Public Sector Software Solutions (RM6396): What SaaS Suppliers Should Do Before the Tender Opens

Public Sector Software Solutions (RM6396): What SaaS Suppliers Should Do Before the Tender Opens

RM6396 Public Sector Software Solutions will open for tender later this summer (2026), with award expected in winter 2027, and if you supply SaaS, platform or enterprise software to government, you need to begin evidence gathering now. The framework will run for four years with a ceiling value up to £12 billion, covering SaaS, on-premise and hybrid models under the previous Procurement Act enacted in 2023, and unlike G-Cloud it will handle higher-value, more complex procurements where evaluators expect detailed case studies, financial standing evidence and integration capability.

This is the first major software framework let entirely under the Procurement Act, and the evaluation mechanics will differ from what many suppliers know from the earlier G-Cloud renewal cycle. The framework sits alongside G-Cloud, not in place of it. G-Cloud remains the route for catalogue-based, lower-touch purchases. RM6396 is designed for procurements where a buyer needs structured evaluation, formal scoring and comparative assessment across suppliers. If your typical contract value runs above £100,000 annually or requires significant configuration, integration or support, RM6396 is the route buyers will use.

How RM6396 relates to G-Cloud

G-Cloud operates as a catalogue with a pass or fail compliance gateway. Once you are on the framework, buyers search, compare and award directly. RM6396 will use lot structures and a Dynamic Purchasing System (DPS) model, meaning there will be an initial accreditation round, but each call-off competition will involve fresh submission of case studies, pricing and method statements specific to that opportunity.

The practical implication is that winning a place on RM6396 does not guarantee revenue. Buyers will run mini-competitions for each requirement, scoring submissions out of 100 in most cases, and you will compete afresh each time. This changes the commercial model. Framework accreditation is necessary but not sufficient. The work lies in winning individual call-offs, and that requires repeatable, strong case study libraries and tight pricing discipline.

If you currently sell through G-Cloud and your contracts stay below £50,000 per year, you may not need RM6396 immediately. If you routinely close contracts above £100,000, particularly in healthcare, justice, or central departments, RM6396 becomes essential because buyers will default to it for anything requiring formal evaluation or where they need assurance on integration, data migration or ongoing support at scale.

Evidence you need ready before the tender opens

The Initial Accreditation Questionnaire (IAQ) for RM6396 will open in late summer 2026 and is expected to include financial standing, insurance, quality management and information security requirements. Start with these.

You will need audited accounts for the most recent two financial years. If your turnover is below £5 million, expect questions on parent company guarantees or insurance-backed bonding. CCS typically looks for professional indemnity insurance at £5 million minimum for software frameworks, and cyber liability cover at £2 million. Check your current policies now. Renewal or uplift can take six to eight weeks if underwriters need additional information.

ISO 27001 certification remains the clearest route through information security questions, though CCS has signalled that Cyber Essentials Plus combined with detailed narrative evidence may be acceptable for smaller suppliers. If you do not hold ISO 27001 and your revenue is below £2 million, begin a Cyber Essentials Plus assessment immediately. Certification takes four to six weeks assuming a clean first pass. If you are larger or handle sensitive data routinely, budget three to four months and £8,000 to £15,000 for ISO 27001 initial certification through an accredited body.

Case studies will matter more on RM6396 than on any previous software framework. Prepare at least six case studies, each covering a contract delivered in the past three years, with defined outcomes, contract values and named clients where permissible. A strong case study for a software framework includes the problem context, your solution architecture, integration points, user numbers, uptime or performance metrics, and a quantified benefit such as cost saved, time reduced or error rate improved.

Worked example: a SaaS supplier bidding into the data and analytics lot might prepare a case study showing a £240,000 annual contract with a combined authority, delivering a business intelligence platform supporting 150 users, integrating with three legacy finance systems, achieving 99.7 per cent uptime over 18 months, and reducing monthly reporting cycle time from nine days to two. That level of detail allows an evaluator to score specificity, relevance and credibility.

Realistic preparation timeline

If the formal tender notice appears in late August 2026, the IAQ submission window will likely close in late October or early November 2026. That gives you 10 to 12 weeks from notice to submission. In practice, you need most of your evidence ready before the notice, because the submission window will be consumed by drafting, internal review and pricing validation.

Work backwards from a mid-October 2026 submission deadline. If you need ISO 27001, start the gap analysis and scoping in the week starting 2026-07-15. If you need Cyber Essentials Plus, book the assessment by the end of July 2026. If you need to increase insurance cover, request quotes this month.

Case study drafting should begin now. Identify your six strongest contracts, contact the clients to secure permission for a named reference, gather the performance data and write the narrative in a standard format: context, solution, outcomes, evidence. Budget two hours of senior time per case study for the first draft and another hour for client review and adjustment. If you wait until the tender opens, you will not have time to chase client approvals or locate historical performance data.

Pricing preparation is equally time-sensitive. RM6396 will likely require day rate or user-based pricing across defined service categories. Review your cost base now, model your delivery costs for a typical central government client, and set floor pricing that protects margin under competitive pressure. In a scored evaluation, pricing typically carries 20 to 30 per cent of the total marks. A supplier quoting £850 per day where the market clusters around £650 will lose significant points even if the quality submission is strong. Conversely, undercutting at £450 per day signals risk unless your cost model genuinely supports it.

How RM6396 will actually be scored in call-off competitions

Once you hold a place on RM6396, each call-off will be a separate competition. Buyers will issue a specification, usually through the CCS eSourcing portal, and you will submit a method statement, relevant case studies and pricing. Evaluators score your submission, typically splitting 60 to 70 per cent for quality and 30 to 40 per cent for price, though this varies by lot and buyer.

Quality marks come from relevance, specificity and evidence of capability. A generic method statement that could apply to any software project scores poorly. Evaluators look for evidence that you have read the requirement, understood the buyer's constraints (legacy systems, user demographics, security classification, integration needs) and tailored your response. A strong method statement for a case management system tender would reference the specific user workflows described in the specification, name the integration standards you will use, explain your approach to user acceptance testing in a pressured operational environment, and cite a case study from a comparable organisation.

Pricing is scored on a formula, often a simple ratio where the lowest bid scores full marks and others score proportionally. If the lowest bid is £600 per day and yours is £750 per day, and price carries 30 marks, you score 24 marks. This is why floor pricing discipline matters. A supplier who drops to £550 per day to win the price element may win that tender but will struggle to deliver profitably, damaging future references.

Frequently asked questions

Do I need RM6396 if I am already on G-Cloud 14?

Yes, if your typical contract values exceed £100,000 or if buyers in your target departments require formal evaluation rather than direct award. G-Cloud works well for straightforward SaaS purchases where the buyer knows what they need and can compare catalogue entries. RM6396 is for procurements where the buyer needs to score submissions against weighted criteria, often because the solution involves integration, data migration or significant configuration. The two frameworks serve different purchasing behaviours, and most software suppliers will need both.

What happens if I miss the initial accreditation window?

RM6396 operates as a Dynamic Purchasing System, which means CCS will open periodic windows for new supplier applications, typically every six months after the initial award. Missing the first window delays your access by six months or more, and you will miss the early call-off competitions where buyers are most active. The first 12 months of a framework typically see the highest volume of competitions as pent-up demand releases. Delaying accreditation costs you revenue opportunity during the most active trading period.

How much does it cost to prepare for RM6396?

If you already hold ISO 27001, have current insurance at the required levels and maintain a library of recent case studies, internal preparation time is the main cost, typically 15 to 25 days of senior effort to draft responses, gather evidence and coordinate submission. If you need ISO 27001 certification, add £8,000 to £15,000 and three to four months. If you need external bid writing support, expect £4,000 to £8,000 for a experienced consultant to manage the submission and draft quality responses. Our revenue model ties to call-off wins, not framework award, so we focus on suppliers who will actively compete once accredited rather than those seeking a framework listing for credibility alone.

Book a call at bookings.glaxtons.co.uk

Glaxtons, 3 More London Place, London SE1 2RE