G-Cloud procurement steps: a practical guide for public sector buyers

A compliant G-Cloud procurement under the G-Cloud 14 framework requires six steps: prepare your Statement of Requirements and select the correct lot; register and access the Public Procurement Gateway (PPG) and Contract Award Service (CAS); search the Digital Marketplace catalogue and build a shortlist; assess and score shortlisted services; award the call-off contract via direct award or further competition; and complete post-award obligations including the Customer benefits record. The CAS six-step buying process is mandatory for Lots 1, 2 and 3 direct awards under the Public Contracting Regulations 2015.

The six G-Cloud procurement steps at a glance:

  1. Prepare your requirements, choose the lot and confirm G-Cloud is the right route
  2. Register for the PPG and access the Contract Award Service
  3. Search the G-Cloud catalogue and build a shortlist
  4. Assess shortlisted services using a scoring matrix and MEAT reasoning
  5. Award the call-off contract and complete the order form
  6. Submit the Customer benefits record and manage the contract

Quick links: G-Cloud 14 buyer guide | Contract Award Service | G-Cloud 14 framework agreement

Key takeaways

A compliant G-Cloud procurement requires six documented steps, with the Customer benefits record submission and a written MEAT note being the two most frequently omitted obligations.

Point Details
Six mandatory steps Prepare requirements, register for PPG and CAS, search and shortlist, assess with MEAT scoring, award the call-off, complete post-award returns.
Lot selection is binding Choose Lot 1 (hosting), Lot 2 (software) or Lot 3 (support) before searching; Lot 4 requires further competition.
MEAT note is your audit defence A written scoring matrix and one-page MEAT note are required for every direct award to satisfy the buyer’s burden of proof.
Contract term up to 36 months An optional 12-month extension must be specified in the original order form; it cannot be added retrospectively.
Customer benefits record is mandatory Submit the Customer benefits record promptly after award, as omitting it creates a gap in your post-award compliance record.

Table of Contents

Step 1: what do you need, and is G-Cloud the right framework?

Before opening the catalogue, buyers must confirm that G-Cloud is the appropriate procurement route. G-Cloud suits off-the-shelf cloud hosting, software-as-a-service and cloud support. It is not suitable for bespoke development, hardware procurement, or projects requiring significant customisation that would constitute a new build. For those scenarios, Digital Outcomes and Specialists or Technology Products frameworks are more appropriate.

Once route suitability is confirmed, the next task is drafting a Statement of Requirements. A precise statement is the single most effective way to reduce evaluation cycles and audit friction. It should cover:

  • Functional requirements: what the service must do, including integration points and user volumes
  • Security and data residency: classification level, data sovereignty requirements and any Cyber Essentials or ISO 27001 expectations
  • Accessibility: compliance with WCAG 2.1 AA as a minimum for public sector services
  • Performance and availability: uptime thresholds, response times and maintenance windows
  • Support expectations: service desk hours, escalation paths and incident response times
  • Exit arrangements: data portability, migration support and notice periods

With requirements documented, select the correct lot. Lot 1 covers cloud hosting infrastructure. Lot 2 covers cloud software, including SaaS platforms. Lot 3 covers cloud support services such as managed services and consultancy. Lot 4 requires further competition and applies to complex cloud support scenarios where a direct award is not appropriate. Choosing the wrong lot is a common error that can invalidate the procurement record, so verify the lot definition against your requirements before proceeding.

Record every decision at this stage, including why G-Cloud was chosen over alternative frameworks and how the lot selection was reached. This documentation forms the foundation of your compliance trail.

Pro Tip: Save a version-controlled copy of your Statement of Requirements before you begin searching. Any changes made after shortlisting must be documented as amendments, not silent rewrites, to preserve the integrity of your audit record.

Step 2: how do you register and access the buying tools?

The Contract Award Service is accessed through the Public Procurement Gateway. Buyers must create or log in to a PPG account before they can use CAS to search the catalogue, record evaluations or generate a call-off contract. Registration requires a government or public sector email address and organisational verification.

Before registering, identify the roles your organisation needs to complete the procurement. A typical buy involves at least three distinct responsibilities:

Role Responsibility Required in CAS?
Procurement lead Owns the process, documents decisions, submits the award Yes
Technical evaluator Assesses service descriptions, security evidence and SLAs No (contributes offline)
Approver / budget holder Authorises the award and signs the order form Yes (for sign-off)

When registering, have the following ready: your organisation’s name and address, your public sector email address, the name of your approver, and the lot and approximate contract value you intend to procure. Registration typically completes within one working day for organisations already listed in the PPG directory. New organisations may require additional verification.

Once authenticated, download the G-Cloud 14 buyer guide and the call-off contract templates from the G-Cloud templates and legal documents page before beginning your search. Reading the buyer guide in full before proceeding is a requirement stated on the G-Cloud 14 framework page, not a recommendation.

Step 3: how do you search the G-Cloud catalogue and build a shortlist?

The G-Cloud catalogue within CAS allows buyers to filter by lot, service category, supplier name and keyword. Effective searching depends on using terminology that matches how suppliers describe their services, which is not always identical to how buyers frame their requirements.

Search technique guidance:

  • Start with broad lot-level filters (Lot 1, 2 or 3) before applying keyword terms
  • Use service category filters to narrow results to the relevant cloud service type
  • Run multiple keyword searches using synonyms from your Statement of Requirements; a supplier may describe “automated compliance monitoring” where your requirement uses “continuous vehicle compliance checks”
  • Review the service description, pricing document and terms and conditions for each result before shortlisting
  • Use the Digital Marketplace service pages to inspect individual supplier entries and capture screenshots as audit evidence

Shortlist checklist — minimum documentation to request or record for each candidate:

  • Service description reviewed and mapped to your Statement of Requirements
  • Pricing document downloaded and unit costs confirmed
  • Terms and conditions reviewed for compatibility with your organisation’s standard clauses
  • Security and compliance evidence noted (Cyber Essentials, ISO 27001, data residency confirmation)
  • SLA summary captured, including uptime commitments and support hours
  • Exit and data portability terms recorded

Aim for a shortlist of three to five services for a direct award evaluation. If fewer than three services match your requirements, document why and proceed with those available. If more than five match, apply a preliminary scoring pass to reduce the list before full evaluation.

Capture a timestamped screenshot or export of your search results within CAS. This forms part of the audit trail required under the Public Contracting Regulations 2015 and demonstrates that the shortlist was derived from an objective catalogue search rather than a pre-selected supplier.

Step 4: how do you assess shortlisted services and document your MEAT reasoning?

Evaluation under G-Cloud uses the Most Economically Advantageous Tender (MEAT) principle. For a direct award, the buyer must demonstrate that the chosen service represents the best combination of price and quality against the documented requirements. This is not a subjective preference; it requires a structured, auditable scoring process.

A practical scoring matrix covers four evaluation dimensions:

Assign numerical scores (for example, 1 to 5) for each criterion, apply the weighting, and calculate a total for each shortlisted service. Record the rationale for each score in writing. Where a service description makes a claim (for example, “ISO 27001 certified”), request or locate the supporting evidence before accepting it at face value.

For buyers procuring cloud compliance software, reviewing how a supplier handles role-based access and multi-tenant controls is a practical security check that often surfaces material differences between services that appear similar on price alone.

Pro Tip: For a direct award, write a brief MEAT summary note of no more than one page that records which service scored highest, why, and how the score was reached. This note is your primary defence if the award is later questioned. Store it with your procurement record in a version-controlled folder alongside the scoring matrix.

The G-Cloud buyers’ guide confirms that buyers bear the burden of proof for direct award decisions. A documented scoring matrix and MEAT note satisfy that burden; an undocumented preference does not.

Step 5: how do you award the call-off contract and choose between direct award and further competition?

The award stage has two distinct paths depending on your lot and circumstances.

Direct award checklist (Lots 1, 2 and 3):

  • A single service meets your requirements better than all others based on the documented MEAT assessment
  • Pricing is confirmed from the catalogue pricing document, with no off-catalogue negotiation
  • The order form is completed with: contract start and end date, optional 12-month extension clause (if required), scope description, agreed price, and authorised signatures or a binding electronic purchase order
  • No informal parallel negotiations have taken place with any supplier outside the CAS process

When further competition is required:

Lot 4 mandates further competition for complex cloud support scenarios. Further competition may also be appropriate for Lots 1 to 3 where multiple services are closely matched and a more structured evaluation is needed. The Lot 4 further competition process involves issuing a call-off invitation to tender to shortlisted suppliers, evaluating responses against pre-defined criteria, and awarding on the basis of the documented evaluation.

Contract term: the G-Cloud 14 framework permits call-off contracts of up to 36 months. An optional 12-month extension is available, but only where that extension was specified in the original order form at the time of award. You cannot add an extension option retrospectively.

The framework attachments for RM1557.14 explicitly prohibit deviation from the prescribed buying process. Running an informal request for proposal or negotiating terms outside the framework voids the protections the framework provides and may result in supplier suspension. Complete all award activity within CAS.

Once the order form is signed or the electronic purchase order is confirmed, the call-off contract is formed. Retain a copy of the completed order form, the scoring matrix, the MEAT note and the service description as downloaded at the time of award.

Step 6: what are your post-award obligations and how do you manage the contract?

Post-award obligations begin on the day the call-off contract is formed. The G-Cloud buyers’ guide requires buyers to submit a Customer benefits record after every award. This record captures the anticipated benefits of the procurement, including cost savings, efficiency gains and service improvements. Submission is mandatory; the information is used for framework performance monitoring and forms part of your post-award compliance record.

Post-award task timeline:

Record-keeping under the Public Contracting Regulations 2015 requires that all procurement decisions, evaluation records, the awarded order form and post-award communications are retained for a minimum period. Store these in a structured, version-controlled document repository. Practical guidance on compliance document management is relevant here, particularly for buyers managing multiple concurrent contracts or fleet-related SaaS platforms.

Contract management should include defined KPIs aligned to the SLAs in the order form, a schedule for periodic supplier reviews, and a documented process for raising and escalating service failures. Where the contract involves regulatory data or fleet compliance functions, align your contract governance with your organisation’s regulatory change management process to capture any changes in applicable standards during the contract term.

Where do you find the framework schedules, call-off templates and buyer documents?

The legal documents underpinning a G-Cloud 14 procurement are available from two primary sources: the G-Cloud 14 framework page and the G-Cloud templates and legal documents page.

Document Purpose When to use
G-Cloud 14 buyer guide (RM1557.14 v3.0) Step-by-step procurement instructions and templates Before beginning any procurement activity
Framework agreement (RM1557.14) Sets the terms under which call-offs are made Reference throughout; governs the whole procurement
Call-off contract template Forms the binding contract between buyer and supplier Complete at award stage
Order form Records the specific terms of the individual call-off Complete and sign at award stage
Framework schedules Detail specific obligations, data processing terms and exit requirements Review during assessment and award stages

The templates page also holds documents from earlier G-Cloud framework versions. If you are managing a contract awarded under G-Cloud 13 or earlier, use the templates from that version, not G-Cloud 14. Mixing template versions creates contractual ambiguity and may invalidate specific clauses.

Pro Tip: Create a procurement folder at the start of each buy and save the buyer guide, call-off template and order form into it on day one. Name files with the framework version and date downloaded (for example, “G-Cloud-14-Call-Off-Template-Downloaded-2026-03”). This prevents accidental use of outdated versions and satisfies the version-control expectation in the buyer guide.

Common mistakes that create audit risk and how to avoid them

Most G-Cloud procurement failures are not caused by complex legal errors. They result from a small set of repeatable process gaps that are straightforward to prevent.

Top pitfalls and how to address them:

  • Vague Statement of Requirements: requirements that do not specify security classification, data residency or SLA thresholds make it impossible to score services objectively and expose the award to challenge
  • Undocumented MEAT for direct award: selecting a supplier without a written scoring matrix and MEAT note leaves the buyer without evidence if the decision is questioned. The CAS guidance confirms the buyer bears the burden of proof
  • Parallel negotiations outside CAS: contacting suppliers informally before or during the CAS process, or negotiating pricing not listed in the catalogue, breaches the framework agreement terms and may result in supplier suspension
  • Omitting the Customer benefits record: this submission is mandatory after every award; omitting it creates a gap in the framework performance record and your own post-award audit trail
  • Using the wrong lot: procuring bespoke development or hardware through G-Cloud, or selecting Lot 3 for a SaaS platform, invalidates the procurement basis

Pre-award audit checklist:

  • Statement of Requirements documented and version-controlled
  • Correct lot confirmed and recorded
  • Catalogue search screenshots saved with timestamps
  • Scoring matrix completed for all shortlisted services
  • MEAT note written and stored
  • Order form fields complete: term, extension option, scope, price, signatures
  • No off-catalogue negotiations conducted

Pro Tip: When awarding to a single supplier on a direct award, write one paragraph in your procurement record that explicitly states why no other shortlisted service met the requirements as well. This is the clearest way to demonstrate objective comparison and satisfies the burden of proof without requiring a lengthy justification document.

A practitioner’s perspective on the G-Cloud buying process

The G-Cloud framework is genuinely one of the more accessible procurement routes available to public sector buyers, but its low-friction reputation can create a false sense of informality. The most common audit problem is not a buyer who broke the rules deliberately; it is a buyer who completed the process correctly but recorded it inadequately.

A realistic timeline for a straightforward Lot 2 SaaS procurement, from finalising the Statement of Requirements to a signed order form, is typically four to six weeks. The evaluation stage takes longest, not because the scoring is complex, but because getting the right internal stakeholders to review service descriptions and security evidence takes time. Involving your information security lead and data protection officer at the shortlisting stage, rather than at the award stage, removes the most common source of delay.

One practical decision that consistently reduces delivery risk is specifying the optional 12-month extension in the original order form, even when you are not certain you will use it. Retrospective extensions are not permitted under G-Cloud 14, and a contract that expires before a migration is complete creates operational exposure. The extension costs nothing to include at award and provides material flexibility later.

Sources

The following official pages cover every document and tool referenced in this guide:

This article is general information, not a substitute for advice from a qualified lawyer. Consult a qualified legal professional about your own circumstances before acting on anything here.

Recommended