Cyber Security 4: what UK SMEs should prepare before the government framework is tendered (2026)

A large public-sector cyber procurement is still being shaped. For an SME supplier, the useful move is to prepare evidence while the buying route is open to influence, rather than wait for a final tender pack.

At a glance

Signal	Audience pain point	Useful action	Commercial angle
The Government Commercial Agency's RM3764.4 Cyber Security 4 notice is a preliminary market engagement notice. Its current version was last edited on 14 August 2026; the notice was first published on 10 July. It describes a planned framework for public-sector access to cyber security services and says SMEs are particularly suitable. 1	A capable SME sees public procurement as a distant enterprise process and has no clear evidence pack ready when the opportunity becomes real.	Pick a service lane, build an evidence index around it, and register for the GCA's supplier engagement updates.	Turn security capability into something a public buyer can evaluate, compare and take through procurement.

The audience pain point: the opportunity arrives before the tender pack

The current notice is a planning signal, not a contract award. RM3764.4 is intended to replace the existing Cyber Security Services 3 dynamic purchasing system and establish a framework. The notice gives an estimated value of £3 billion excluding VAT, an engagement deadline of 1 October 2027 and estimated contract dates from 12 April 2028 to 11 April 2036. Those figures are procurement estimates, not guaranteed revenue for suppliers. 1

That distinction is the useful marketing angle. A supplier does not need to claim that it has won work. It can show that it understands how to become easier to assess before the final requirements are published.

What the UK signal says

The GCA says Cyber Security 4 will give all public-sector organisations a way to buy cyber security services. It is still running pre-market engagement to define the scope, requirements, competition procedure and contract type. The page lists possible service areas such as NCSC-assured services, consultancy and advice, penetration testing, incident response and managed security services, while making clear that product types and routes to market will be decided through market engagement. 2

The notice also marks SMEs as particularly suitable. That does not guarantee a place on the future framework. It does give smaller providers a reason to make their capability legible now: a buyer should be able to see exactly what the service does, what evidence supports it and where its delivery boundary sits. 1

The GRC translation: make one service easy to test

A useful preparation pack can stay small. Build it around one service line rather than presenting a catalogue of everything the business can do.

Name the service boundary. State the problem solved, the client profile, the in-scope systems and the point at which another supplier or the customer takes over. This prevents a broad capability claim from becoming an unclear delivery promise.
Create an evidence index. Map each buyer question to one artefact: service description, delivery method, staff roles, relevant assurance, data-handling controls, subcontractor oversight, incident process and outcome evidence. Link to the controlled document or record, not just a policy title.
Show how the service is governed. Add the service owner, review cycle, risk and exception route, escalation contacts and the evidence retained after delivery. This is where GRC becomes visible to procurement: the buyer can see who is accountable when the service changes or something goes wrong.
Separate confirmed facts from planned claims. Label what is already evidenced, what is being tested and what depends on the future Cyber Security 4 scope. The GCA says the final scope, product types and routes to market will be determined through engagement, so a supplier should not market the future framework as a settled requirement. 2
Use the engagement window. Register interest in the GCA's supplier engagement sessions and keep the RM3764.4 page under review. Feedback from the sessions will help shape the agreement, and the GCA says dates for future supplier sessions will be published when available. 2

This is a growth conversation with a useful boundary: the public buying signal is real, the final route is still being designed, and a supplier can improve its readiness without pretending the outcome is decided.

Cyber Security 4: what UK SMEs should prepare before the government framework is tendered

At a glance

The audience pain point: the opportunity arrives before the tender pack

What the UK signal says

The GRC translation: make one service easy to test

Suggested LinkedIn post structure

References

Related content