CPV 72 IT services

About CPV 72

CPV 72 is the Common Procurement Vocabulary division covering IT services: the work of building, running, and advising on technology, as distinct from the software and hardware products themselves, which sit under CPV 48 and CPV 30 respectively.

The division covers bespoke software development, systems integration, IT consultancy and strategy, hosting and infrastructure services, application support and maintenance, data services, network services, and user support. Digital agencies, development houses, cloud consultancies, and managed service providers all sell into it.

The distinction between CPV 72 and CPV 48 catches suppliers out repeatedly. A buyer purchasing a licensed product codes it under 48; the same buyer purchasing the implementation, configuration, integration, and ongoing support of that product codes it under 72. Many procurements involve both and are coded under one or the other depending on where the buyer thinks the balance of value sits. A supplier that does both should watch both codes, because the coding decision reflects the buyer's internal categorisation rather than any reliable rule.

Active CPV 72 tenders

This is one of the more accessible divisions for smaller suppliers, largely because of the digital framework infrastructure that central government built and that the wider public sector now uses. G-Cloud carries a very large volume of cloud hosting, software, and support purchasing, and it refreshes frequently enough that a supplier is rarely more than a few months from the next opportunity to join. Digital outcomes frameworks cover the people-based work of building services, and are the standard route for user research, service design, and development teams.

Active sub-category	Typical procurement route	Primary buyer pattern
Bespoke development and service delivery	Digital outcomes framework	Central government or large council
Cloud hosting and infrastructure	G-Cloud call-off	Any public body
Application support and managed services	Bespoke competition or framework	NHS body, council, agency
IT strategy and consultancy	Professional services framework	Department or arms-length body
Data and analytics services	Digital outcomes or bespoke	Department, ICB, combined authority

Top buyers procuring CPV 72

Central government departments are the largest buyers of digital services by value, running long-lived programmes with continuous team-based procurement. The Ministry of Defence, the Home Office, the Department for Work and Pensions, and HM Revenue and Customs all sustain substantial digital estates. Arms-length bodies and agencies procure independently and often at a scale that suits mid-sized suppliers better than departmental programmes do.

Local government is the highest-volume publisher by notice count, buying line-of-business systems, hosting, and support across housing, revenues and benefits, social care, and planning. NHS bodies buy clinical systems, integration, and infrastructure, with additional information governance requirements that general suppliers underestimate. Universities and police bodies form two further distinct segments, each with their own sector frameworks. In our own corpus the Scottish Government and Scottish public bodies publish under this code unusually frequently, reflecting both real programme volume and more granular notice publication on the Scottish portal.

Typical contract values under CPV 72

The value spread in this division is wide and bimodal. G-Cloud call-offs for hosting and smaller software services frequently sit in the tens of thousands of pounds, and are commonly awarded through direct call-off after a compliant search of the catalogue rather than through a competition. That end of the market is genuinely open to very small suppliers.

At the other end, systems integration and managed service contracts for major departments run for five to seven years and reach into the tens of millions, with a small number of large programme procurements considerably above that. Between the two sits the bulk of the market: multi-year application support and development contracts in the low millions, which is where mid-sized specialist suppliers compete most effectively. Suppliers should note that call-off ceilings on digital frameworks are frequently set well above expected spend to allow headroom, so the advertised figure overstates the realistic value.

Compliance and certifications for CPV 72 bidders

Cyber Essentials is effectively mandatory across this division, and Cyber Essentials Plus is required wherever personal data or operational systems are involved. ISO 27001 certification is commonly required for hosting, managed services, and anything handling data at scale, and is increasingly asked for even on smaller engagements.

Health sector work carries the Data Security and Protection Toolkit as an additional annual requirement, and clinical systems attract clinical safety standards requiring a named clinical safety officer and documented hazard logs. Central government digital work is assessed against the Service Standard and the Technology Code of Practice, and suppliers should expect to evidence accessibility conformance to WCAG at the level the buyer specifies, since public sector accessibility regulations make this a legal obligation rather than a preference. Security clearance for named staff is required more often than suppliers expect, and clearance lead times are long enough that they should be started before award rather than after.

Frequently asked questions

Is G-Cloud the right route for my software or service?

It depends on what you sell and how it is bought. G-Cloud suits productised offerings with published pricing that a buyer can compare and call off directly: hosting, software subscriptions, and defined support services. It suits bespoke team-based delivery far less well, because that work is procured through digital outcomes routes designed for it. Listing on G-Cloud is comparatively straightforward and inexpensive, and the refresh cycle is frequent, so for most technology suppliers it is worth being on it. Being listed generates no work by itself: buyers search the catalogue, so the quality and clarity of the service description does most of the work.

Why do some IT opportunities appear under CPV 48 instead?

Because the buyer judged the purchase to be primarily a product rather than a service. A licensed application with implementation attached is often coded 48; the same implementation sold separately is coded 72. There is no reliable rule, and buyers within the same organisation code inconsistently. Any supplier whose offering combines software and services should watch both divisions, and should treat the coding as a signal about how the buyer thinks about the purchase rather than as a definition of what is being bought.

How much does security clearance actually matter?

More than most suppliers assume, and it is a common reason for late-stage problems. Central government, defence, policing, and some health programmes require named individuals to hold clearance at Baseline Personnel Security Standard, Security Check, or Developed Vetting level depending on the work. Clearance is sponsored by the buyer and takes time, so a supplier who wins work but has no cleared staff faces a delay before delivery can start. Suppliers targeting this market should maintain a cleared bench where they can, and should be honest at tender stage about what they hold, because overstating it is discovered quickly.

Can a small development house realistically win central government work?

Yes, and the digital frameworks were designed partly to make that possible. The realistic entry route is a single team-based outcome on a digital framework, competed on the strength of named people and relevant delivery evidence rather than on corporate scale. Framework competitions at that level are usually assessed on a written response and an assessment session, both of which reward specific delivery experience over general capability statements. The harder barrier is not evaluation but cash flow, since public sector payment terms and the cost of maintaining cleared, available staff between engagements weigh more heavily on small suppliers than the bidding process does.