Selling to the public sector has a reputation for being slow, complicated, and stacked in favour of big suppliers. G-Cloud is the UK government's attempt to fix exactly that, and small businesses are its biggest winners. This guide explains what G-Cloud 15 is, how it works, and what it means for you, without the jargon.
If you have read the detailed, technical guides and come away more confused than when you started, this is the version to start with.
What Is G-Cloud, in Plain English?
Think of G-Cloud as an app store for the public sector.
Instead of every council, NHS trust, or government department running its own lengthy tender every time it needs some cloud software or hosting, they browse a ready-made catalogue of pre-approved suppliers and simply pick one. The catalogue lives on a government website called the Digital Marketplace. Suppliers list their services, buyers search, compare, and buy.
That is the whole idea: less paperwork, faster buying, and a level playing field where a five-person software company can appear next to a global corporation and win the work.
G-Cloud has run since 2012, and the numbers show why small businesses pay attention:
- More than nine in ten suppliers on the framework are small and medium-sized businesses.
- Billions of pounds of public money flow through it every year.
- The buyers include central government, local councils, NHS trusts, schools and universities, police forces, and more.
"G-Cloud 15" is simply the fifteenth version of this catalogue. Each version runs for a few years, then the government refreshes it with updated rules and a new intake of suppliers.
In One Line
G-Cloud is a government-run catalogue that lets public bodies buy cloud services quickly, and it is deliberately built to be accessible to small suppliers.
What G-Cloud 15 Covers: The "Lots" Explained
A framework this big has to be organised, so it is split into categories called "Lots." The easiest way to picture a Lot is as an aisle in a supermarket: each one groups together a particular type of product so buyers can find what they need.
G-Cloud 15 has been restructured compared with earlier versions. Here are its Lots in plain terms.
| Lot | What it is called | What it actually means | Example |
|---|---|---|---|
| 1a | Cloud hosting (general) | Renting computing power, storage, or platforms to run software on | A company offering secure cloud servers to a council |
| 1b | Cloud hosting (higher security) | The same as 1a, but for more sensitive government information | Hosting for data above the standard government security level |
| 2a | Cloud software (infrastructure and service management) | Subscription software that helps run IT systems | An IT monitoring or service-desk tool |
| 2b | Cloud software (everything else) | Any other ready-to-use subscription software | A case-management app, a CRM, an analytics dashboard |
| 3 | Cloud support | Help getting cloud services set up, migrated, secured, or managed | A consultancy that moves a department's systems to the cloud |
Two changes are worth knowing if you have looked at older G-Cloud guides. The previous "Lot 4" for complex services has been removed, and a separate government framework for raw computing power has been folded into G-Cloud 15. In practice, most small software and support businesses will be looking at Lots 2a, 2b, or 3.
Why G-Cloud 15 Is a Real Opportunity for Small Businesses
Getting listed is work, so it is fair to ask what you get in return. Four things stand out.
Speed. Once you are on the framework, a buyer can hire you without running a full tender. For a small business, that removes one of the biggest barriers to public sector work: the months of bidding effort that larger competitors can absorb more easily than you can.
Built-in trust. To get listed, you have to pass checks on security, finances, and terms. That means when a buyer sees you on G-Cloud, a lot of their due diligence is already done. Being on the framework is a bit like having a pre-approved mortgage: the hard credibility questions have been answered before the conversation even starts.
Visibility. The Digital Marketplace puts your service in front of tens of thousands of public sector buyers nationwide. For a young company, that reach is very hard to build on your own.
Scale. G-Cloud 15 is the largest version yet, valued at up to £14 billion over four years. Public sector demand for cloud services keeps growing, even when budgets are tight.
There is an honest counterpoint, though. G-Cloud 15 has raised the bar. The checks are tougher than before, and some of the requirements (particularly around certifications, financial standing, and insurance) are harder for the very smallest firms to meet. That is not a reason to walk away. It is a reason to prepare properly, and to know what you need before you start.
What You Need to Get Listed
This is where many first-time applicants get stuck, because the single biggest hurdle is usually certification. If you take one thing from this guide, make it this: certifications take months to achieve, so they are the part to start on first.
Broadly, to list on G-Cloud 15 you need to show:
- A track record of delivering similar services (typically over the last three years).
- Appropriate insurance cover.
- Sound finances, checked more closely for the hosting Lots.
- The right security and management certifications for your Lot.
- Supporting documents such as a carbon reduction plan and a modern slavery statement.
The Certification Part (Where ISO Comes In)
Certifications are independent stamps of approval that prove your business meets a recognised standard. G-Cloud 15 asks for different ones depending on the Lot.
| Certification | What it proves | Where it is needed on G-Cloud 15 |
|---|---|---|
| Cyber Essentials | A basic, government-backed level of cyber security | The minimum expected across the Lots |
| Cyber Essentials Plus | The same, but independently tested rather than self-assessed | Required for the cloud hosting Lots |
| ISO 27001 | A full, audited system for managing information security | Not always mandatory, but the trust signal buyers most often look for |
| ISO 20000-1 | A recognised system for managing IT services well | Required for the cloud hosting Lots |
A note on the difference, because it trips people up. Cyber Essentials is a UK government scheme, not an ISO standard. ISO 27001 and ISO 20000-1 are international standards, audited by an independent certification body. They take longer to achieve but carry more weight, and ISO 27001 in particular has become the certification public sector buyers expect to see.
If you do not yet hold these, that is completely normal, and it is the right place to begin. As a rough guide, a small business should budget from around £5,000 to £15,000 (roughly $6,500 to $19,000, or €5,900 to €17,500) to reach ISO 27001, and allow three to six months to get there. Costs vary a lot depending on your size, how much you do in-house, and whether you bring in a consultant, so it is always worth getting a few quotes.
Where to Start With Certification
Where Things Stand Right Now
G-Cloud 15 at a Glance (as of July 2026)
- Applications for the opening round have closed. The deadline was 30 January 2026, so it is not currently possible to apply to join the first intake.
- The framework is being awarded on 6 August 2026, with buyers able to search it from around mid-August 2026.
- The previous version, G-Cloud 14, runs until 28 October 2026. Any work started under it must be wrapped up by then.
- The next chance to join is expected in early 2028. G-Cloud 15 is an "open framework," which means it reopens partway through to let new suppliers on and existing ones update their listings.
G-Cloud runs on a strict timetable, so the right move depends entirely on where we are in the cycle. Because applications are currently closed, the useful question is: which of these are you?
You Applied Back in January
Good news: your launch date has actually moved earlier, so get ready now rather than in the autumn. Polish your service listings, line up your case studies, and have your sales and outreach ready for the moment buyers start searching in mid-August.
You Are on G-Cloud 14 but Did Not Apply for G-Cloud 15
Check every live opportunity against the 28 October 2026 cut-off, because anything that will not complete by then cannot be delivered under G-Cloud 14. Then start planning your route back in, whether that is the 2028 reopening or an alternative framework.
You Missed G-Cloud 15 Altogether
You are not locked out for good. Put the expected early-2028 reopening in your diary, and use the time well: get your certifications in place now so you are ready to apply the moment the door opens. In the meantime, look at whether you can subcontract to a supplier who is already on the framework, or whether another government agreement suits your service.
How to Get Ready, Whichever Group You Are In
The preparation is broadly the same for everyone. Do these five things and you will be in a strong position.
- Sort your certifications early. This is the long pole in the tent. Start ISO 27001 and Cyber Essentials now, because you cannot rush an audit.
- Get your pricing right. G-Cloud expects clear, fixed pricing, not vague ranges. Set it out plainly, including any volume discounts.
- Write service descriptions a buyer can understand. Explain what you do, what is included, and what happens if something goes wrong, in plain language. Your listing is your shop window.
- Gather proof. Case studies, results you have delivered, and evidence of your wider value (such as your environmental or community impact) all help you stand out.
- Get to know the market. Attend supplier events, watch how buyers search, and learn what similar services are offering.
A Worked Example: How Meridian Analytics Approaches G-Cloud 15
Meridian Analytics Ltd is a fictional small business we use across ISOCentral to make these ideas concrete. Meridian is a ten-person company that builds a cloud-based data dashboard, the kind of tool a local council could use to track spending or service performance. It is exactly the sort of software supplier G-Cloud 15 is designed to include, most likely in Lot 2b.
When Meridian's founder first looked into G-Cloud, she made two useful discoveries. First, her software would need ISO 27001 to reassure public sector buyers that council data would be safe, and Meridian did not yet hold it. Second, she had missed the January 2026 application deadline.
Rather than give up, Meridian took the long view. The team started their ISO 27001 journey straight away, using a consultant to move quickly, and pencilled in the expected early-2028 reopening as their target. To keep a foot in the public sector door in the meantime, Meridian approached a larger supplier already on G-Cloud 15 about subcontracting on a council project.
The lesson is simple. Meridian could not change the timetable, but by fixing the certification gap now and planning around the reopening, they turned a missed deadline into a head start on the next one.
Where to Get Help
Getting onto G-Cloud has two distinct sides, and it helps to treat them separately.
The certification side is about meeting the standards buyers expect, chiefly ISO 27001, ISO 20000-1, and Cyber Essentials. This is where ISOCentral can help directly. Use our consultant directory to find someone to guide you through certification, and our certification body directory to find an accredited auditor.
The framework side is about the G-Cloud application itself: choosing the right Lot, writing listings that get found and chosen, pricing correctly, and making the most of your place once you are on. This is a specialist skill in its own right, and it is worth getting help if the framework is important to your business.
For that side, we recommend Advice Cloud, a UK consultancy that focuses specifically on helping suppliers get listed and succeed on G-Cloud and other public sector frameworks. They offer framework listing support, bid review, listing "buyability" reviews, and training, and they have a strong track record of getting suppliers successfully onto G-Cloud. If the framework matters to your growth, a conversation with a specialist like Advice Cloud is a sensible first step.
Related ISOCentral Resources