How to write a winning IT services tender

The public sector spends heavily on technology: managed IT services, service desks, cloud hosting, software licences, cyber security, networks, devices and digital delivery teams. Councils, NHS trusts, schools, universities, police forces and central government departments all buy it, and much of it is within reach of regional IT firms, managed service providers and specialist software companies.

IT tenders have their own vocabulary, their own frameworks and a heavy focus on security and data. This guide walks through how to write a public sector IT services bid that scores well: where the work is bought, how to answer the technical and service questions, how to price it, the evidence you'll need, and the mistakes that sink otherwise strong technology firms.

Where public sector IT work is bought

IT services reach the market through several routes:

• Frameworks run by the Government Commercial Agency (formerly Crown Commercial Service), such as G-Cloud for cloud hosting, software and support, and Digital Outcomes and Specialists 7 for digital delivery teams and specialists. Buyers across the public sector can call off from them.
• Sector frameworks and consortia, used heavily by councils, the NHS, education and housing.
• Open and competitive tenders advertised on Find a Tender and Public Contracts Scotland, often for managed services, service desks and larger system replacements.
• Dynamic markets, which suppliers can join at any time.

If you're new to public sector IT, G-Cloud is often the most accessible way in, because for simpler needs buyers can award to you without running a further competition. It only takes new suppliers when it reopens: G-Cloud 15 started in August 2026 and is due to reopen around February 2028. Just remember that being listed isn't the same as being bought: you still need to make your service easy to find and easy to choose.

What's in an IT services tender pack?

Expect an invitation to tender, a specification or statement of requirements, a selection questionnaire, quality questions, a pricing schedule, a data protection schedule and the contract terms. Larger contracts may add a security questionnaire, a service level agreement with service credits, an exit plan template and a requirement for a demonstration or presentation.

Build a compliance checklist first: every document, every question, every word limit and every weighting. On IT tenders, also list every mandatory requirement in the specification. Many are pass or fail, and missing one can disqualify the bid.

Writing the IT method statement

IT quality questions tend to cluster around a handful of themes. Answer each one in the buyer's terms, not your sales deck's.

Understanding the requirement and your solution

Open by restating the buyer's problem in your own words: what they run today, what's going wrong and what success looks like. Then describe your solution against it, requirement by requirement. Evaluators often score with the specification open beside them, so make it easy for them to tick each line. Explain any acronyms and avoid product jargon. The person scoring may be a service manager, not an engineer.

Implementation and transition

Buyers worry most about the switchover. Set out a phased plan: discovery, design, build or configuration, testing, data migration, training, go-live and early-life support. Explain how you'll work with the outgoing supplier, protect service continuity and roll back if something goes wrong. If staff transfer under TUPE, show you've accounted for it.

Service management and service levels

Describe how the service will run day to day: service desk hours and channels, incident priorities and response and resolution targets, escalation routes, change and problem management, and reporting. If you follow ITIL practices, say how they apply here rather than just naming the framework. Show how you'll meet the buyer's service levels and what happens if you don't.

Security

Security answers are where generic copy is most obvious. Explain how you protect the buyer's systems and data: access control, encryption, patching, vulnerability management, monitoring, incident response and business continuity. Reference the accreditations you hold, such as Cyber Essentials or Cyber Essentials Plus and ISO 27001, and, for cloud services, how you align with the NCSC's Cloud Security Principles. Say where data is hosted. If staff need security checks, such as BPSS screening or SC clearance, say how many already hold them.

Data protection

Most IT contracts make you a data processor under UK GDPR. Explain how you'll process data only on the buyer's instructions, support data protection impact assessments, manage sub-processors, handle subject access requests and report breaches.

Accessibility and user experience

Public sector websites and apps must meet the Public Sector Bodies (Websites and Mobile Applications) (No. 2) Accessibility Regulations 2018, which in practice means WCAG 2.2 AA. If you build or supply anything citizens or staff use, explain how you design, test and maintain accessibility. For digital delivery work, show familiarity with the GOV.UK Service Standard and user-centred, agile delivery.

Social value, continuous improvement and exit

Explain how you'll improve the service over the contract term: regular reviews, innovation proposals, cost reductions. Buyers are also wary of lock-in, so describe how you'll hand over data, documentation and knowledge at exit, in open formats. Social value is usually its own question; our guide to writing a social value response covers it.

Pricing an IT services tender

Use the buyer's structure. IT pricing schedules typically separate one-off implementation costs, recurring service or licence charges, and day rates for additional work. Fill in every cell in the format requested.

Be transparent about assumptions. If your price depends on user numbers, device counts, data volumes or service hours, state them where the buyer allows it, and make sure they match the specification.

Price the whole term. Include annual uplifts, licence renewals and any third-party costs over the full contract length. Buyers increasingly compare whole-life cost, and a low year-one price with steep renewals won't survive scrutiny.

Set a sensible rate card. For day-rate work, buyers often ask for rates by role, sometimes mapped to SFIA skill levels or to the government's Digital and Data Profession Capability Framework. Keep rates consistent with your framework listings, because buyers check.

Avoid hidden extras. Charges for onboarding, data exports at exit or out-of-hours support that only appear in the small print damage trust and can lose you the contract later.

Make sure the price matches the solution. If your method statement promises a dedicated service manager and 24/7 monitoring, the pricing needs to pay for them.

The evidence buyers ask for

• Cyber Essentials: required for many central government and NHS contracts, such as those that involve handling personal information or ICT systems that hold OFFICIAL data, and commonly asked for elsewhere. Cyber Essentials Plus is often preferred.
• ISO 27001 for information security, and ISO 9001 for quality, particularly on managed services.
• Insurance: professional indemnity, public liability, employer's liability and, increasingly, cyber insurance. Under the Procurement Act these may only be required at award.
• Policies: information security, data protection, business continuity, acceptable use, equality and modern slavery.
• Accounts: usually two or three years.
• Case studies and references: similar services, user numbers and sectors, with a named referee.
• Carbon Reduction Plan: required for in-scope central government contracts worth more than £5 million a year.

Common mistakes in IT bids

Pasting in the sales brochure. Feature lists don't answer questions. Evaluators score how you'll meet their requirements, in their environment.

Too much jargon. If the scorer can't follow it, they can't award marks for it. Explain the technology in plain English and tie it to outcomes.

Generic security answers. "We take security seriously" scores nothing. Specific controls, accreditations and examples score well.

Skipping exit. Buyers have been burned by lock-in. A clear exit plan builds confidence.

Forgetting accessibility. For anything user-facing, accessibility is a legal duty for the buyer, so it matters to them.

Pricing that doesn't match the answer. Inconsistency between the solution and the price is a red flag for evaluators and commercial teams alike.

Where Jonty fits

Finding IT tenders is the easy part. Writing them, with security schedules, service levels, data protection questions and pricing models to align, is what keeps many technology firms out of public sector work. Jonty is an AI bid manager built to take that paperwork off your desk.

Jonty Scout finds the IT contracts that fit what you sell across sources such as Find a Tender, Contracts Finder, Public Contracts Scotland and TED for EU work, and emails you the ones worth bidding for, with a note on why. It comes with a 21-day free trial.

With Jonty Bid Manager, Jonty reads the tender pack, builds the compliance checklist, drafts the method statement, security and social value answers from your own evidence, helps you work through the pricing schedule and handles the portal submission. Nothing goes to a buyer until you've approved it. Jonty does the paperwork. You do the work.

IT services tender FAQs

Is G-Cloud worth joining?

For most IT firms selling cloud hosting, software or support, yes. It's one of the most accessible routes into public sector IT, but you can only join when it reopens, and buyers still need to find and choose you. Prepare ahead of the next reopening, due around February 2028, and write clear, specific service descriptions.

Do I need Cyber Essentials to bid for public sector IT work?

Many central government and NHS contracts require it, and other buyers ask for it often. It's relatively quick to achieve, so get it before you start bidding.

Which CPV codes cover IT services?

IT services sit under CPV division 72000000, covering consulting, software development, internet and support. Software packages sit under 48000000.

More bid guides

• How to write a winning cleaning tender
• How to write a winning construction tender
• How to write a winning social value response