G-Cloud 15: What It Is and What Certification Means for Suppliers

G-Cloud 15 is the current framework agreement under the Procurement Act 2023, allowing UK public sector buyers to buy cloud hosting, software, and support services from pre-approved suppliers through a streamlined digital marketplace.

G-Cloud 15, launched in August 2026, is an open framework that will run for four years, with planned reopenings after 18 months and 36 months. This means suppliers that were not appointed during the initial competition will have further opportunities to apply, subject to the requirements published for each reopening. 

Replacing G-Cloud 14, this version introduces a refreshed lot structure, clearer guidance, and updated requirements designed to keep pace with emerging technologies and modern cloud delivery models.

What is a ‘lot’?

A “lot” is a formal category within a public sector framework that groups similar types of services together, helping buyers and suppliers understand where specific offerings sit.​

How do lots interact with G-Cloud 15?

Lots act as the core organising structure of the G-Cloud framework.

Each one has: 

• A defined scope (e.g., cloud hosting, SaaS, cloud support)
• Its own entry requirements
• Specific evaluation and compliance criteria

Suppliers choose the lot – or multiple lots – that best reflect the services they wish to make available to public sector buyers.

What does choosing a ‘lot’ mean for a supplier?

For a supplier, choosing a ‘lot’ means deciding which category best aligns with their offering, ensuring their services appear in the right place when public sector buyers search.

What are the lots in G-Cloud 15?

G-Cloud 15 is structured into the following 5 lots:

• Lot 1a: Cloud hosting IaaS/PaaS
• Lot 1b: Above Official security hosting
• Lot 2a: Infrastructure SaaS
• Lot 2b: General SaaS 
• Lot 3: Cloud support

Government Commercial Agency (GCA) opportunity for suppliers 

The Government Commercial Agency (GCA), which replaced Crown Commercial Service (CCS) on 1st April 2026, positions G-Cloud 15 as a quick route to market for SMEs offering cloud services, providing access to public sector buyers through a large catalogue featuring the latest technology and innovation. 

G-Cloud 15 provides extensive supplier places, reopening after 18 months and 36 months to refresh the framework, and transparent pricing and service information. Together, these features support direct awards and competitions estimated at up to around £14 billion (excluding VAT) over the four-year framework period. 

Requirements can vary between Bid Packs, so always refer to the specific documentation to ensure you are following the most up-to-date guidance. 

For Lots 1a and 1b in particular, requirements also differ according to whether a supplier is reselling services from another cloud service provider or is in sole control of the underlying infrastructure. 

Lot 1a: Cloud Hosting (IaaS/PaaS)

 Required:

For resellers, current G-Cloud 15 requirements include: 

• ISO 9001
• ISO/IEC 27001 (Information Security Management)
• ISO/IEC 20000-1 (IT Service Management, supporting service delivery processes)
• Cyber Essentials Plus

Resellers must also provide information about the cloud service providers they intend to resell and may rely on those providers for some applicable accreditations. 

For suppliers in sole control of the infrastructure, the mandatory certification requirements are broader and include: 

• ISO 9001 
• ISO 14001 
• ISO/IEC 27001 
• ISO/IEC 27017: certification available through Amtivo Ireland  
• ISO/IEC 20000-1: certification available through Amtivo US 
• Cyber Essentials and Cyber Essentials Plus 

This means the exact certification requirements should be checked against the supplier’s delivery model rather than applying a single list to every Lot 1a supplier.

Lot 1b: Above Official security hosting

Lot 1b follows the same distinction between resellers and suppliers in sole control of the infrastructure, with additional requirements applying to higher-security hosting services. 

For suppliers in sole control of the infrastructure, current mandatory certification requirements include: 

• ISO 9001 
• ISO 14001 
• ISO/IEC 27001 
• ISO/IEC 20000-1 
• ISO/IEC 27017 
• ISO/IEC 27018 
• Cyber Essentials Plus 

Resellers should check which accreditations must be held directly and where evidence from the underlying cloud service provider can be used. 

Need to get certified for G-Cloud 15? Start your certification journey with Amtivo today  We can offer package deals for multiple certifications, and with our global network of certification services, can also offer more specific certifications such as ISO 27017, an additional add-on to your ISO 27001-certified management system. Get A Quote

Lot 2a (Infrastructure SaaS), Lot 2b (General SaaS) and Lot 3 (Cloud support)

No mandatory ISO certifications are specified for these lots, however;

• Cyber Essentials was announced as required for all suppliers for G-Cloud 15 as of 5th December 2025. This aligns with the Government’s Commitment to mitigate supply chain security risks.
  • Suppliers awarded a place on the framework for Lots 2a, 2b or 3 are required to obtain a valid Cyber Essentials certificate for themselves and ensure any subcontractors who process personal or OFFICIAL data also hold a Cyber Essentials certificate. 
  • Evidence of certification must be provided within 12 months of the G-Cloud 15 framework award. Suppliers that do not provide the required certification within this period may be suspended from the framework until it is supplied. 
• Cyber Essentials Plus is the enhanced version of Cyber Essentials. It includes an independent, hands-on technical audit of an organisation’s systems to verify that the required security controls are operating effectively in practice, rather than relying solely on self-assessment.
  • Cyber Essentials Plus could benefit G-Cloud 15 by offering a higher level of assurance through independent technical testing, demonstrating that suppliers’ security controls work effectively in real-world conditions.
• ISO 27001, is not mandatory but may be useful when competing in the marketplace.  
  • ISO 27001 is a comprehensive, internationally recognised information security management standard, while Cyber Essentials and Cyber Essentials Plus are UK-focused schemes that verify an organisation has strong core technical controls.
  • Holding ISO 27001 alongside Cyber Essentials or Cyber Essentials Plus can demonstrate both a structured approach to information security management and independently verified technical controls. 

Need Cyber Essentials, Cyber Essentials Plus, or ISO 27001? Get a quote today, and our team will be in touch shortly.

During the original G-Cloud 15 tender process, CCS adjusted its approach to accredited ISO certification requirements for Lots 1a and 1b. 

• The applicable ISO standards remained mandatory, but bidders did not necessarily need to have completed every required certification at the point of tender submission. 
• Bidders could instead provide authorised third-party confirmation from a certification body that the relevant certification process had started. 
• Where a successful bidder had not yet achieved the required certification, its affected services could remain hidden from buyers until the required evidence was provided. 
• G-Cloud 15 is now live, so the original 30th January 2026 tender deadline has passed. Suppliers considering a future reopening should check the GCA documentation published for that reopening, as evidence requirements and timelines may change. 

What about ISO 20000-1 timelines for SMEs?

• ISO/IEC 20000-1 remains one of the mandatory certification requirements for the G-Cloud 15 hosting lots. The exact requirements depend on the supplier model, including whether the organisation is acting as a reseller or is in sole control of the infrastructure. 

• The original tender deadline has now passed. Organisations considering applying at a future G-Cloud 15 reopening should check the applicable GCA documentation for the certification evidence and timelines required at that point. 

Cyber Essentials vs Plus for Lot 2b?

• Cyber Essentials is required for suppliers appointed to Lots 2a, 2b and 3. Suppliers appointed during the original competition have 12 months from the framework award date to provide evidence of certification. 
• Cyber Essentials Plus is not mandatory for Lots 2a, 2b or 3, although suppliers may choose to hold it. Cyber Essentials Plus is mandatory for Lots 1a and 1b. 

Are British Standard certification details required?

• BS 7858:2019 is referenced for staff screening in Lot 3, but non-conformance is not considered a failing requirement. 
• There are no broad British Standard mandates; requirements apply only to specific processes.

Will the CCS Accept the ITIL Maturity Model instead of the ISO/IEC 20000-1 2018?

• G-Cloud 15 requires suppliers to hold ISO/IEC 20000-1:2018, and therefore the ITIL Maturity Model is not considered a substitute for a required certification.
• ISO/IEC 20000-1:2018 is therefore a specific certification requirement for relevant G-Cloud 15 suppliers rather than something that can be replaced by an alternative service management model. 

If third-party cloud platforms (e.g., AWS) hold certification, can suppliers rely on the platform provider’s certification, or must the supplier hold their own certification? 

It depends on the supplier model. G-Cloud 15 distinguishes between suppliers that are in sole control of the infrastructure and those acting as resellers. 

Resellers can rely on the underlying cloud service provider for some applicable accreditations. However, current G-Cloud 15 requirements also require resellers to provide their own evidence for standards including ISO 9001, ISO/IEC 27001 and ISO/IEC 20000-1. 

A platform provider’s certification therefore does not automatically replace all of the supplier’s own certification responsibilities. Suppliers should check the requirements that apply to their particular delivery model. 

If your organisation is reviewing the certification requirements relevant to G-Cloud 15 or another public sector procurement opportunity, request a quote today to find out more about the certification services available from British Assessment Bureau.