The G-Cloud framework exists so that government buyers can purchase cloud hosting, software, and support services from pre-approved suppliers through a digital catalogue instead of running full tender exercises for every contract. Ninety per cent of suppliers on the Digital Marketplace are small and medium-sized enterprises. The framework was explicitly designed to open public sector procurement to firms that do not have a dedicated bid team, a compliance department, or a track record of winning government contracts. If you run a UK MSP with fewer than fifty staff and you sell any form of cloud hosting, managed Microsoft 365, or IT support, you are already delivering the kind of services that public sector buyers search for on this platform. The barrier is not your size. The barrier is understanding the process, meeting the certification requirements, and writing a service listing that surfaces when a council IT manager searches for what you actually do. The Procurement Act 2023, which came into force in February 2025, was designed in part to simplify the process for smaller suppliers. Annual sales through G-Cloud reached two point nine billion pounds in 2024/25. The direction of travel in public sector procurement is toward more SME participation, not less.
What G-Cloud Actually Is and How Buying Works
G-Cloud is a framework agreement managed by Crown Commercial Service. It gives public sector organisations — councils, NHS trusts, government departments, schools, police forces — a pre-approved catalogue of cloud services. When a buyer needs a service, they search the Digital Marketplace, filter by lot and category, compare listings, and award a call-off contract directly to the supplier whose service best fits their requirements. There is no separate tender for each purchase. The buyer picks from the catalogue. This is why your service listing matters more than your ability to write a fifty-page bid document. The call-off process is also simpler than a full procurement exercise. The buyer evaluates your listing against their requirements, may ask clarification questions, and awards the contract. There is no presentation stage, no panel interview, and no competitive dialogue round. For an MSP that has never touched public sector work, this is the gentlest entry point that exists.
The current live framework is G-Cloud 14, which runs until April 2026. G-Cloud 15 opened for supplier applications on 23 October 2025 with a deadline of 30 January 2026 and is expected to go live in September 2026. Each framework iteration runs for roughly eighteen months before the next version replaces it. If you missed the G-Cloud 15 deadline, watch for G-Cloud 16 — CCS typically opens applications twelve to fifteen months before the previous framework expires. The Digital Marketplace itself is a GOV.UK platform at digitalmarketplace.service.gov.uk. You register as a supplier, complete your company profile, and list your services once you are accepted onto the framework. The platform handles search, filtering, and buyer-supplier communication. Think of it as a government-approved marketplace where your services sit alongside every other approved supplier in your lot.
The Lot Structure and Where MSPs Fit
G-Cloud 15 splits into three lots with sub-categories. Lot 1 covers cloud hosting — infrastructure as a service and platform as a service. Lot 1a is for standard cloud hosting; Lot 1b is for large-scale hosting with an insurance requirement above seventy-five million pounds, which rules out all but the largest providers. Lot 2 covers cloud software as a service, split into Lot 2a for infrastructure-focused SaaS and Lot 2b for general SaaS applications. Lot 3 covers cloud support — professional services, consultancy, migration, and ongoing management.
For a typical UK MSP selling managed Microsoft 365, Azure hosting, backup, security monitoring, and IT support, the relevant lots are Lot 2b for any SaaS-based service you wrap and resell, and Lot 3 for your managed services, migration projects, and ongoing support contracts. Lot 3 is where the bread-and-butter MSP work sits. If you run hosted infrastructure on Azure or AWS for clients, Lot 1a applies as well. Do not try to list under every lot. Pick the one or two lots that match what you already deliver to your commercial clients today. A focused application for one lot with a well-written service listing will outperform a scattered application across three lots with generic descriptions. Before you apply, search the Digital Marketplace for services similar to yours. Look at how your direct competitors have listed their offerings, what pricing models they use, and how they describe their support tiers. This research takes an afternoon and gives you a clear picture of the competitive field you are entering.
Certification Requirements That Trip Up First-Time Applicants
G-Cloud 15 Certification Requirements by Lot
Mandatory certification requirements for each G-Cloud 15 lot, showing which certifications small MSPs need to prepare before applying.
Source: Crown Commercial Service G-Cloud 15 ITT documentation
G-Cloud 15 introduced mandatory Cyber Essentials certification for all lots. Previous framework iterations made it optional or recommended. Under G-Cloud 15, you need to hold a valid Cyber Essentials certificate or provide evidence that you have started the certification process by the application deadline. CCS will check. Suppliers who fail to provide a valid certificate within twelve months of the framework award date get suspended.
For Lots 1a and 1b, Cyber Essentials Plus is required — that means an external assessment, not just the self-assessment questionnaire. For Lots 2a, 2b, and 3, standard Cyber Essentials is the minimum, but any subcontractors processing personal or OFFICIAL-classified data also need their own certificate.
Beyond Cyber Essentials, G-Cloud 15 expanded the number of mandatory ISO accreditations. The specific requirements depend on the lot, but ISO 27001 for information security management is the one that catches unprepared MSPs. If you do not hold ISO 27001, check whether your lot requires it and budget for the audit — first-time certification typically costs between eight thousand and fifteen thousand pounds for a firm under fifty staff, and the process takes six to nine months.
If you already hold Cyber Essentials and ISO 27001, you are ahead of a large proportion of potential applicants. If you do not, start the Cyber Essentials process immediately — it can be completed in a few weeks — and begin scoping ISO 27001 if your target lot requires it. Budget around three hundred to five hundred pounds for the standard Cyber Essentials self-assessment through an IASME-accredited body, or between one thousand five hundred and three thousand pounds for Cyber Essentials Plus with the external vulnerability scan and on-site technical audit. These are sunk costs regardless of whether you win work through the framework, because both certifications strengthen your commercial proposition to private sector clients as well.
Writing a Service Listing That Public Sector Buyers Actually Find
Your service listing is your shopfront on the Digital Marketplace. Buyers search by keyword, filter by lot and category, and read your listing summary before deciding whether to look further. A poorly written listing means you never appear in search results, regardless of how good your service actually is.
The listing has three components: a summary that appears in search results, a features and benefits section, and a full service definition document that buyers download. The summary is the critical piece. Write it in plain language that matches the way a council IT manager would search — not the way a marketing team would describe your service. If you provide managed Microsoft 365 administration for organisations with fifty to five hundred users, say exactly that. Do not say you offer a unified digital workplace platform. A buyer searching for Microsoft 365 migration support will type those exact words. If your listing summary does not contain those words, you will not appear. Structure your summary around the buyer question: what do you do, for whom, at what scale, in which geography, and at what price point.
Include specific details in your summary: the technologies you support, the size of organisation you typically serve, your geographic coverage, your pricing model, and your support hours. Public sector buyers filter heavily on these criteria. A listing that says you provide twenty-four-seven UK-based support for Microsoft 365 tenants including Exchange Online, SharePoint, Teams, and Intune at a fixed per-user monthly price will outperform a vague listing about cloud solutions every time.
Price your listing carefully. G-Cloud operates on a published price basis — the price in your listing is the maximum you can charge for that service. You can discount below your listed price on individual call-off contracts but you cannot charge above it. Set your prices to reflect your standard commercial rates. Do not underprice to win your first contract because you will be locked into that ceiling for the duration of the framework.
How the Money Flows on a G-Cloud Contract
G-Cloud Sales by Supplier Size (Last Five Years)
Breakdown of G-Cloud framework sales showing SME share of total spend over the past five years, based on Crown Commercial Service data.
Source: Crown Commercial Service / Digital Marketplace analytics
When a public sector buyer awards you a call-off contract through G-Cloud, the contract is directly between you and the buying organisation. CCS is not a middleman. You invoice the buyer directly, on whatever terms the call-off contract specifies — typically thirty-day payment terms, though some public sector bodies pay within fourteen days under the prompt payment code.
There is no commission or fee payable to CCS for sales made through G-Cloud. The framework is free to join and free to sell through. Your only costs are the time spent on your application and maintaining the required certifications.
Contract values on G-Cloud range from a few thousand pounds to tens of millions. The average call-off contract for cloud support services is in the range of twenty thousand to one hundred thousand pounds annually, but there is no minimum. A small council buying managed 365 support for eighty users is a perfectly normal G-Cloud transaction. One advantage of public sector clients that MSPs often overlook is payment reliability. Government bodies do not go bust mid-contract. They may pay slowly — net thirty is standard — but they pay. For an MSP that has experienced bad debt from commercial clients, the predictability of public sector revenue is worth the administrative overhead of the framework. Call-off contracts can run for up to two years with options to extend, depending on the buying organisation and the value of the contract. Renewals are common if the service has been delivered well, and existing public sector clients frequently buy additional services from suppliers they already trust on the framework.
G-Cloud has facilitated over fourteen billion pounds in sales over the past five years, with thirty-seven per cent of that spend going to SMEs. The framework is not a token gesture toward small suppliers — it is a genuine procurement channel that moves real money.
Five Mistakes Small MSPs Make on G-Cloud
First, writing service listings in marketing language instead of plain procurement language. Public sector buyers search for specific services using specific terminology. They search for managed Microsoft 365 support, not digital workplace enablement.
Second, listing one catch-all service instead of separate listings for distinct services. If you offer managed 365, Azure hosting, and cyber security monitoring, create three separate listings. Buyers filter by service type and a single bundled listing gets lost.
Third, ignoring the service definition document. The listing summary gets you found. The service definition document is what the buyer reads before awarding the contract. Treat it like a proposal — include your SLA commitments, onboarding process, escalation procedures, and exit terms.
Fourth, missing the application window. G-Cloud frameworks have fixed application periods. Once the window closes, you wait for the next iteration. Set a calendar reminder for twelve months before the current framework expires and monitor the CCS website for announcements.
Fifth, treating G-Cloud as passive income. Listing your services does not guarantee sales. You still need to market to public sector buyers, attend local government networking events, and respond promptly when buyers contact you through the platform. The listing puts you in the catalogue. You still need to sell. Check your local council and NHS trust procurement portals for upcoming requirements that match your services, and make sure the relevant procurement contacts know you are listed on G-Cloud. A short introductory email pointing a buyer to your Digital Marketplace listing is entirely appropriate and often welcomed.
The Checklist Before You Apply
Before the next G-Cloud application window opens, confirm these items. Do you hold a valid Cyber Essentials certificate — and Cyber Essentials Plus if you plan to apply for Lot 1? Have you checked whether your target lot requires ISO 27001, and if so, is your certification in progress? Have you registered on the Digital Marketplace as a supplier? Have you drafted your service listings using plain language that matches public sector search terms? Have you set your pricing at a level you are comfortable being locked into for eighteen months? Have you prepared a service definition document that covers SLAs, onboarding, support hours, data handling, and exit provisions? Have you checked that your public liability and professional indemnity insurance meets the minimum requirements for your lot? Have you identified three to five public sector organisations in your region that you could realistically serve, so you can tailor your listing to the types of buyer who will find it? Have you reviewed existing listings from competitors on the Digital Marketplace to understand how they describe similar services and price them? Have you confirmed that your team has capacity to respond to buyer enquiries within two working days — because slow responses to call-off opportunities are the fastest way to lose public sector work you have already been shortlisted for?
