Cyber Security 4: what UK SMEs should prepare before the government framework is tendered
A new UK government cyber-services framework is still being shaped; this brief turns the procurement signal into a practical evidence-readiness plan for SME suppliers.
A large public-sector cyber procurement is still being shaped. For an SME supplier, the useful move is to prepare evidence while the buying route is open to influence, rather than wait for a final tender pack.
At a glance
| Signal | Audience pain point | Useful action | Commercial angle |
|---|---|---|---|
| The Government Commercial Agency's RM3764.4 Cyber Security 4 notice is a preliminary market engagement notice. Its current version was last edited on 14 August 2026; the notice was first published on 10 July. It describes a planned framework for public-sector access to cyber security services and says SMEs are particularly suitable. 1 | A capable SME sees public procurement as a distant enterprise process and has no clear evidence pack ready when the opportunity becomes real. | Pick a service lane, build an evidence index around it, and register for the GCA's supplier engagement updates. | Turn security capability into something a public buyer can evaluate, compare and take through procurement. |
The audience pain point: the opportunity arrives before the tender pack
The current notice is a planning signal, not a contract award. RM3764.4 is intended to replace the existing Cyber Security Services 3 dynamic purchasing system and establish a framework. The notice gives an estimated value of £3 billion excluding VAT, an engagement deadline of 1 October 2027 and estimated contract dates from 12 April 2028 to 11 April 2036. Those figures are procurement estimates, not guaranteed revenue for suppliers. 1
That distinction is the useful marketing angle. A supplier does not need to claim that it has won work. It can show that it understands how to become easier to assess before the final requirements are published.
What the UK signal says
The GCA says Cyber Security 4 will give all public-sector organisations a way to buy cyber security services. It is still running pre-market engagement to define the scope, requirements, competition procedure and contract type. The page lists possible service areas such as NCSC-assured services, consultancy and advice, penetration testing, incident response and managed security services, while making clear that product types and routes to market will be decided through market engagement. 2
The notice also marks SMEs as particularly suitable. That does not guarantee a place on the future framework. It does give smaller providers a reason to make their capability legible now: a buyer should be able to see exactly what the service does, what evidence supports it and where its delivery boundary sits. 1
The GRC translation: make one service easy to test
A useful preparation pack can stay small. Build it around one service line rather than presenting a catalogue of everything the business can do.
- Name the service boundary. State the problem solved, the client profile, the in-scope systems and the point at which another supplier or the customer takes over. This prevents a broad capability claim from becoming an unclear delivery promise.
- Create an evidence index. Map each buyer question to one artefact: service description, delivery method, staff roles, relevant assurance, data-handling controls, subcontractor oversight, incident process and outcome evidence. Link to the controlled document or record, not just a policy title.
- Show how the service is governed. Add the service owner, review cycle, risk and exception route, escalation contacts and the evidence retained after delivery. This is where GRC becomes visible to procurement: the buyer can see who is accountable when the service changes or something goes wrong.
- Separate confirmed facts from planned claims. Label what is already evidenced, what is being tested and what depends on the future Cyber Security 4 scope. The GCA says the final scope, product types and routes to market will be determined through engagement, so a supplier should not market the future framework as a settled requirement. 2
- Use the engagement window. Register interest in the GCA's supplier engagement sessions and keep the RM3764.4 page under review. Feedback from the sessions will help shape the agreement, and the GCA says dates for future supplier sessions will be published when available. 2
This is a growth conversation with a useful boundary: the public buying signal is real, the final route is still being designed, and a supplier can improve its readiness without pretending the outcome is decided.
Suggested LinkedIn post structure
- Hook: "The UK government's next major cyber services framework is still being shaped, and the preparation window is already open."
- Give the verified context: Name RM3764.4 Cyber Security 4, explain that the current Find a Tender version was edited on 14 August, and state that it is a preliminary market engagement notice rather than an award. 1
- Add the SME signal: The notice says SMEs are particularly suitable; the GCA lists possible services but says scope and routes to market will come from pre-market engagement. 12
- Give the practical move: Tell smaller providers to choose one service line and prepare a buyer-testable pack covering scope, ownership, delivery evidence, data handling, subcontractors and incident escalation.
- Close on growth: "The early advantage is not claiming the framework. It is making your capability easy to assess while the framework is still being designed."
The post should leave readers with a measured claim: Cyber Security 4 is an opportunity to prepare for, not revenue to announce. The supplier that can connect technical delivery to controlled evidence will have a clearer conversation when the final procurement route appears.
References
- 1Cyber Security 4 notice
find-tender.service.gov.uk
- 2Cyber Security 4 - GCA
gca.gov.uk
This story was produced automatically by a channel. One sentence is all it takes for Neodrop to keep producing for you.