G-Cloud 15: What It Is and What Certification Means for Suppliers

The G-Cloud 15 deadline is approaching on 30th January 2026. With the Commercial Crown Service (CCS) now allowing certifications to be “in progress” rather than fully completed, more businesses may be able to start their applications.

G-Cloud 15 is the latest framework agreement under the Procurement Act 2023, allowing UK public sector buyers to buy cloud hosting, software, and support services from pre-approved suppliers through a streamlined digital marketplace. G-Cloud is only reviewed every couple of years, so if you miss the G-Cloud 15 deadline, you’ll be waiting until at least 2027 for your next chance to become listed on a marketplace that has facilitated over £20 billion of public sector spend.

Replacing G-Cloud 14, this version introduces a refreshed lot structure, clearer guidance, and updated requirements designed to keep pace with emerging technologies and modern cloud delivery models.

What is a ‘lot’?

A “lot” is a formal category within a public sector framework that groups similar types of services together, helping buyers and suppliers understand where specific offerings sit.​

How do lots interact with G-Cloud 15?

Lots act as the core organising structure of the G-Cloud framework.

Each one has: 

• A defined scope (e.g., cloud hosting, SaaS, cloud support)
• Its own entry requirements
• Specific evaluation and compliance criteria

Suppliers choose the lot – or multiple lots – that best reflect the services they wish to make available to public sector buyers.

What does choosing a ‘lot’ mean for a supplier?

For a supplier, choosing a ‘lot’ means deciding which category best aligns with their offering, ensuring their services appear in the right place when public sector buyers search.

What are the lots in G-Cloud 15?

G-Cloud 15 is structured into the following 5 lots:

• Lot 1a: Cloud hosting IaaS/PaaS
• Lot 1b: Above Official security hosting
• Lot 2a: Infrastructure SaaS
• Lot 2b: General SaaS 
• Lot 3: Cloud support

Crown Commercial Service (CCS) opportunity for suppliers

CCS positions G-Cloud 15 as a quick route to market for SMEs offering cloud services, providing access to public sector buyers through a large catalogue featuring the latest technology and innovation.

G-Cloud 15 provides extensive supplier places, scheduled reopenings every 18 months to refresh the framework, and transparent pricing and service information. Together, these features support direct awards and competitions estimated at up to around £14 billion (excluding VAT) over the four-year framework period.

Requirements can vary between Bid Packs, so always refer to the specific documentation to ensure you are following the most up-to-date guidance. 

Generally, the certifications outlined below are either required or strongly recommended for suppliers, helping them remain competitive and demonstrate the appropriate level of assurance in the marketplace.

Lot 1a: Cloud Hosting (IaaS/PaaS)

 Required:

• ISO/IEC 27001 (Information Security Management)
• ISO/IEC 20000-1 (IT Service Management, supporting service delivery processes)
• Cyber Essentials Plus

Strongly recommended / commonly used to demonstrate assurance:

• ISO/IEC 27017 (Cloud-specific security controls)

Suppliers must hold, or provide evidence that they have started the certification process (via a certification body, such as Amtivo) by the 30th January 2026 tender deadline. Uncertified services stay invisible to buyers until certified.

Lot 1b: Above Official security hosting

 Required:

• ISO/IEC 27001
• ISO/IEC 20000-1
• Cyber Essentials Plus

Strongly recommended / commonly expected for higher-assurance environments:

• ISO/IEC 27017

This lot has a stronger security focus for sensitive environments and requires these certifications either at bid or confirmed shortly after the deadline, before award. Services remain hidden until compliance is achieved.

Need to get certified for G-Cloud 15? Start your certification journey with Amtivo today  We can offer package deals for multiple certifications, and with our global network of certification services, can also offer more specific certifications such as ISO 27017, an additional add-on to your ISO 27001-certified management system. Get A Quote

Lot 2a (Infrastructure SaaS), Lot 2b (General SaaS) and Lot 3 (Cloud support)

No mandatory ISO certifications are specified for these lots, however;

• Cyber Essentials was announced as required for all suppliers for G-Cloud 15 as of 5th December 2025. This aligns with the Government’s Commitment to mitigate supply chain security risks.
  • They have also announced that suppliers awarded a place on the framework for both Lots 2a, 2b or 3 will be required to obtain a valid Cyber Essentials certificate for themselves and ensure any subcontractors who process personal or official data also hold a Cyber Essentials certificate.
  • Suppliers must obtain and provide this certification to the CCS within 12 months of the award date. If they do not, they will be suspended from the framework. They can be reinstated once the certification is supplied.
• Cyber Essentials Plus is the enhanced version of Cyber Essentials. It includes an independent, hands-on technical audit of an organisation’s systems to verify that the required security controls are operating effectively in practice, rather than relying solely on self-assessment.
  • Cyber Essentials Plus could benefit G-Cloud 15 by offering a higher level of assurance through independent technical testing, demonstrating that suppliers’ security controls work effectively in real-world conditions.
• ISO 27001, is not mandatory but may be useful when competing in the marketplace.  
  • ISO 27001 is a comprehensive, internationally recognised information security management standard, while Cyber Essentials and Cyber Essentials Plus are UK-focused schemes that verify an organisation has strong core technical controls.
  • Buyers may view an organisation that holds both ISO 27001 and Cyber Essentials (or Cyber Essentials Plus) as demonstrating a more robust and mature approach to information security.

Need Cyber Essentials, Cyber Essentials Plus, or ISO 27001? You can start the journey with Amtivo for all three certifications. Get a quote today, and our team will be in touch shortly.

CCS has reviewed current market capability and decided to adjust its approach to accredited ISO certification requirements for lots 1a and 1b.

• ISO standards remain mandatory, but bidders do not need to already hold the certifications at the time of tender submission.
• Instead, bidders must provide authorised third-party confirmation (from an ISO certification body) that they have started the certification process.
  • This confirmation must be submitted before 30th January 2026 and must clearly name each required ISO standard.
• Bidders who are already certified may submit their certificates with the tender as originally required.
• If a bidder is successful but not yet certified, their services will remain hidden from buyers until CCS receives evidence that certification has been achieved.
• If certification is obtained after the tender deadline but before contract award, bidders may submit the certificates via the Digital Platform messaging system.

What about ISO 20000-1 timelines for SMEs?

• As ISO 20000-1 is mandated, particularly for Lots 1a and 1b, SMEs must ensure their certification journey has begun by the deadline. Full certification is required before services become visible on the framework. These timelines have not been relaxed, despite the time constraints SMEs may face.​

Cyber Essentials vs Plus for Lot 2b?

• Cyber Essentials and Cyber Essentials Plus are optional for Lots 2a, 2b, and 3. Questions are independent – suppliers must state Yes/No with a certificate number for Cyber Essentials Plus, or provide a reason if the certificate is not held. 
• Cyber Essentials Plus is recommended for higher assurance and will be visible to buyers. Cyber Essentials Plus is mandatory for Lots 1a and 1b.​

Are British Standard certification details required?

• BS 7858:2019 is referenced for staff screening in Lot 3, but non-conformance is not considered a failing requirement. 
• There are no broad British Standard mandates; requirements apply only to specific processes.

Will the CCS Accept the ITIL Maturity Model instead of the ISO/IEC 20000-1 2018?

• G-Cloud 15 requires suppliers to hold ISO/IEC 20000-1:2018, and therefore the ITIL Maturity Model is not considered a substitute for a required certification.
• However, ISO/IEC 20000-1:2018 remains a highly recognised standard for demonstrating strong service management capability. It is mandated for some lots, so suppliers need to obtain it as part of their assurance strategy for participation in the framework.

If third-party cloud platforms (e.g., AWS) hold certification, can suppliers rely on the platform provider’s certification, or must the supplier hold their own certification?

Suppliers cannot rely solely on a platform provider’s certifications to meet G-Cloud assurance expectations. ISO 20000-1 is a required certification for Lots 1a and 1b, buyers and the CCS expect suppliers to demonstrate their own service management and security practices rather than depending exclusively on those of AWS, Azure, or other cloud platforms.

Platform certifications can support a supplier’s evidence pack, but they do not replace the supplier’s own responsibilities for service delivery, management, and compliance under G-Cloud.

Amtivo is a global ISO certification provider that can help your business on its journey to certification.

We have options available for organisations seeking multiple certifications. Request a quote today and our team will be in touch to guide you through the next steps.