IT providers for the public sector

What to look for in a public sector IT provider

Public bodies buy under scrutiny. These are the areas that tend to matter most.

Ready-made procurement evidence

Public procurement asks suppliers to demonstrate capability during the tender, not after it. A provider who keeps their security evidence current can hand you what you need when a bid is due, rather than scrambling to pull it together.

Cyber Essentials in place

Cyber Essentials is a requirement in a range of central government contracts. A provider that already holds it, and keeps it live, removes one common hurdle from your procurement paperwork.

Familiarity with buying frameworks

Public bodies often buy IT through frameworks such as those run by the Crown Commercial Service, including G-Cloud. A provider who has sold through these before understands the format and the expectations, which smooths the whole process.

Awareness of the CAF

The NCSC Cyber Assessment Framework is used across parts of government and critical services. A provider who understands the CAF can talk about security in terms your assessors already recognise.

Care with citizen data

Public bodies handle citizen data under UK GDPR, which carries clear duties. Ask a provider how they control access to that data and how they'd support you if you had to account for it.

Questions to raise during selection

Put these to a provider before you commit. Their answers shape how your next tender goes.

1. Can you give us current evidence of your security controls we can use in a tender? Procurement wants proof during the bid, so ready evidence saves you time and stress.
2. Do you hold Cyber Essentials, and do you keep it current? It's a requirement in many central government contracts, so a lapsed certificate can cost you.
3. Have you supplied through Crown Commercial Service frameworks like G-Cloud before? Framework experience means a provider knows the format your buying team works with.
4. How does your security map against the NCSC Cyber Assessment Framework? Speaking the CAF's language makes it easier for your assessors to check your position.
5. How do you control and log access to the citizen data you'd handle for us? You're accountable for that data, so access needs to be tight and traceable.
6. How quickly can you answer a supplier assurance questionnaire? These land on tight deadlines, so a fast, accurate turnaround matters more than it sounds.

The procurement reality in the public sector

Buying IT in the public sector runs through procurement, and procurement runs on evidence. Public procurement asks suppliers to demonstrate capability during the tender, not once the contract is signed, so the assurance questions arrive early and expect solid answers.

Some of those answers are set by scheme. Cyber Essentials is a requirement in a range of central government contracts, so it turns up regularly in bid documents. Much of the buying itself happens through frameworks such as those run by the Crown Commercial Service, including G-Cloud, which have their own format and their own expectations.

Security gets its own reference point too. The NCSC Cyber Assessment Framework is used across parts of government and critical services, so it shapes how many public bodies talk about risk. And underneath everything, public bodies handle citizen data under UK GDPR, which sets clear duties on how that information is held and protected. A provider who understands all of this makes each tender less of a standing start.

How Assurix relates to public sector buying

Assurix is an independent trustmark for UK IT providers, built on proof rather than promises. The Trusted MSP badge means a provider has passed all 59 controls, aligned to the NCSC Cyber Assessment Framework v4, and is checked continuously with an annual reassessment. Providers working toward it are listed as On the Journey within a six-month window. For a public body facing regular assurance questions, that kind of ongoing evidence is the sort of thing procurement likes to see.

Frequently asked questions

Why does procurement want security evidence up front?

Because public procurement asks suppliers to demonstrate capability during the tender, not after the contract is awarded. The idea is that a buyer can compare bids on what each supplier can actually show, so the assurance questions land while you're still bidding. For a public body, that means keeping your own evidence current, and choosing an IT provider who can hand over theirs on request. When both are ready, a tender that would otherwise cause a scramble becomes far more manageable.

Is Cyber Essentials required for public sector contracts?

It's a requirement in a range of central government contracts, so it comes up often in bid documents. Cyber Essentials is a recognised baseline that shows a supplier has some sensible protections in place. If your IT provider holds it and keeps it live, that's one box already ticked when a tender asks about it. Worth remembering that it's a point-in-time certificate, so it needs renewing, and a lapsed one can trip you up at exactly the wrong moment.

What are Crown Commercial Service frameworks and G-Cloud?

Public bodies often buy IT through frameworks such as those run by the Crown Commercial Service, and G-Cloud is one of them. A framework is a pre-arranged route to market that sets out terms and lets buyers choose from suppliers who've already been assessed against it. It can make buying quicker and more consistent than running a full open tender each time. A provider who has supplied through these frameworks before understands the format, which makes the paperwork and the expectations easier to handle.

What is the NCSC Cyber Assessment Framework?

The Cyber Assessment Framework, or CAF, comes from the National Cyber Security Centre and is used across parts of government and critical services. It sets out a structured way to think about cyber risk and resilience, organised around outcomes rather than a simple checklist. Because it's widely recognised in the sector, a provider who understands the CAF can describe their security in terms your assessors already know. The Assurix Trustmark is aligned to version 4 of the CAF, which keeps that shared language consistent.

How should I read a provider's Assurix status here?

A provider that has completed the Assurix process carries the Trusted MSP badge and is shown first. Providers working toward the badge are listed as On the Journey within a six-month window. On the Journey isn't a pass, so treat it as a signal of intent rather than a finished result. The remaining providers are listed as not yet Assurix-verified, which is a neutral status. Many are capable, experienced firms who simply haven't been through Assurix. Use the questions on this page to check the areas that matter for your tenders.

Related pages

• Healthcare IT providers
• Education IT providers
• Non-profit IT providers
• Financial services IT providers
• IT providers in London
• IT providers in Scotland