Software
Tendering for public sector software and IT
Software and IT tenders ask two questions before any other: can we trust you with our data, and will what you build work for everyone who has to use it. Security and accessibility are often pass/fail, so a strong answer elsewhere can't make up for a missing certificate or statement.
Both have clear rules in the UK, set out below with the official wording, so you can see what will be asked and prepare it once.
What do public buyers ask for in software tenders?
Cyber Essentials, when you handle personal data
Central government and NHS buyers ask for Cyber Essentials, or Cyber Essentials Plus, on contracts where you'll handle personal information or supply systems that store official data. It must be renewed every year of the contract. If you don't hold it, you can show equivalent controls instead.
“where ICT systems and services are supplied which are designed to store, or process data at the OFFICIAL level”
GOV.UK, PPN 014: Cyber Essentials scheme, 17 February 2025 Not on every contract
The same rule tells buyers not to ask for Cyber Essentials as a matter of course, so it shouldn't appear where you won't touch personal data or official systems. If it does, it's a fair clarification question.
“In-scope organisations must not take a blanket approach.”
GOV.UK, PPN 014: Cyber Essentials scheme, 17 February 2025 Accessibility to WCAG 2.2 AA
A public sector website or app has to meet the WCAG 2.2 AA standard and publish an accessibility statement. If you build or run one for a public buyer, expect to show how you test for accessibility and fix what fails.
“meet the Web Content Accessibility Guidelines (WCAG) 2.2 AA accessibility standard”
GOV.UK, Understanding accessibility requirements for public sector bodies, 30 September 2024 Products named in the specification
Where a specification names a product or brand, the buyer must accept alternatives that are shown to be equivalent. If yours does the same job, say so, and show how.
“…demonstrate equivalence will not be disadvantaged…”
GOV.UK, Guidance: Technical Specifications, 13 July 2026 Dynamic markets you can join at any time
Some public software and IT is bought through dynamic markets: lists of qualified suppliers that stay open to new members while they run, unlike most frameworks. Joining one can put you in front of buyers without waiting for a framework to re-open.
“A dynamic market under the Procurement Act 2023 (Act) is a list of qualified suppliers”
GOV.UK, Guidance: Dynamic Markets, 13 July 2026
Quotes are word for word from their sources, checked on 1 November 2026. A tender’s own documents are what count; terms are explained in the glossary.
What should you have ready?
- Your Cyber Essentials or Cyber Essentials Plus certificate, or evidence of equivalent controls
- An accessibility statement, or the results of your latest accessibility audit
- Your information security, data protection and business continuity policies
- Case studies of similar systems, with service levels you met and a client contact
How does TenderSeal help with software tenders?
Security and accessibility requirements are easy to miss in a long pack. TenderSeal's Read summary lists the pass/fail questions, like the Cyber Essentials Plus requirement on our sample IT tender, and Go/No-Go shows whether your documents meet each one. Ask finds the clause and its page when you need to check the detail.
Other sectors: Construction · Engineering · Consultancy · Leadership training and development