RM6320 CWAS3: The Complete SME Guide

If you run a UK SME and you sell anything that could be badged as cyber, cloud, or wider digital advisory, RM6320 CWAS3 is probably on your radar. It should be. Cyber and Technical Security Services 3 is the Crown Commercial Service framework that central government, the wider public sector, the NHS, local authorities, and blue light services use to buy these services compliantly. It replaces CWAS2, widens the scope, and crucially opens more room for smaller suppliers than its predecessor did.

This guide walks through what CWAS3 actually is, how the lots are structured, who can realistically win a place, what it costs you to get listed, and what has to happen after the award before any money lands in your bank account. No hype. No fee padding. Just the information a commercial director needs before committing budget and management time to a framework bid.

What RM6320 CWAS3 is, in plain English

CWAS3 is a multi supplier framework agreement run by Crown Commercial Service. Getting on the framework does not give you a contract. It gives you the right to be invited to compete for contracts. Those contracts are called call-offs. Buyers across the public sector use the framework to shortlist suppliers quickly without running a full OJEU style procurement each time.

The framework covers cyber consultancy, technical security testing, incident response, risk management, assurance, and the security elements of wider digital transformation. If your firm delivers any of that, and you can evidence it properly, CWAS3 is the compliant route to public sector revenue in that category.

The lot structure

CWAS3 is split into lots so buyers can find suppliers who match the scale and shape of the work they need. The lot architecture matters because it dictates which questions you answer in your bid and what evidence you need to hold.

Lot 1 covers cyber advisory and consultancy. This is the widest lot and is where most SMEs compete. Strategy, governance, risk, compliance, security architecture, maturity assessments, and policy work all sit here.

Lot 2 covers technical testing. Penetration testing, red teaming, vulnerability assessment, and related assurance activity. CREST or equivalent accreditation is effectively non-negotiable here.

Lot 3 covers incident response and recovery. Readiness, retainers, live response, and post incident forensics.

Lot 4 covers specialist and emerging capability. Operational technology, industrial control systems, cloud native security, AI security, and similar specialisms.

You can bid for more than one lot if you have the capability and evidence to stand behind each one. You should not bid for a lot you cannot resource on day one.

Who can realistically win a place

CWAS3 was designed with SME participation in mind. Crown Commercial Service has explicit targets for SME spend and CWAS3 is one of the frameworks expected to carry that weight. That does not mean it is easy. It means that if you are a credible SME with the right evidence, you are not structurally shut out the way you were on some older frameworks.

The practical filter is evidence. You will be asked for case studies, usually three, that demonstrate delivery of services in the lot you are bidding. Those case studies need to be recent, ideally within the last three years. They need to show outcomes, not just activity. Public sector references are helpful but not mandatory in every lot. Private sector work counts if it is relevant in scale and complexity.

You will also be asked for evidence of your information security posture. ISO 27001 or Cyber Essentials Plus is the practical minimum. For Lot 2, CREST or equivalent testing accreditation is expected. For Lot 3, demonstrable incident response capability, usually with named and vetted personnel.

Financial standing is checked. The framework uses a turnover test relative to the size of contracts you want to win, not an arbitrary floor. More on that in a moment.

The GBP 2M turnover myth

A stubborn belief circulates that you need GBP 2 million in turnover to get on a CCS framework. On CWAS3 this is not correct as a blanket rule. What CCS actually applies is a proportionality test. Your turnover needs to be broadly twice the value of the largest single call-off you would reasonably bid for through the framework. For an SME bidding on sub GBP 250,000 call-offs, a turnover in the GBP 500,000 to GBP 750,000 range can be perfectly acceptable.

What trips SMEs up is not the turnover rule itself. It is assuming they can bid on multi million pound call-offs from day one. You cannot. You bid within your weight class and you grow into larger ceilings by delivering well.

What it costs you to get listed

There is no fee to Crown Commercial Service for applying to CWAS3. The cost is the bid itself. A serious CWAS3 response takes between 80 and 160 hours of senior time depending on how many lots you target and how ready your evidence library is. If you have ISO 27001, three strong case studies, a written methodology, and financials ready, you are at the lower end. If you need to build those from scratch, you are at the upper end.

At commercial consulting rates that sits between GBP 8,000 and GBP 24,000 of internal cost, or GBP 12,000 to GBP 35,000 if you outsource the bid writing to a specialist. That is the honest range. Anyone quoting a fixed fee below GBP 10,000 is either using a template and hoping, or planning to bill you extras during the lifecycle.

The more important cost is opportunity cost. A bid team distracted from fee earning work for six weeks is a real number on your P and L. Factor that in before you commit.

What happens after award

This is where the rose-tinted view of framework life meets reality. Being awarded a place on CWAS3 does not generate revenue. It generates the right to compete for revenue. The work starts the day you are listed.

Call-offs are published on the Crown Commercial Service portal and through direct buyer routes. Some lots see weekly opportunities. Others are quieter and cluster around fiscal year ends. You need a named individual watching the pipeline. You need a shortlist of buyer relationships you are actively warming. You need to respond to call-off competitions fast, because windows are often two to three weeks from publication to submission.

The suppliers who do well on CWAS3 treat framework listing as the start of a sales motion, not the end of a procurement exercise. They have a bid library ready for call-offs. They have named delivery leads who can walk into a buyer meeting the week a competition drops. They track win rates and iterate.

How Glaxtons supports SMEs through CWAS3

Glaxtons works on a success fee model tied to call-off contract wins, not framework award. We do not charge you for writing a framework bid. We invest our time in positioning SMEs to win the call-offs that generate actual revenue once the framework place is secured. If you win, we share in the upside. If you do not, you are not out of pocket on our fees.

That alignment matters because the public sector sales motion is long. Framework award is month zero. First call-off win is typically month three to nine. First meaningful revenue recognition follows that. A fee model that charges you upfront and walks away after framework award is not aligned to how this market actually pays.

Next step

If you are weighing a CWAS3 bid or you are already listed and not converting into call-offs, book a thirty minute call to talk through your position. We will tell you honestly whether CWAS3 is the right framework for your capability and your numbers.

Book a call at bookings.glaxtons.co.uk.

Glaxtons, 3 More London Place, London SE1 2RE.