Anna Totterdell
Projects Director
Ask most SME owners why they have never bid for public sector work and the answer is rarely "we couldn't do the job." It's the process standing in front of the job - a procurement route built for organisations with a dedicated bid team, a compliance department, and six months to spare before anyone even asks what you'd actually deliver.
We've just cleared two of those obstacles. Novecom has been accepted onto G-Cloud 15, and we're certified against Cyber Essentials. Neither one makes us better at the work, that's still down to us every time, but together they mean more buyers can have that conversation with us in the first place.
What G-Cloud 15 actually changes
G-Cloud is the framework the UK public sector uses to buy cloud hosting, software, and support services through the Digital Marketplace rather than running a full competitive tender from scratch every time. It is now in its fifteenth iteration, which tells you something useful on its own: this is not a pilot scheme or a box-ticking exercise dreamed up last year. It is an established, well-worn route that councils, NHS trusts, central government departments, and education bodies already know how to use.
Being listed on it means public sector buyers can procure our G-Cloud 15 services through that route, via our G-Cloud 15 supplier entry, without running a separate tender process to prove we're allowed to be considered. That's the real benefit, and it's a specific one: it doesn't shortcut due diligence on whether we're the right fit for a particular piece of work, nor should it. What it does remove is the earlier, administrative hurdle, the one that stops a capable smaller supplier getting a look in before anyone's actually assessed what they can do.
What Cyber Essentials actually verifies
Cyber Essentials is a UK government-backed certification that checks a specific, deliberately unglamorous set of controls: firewalls configured properly, systems kept patched, access limited to who actually needs it, malware protection in place, and secure configuration as the default rather than the exception.
We'd rather be straightforward about what that is and isn't. Cyber Essentials is a verified floor, not a ceiling. It does not mean we are unhackable, nobody who tells you that about any organisation is being honest with you, a point we've made before when writing about how neglected basics turn an old website into a liability rather than just a cost line. What it does mean is that a certification body has reviewed and verified our self-assessment against the five controls, confirming we have them in place, rather than asking you to simply take our word for it.
Why we went and got both
We work across manufacturing, financial services, healthcare, and increasingly public sector organisations, through IT and process strategy and tech consultancy engagements where the client's own risk and procurement teams are rightly asking harder questions than "can you do this." Those questions used to cost us time to answer case by case, on every single bid. Cyber Essentials now answers the baseline security question for all of that work, and the G-Cloud 15 listing answers the procurement question for the services it covers.
That matters more in the public sector than almost anywhere else, because procurement decisions there get scrutinised in a way most private contracts never do. Buyers who ask for proof before they ask for a quote aren't being overly cautious, they're doing their job properly, and we'd rather make that job easier than argue it shouldn't exist.
What this actually means if you're evaluating us
If you're a public sector buyer, you can procure our G-Cloud 15 services through that route, rather than building a one-off justification for why a smaller supplier should be allowed to the table. If you're not in the public sector, the Cyber Essentials side still tells you something concrete: a certification body has reviewed and verified our self-assessment of our basic cyber hygiene, which is a reasonable thing to want to know about anyone who's about to get access to your systems or your data through a business automation or integration engagement.
Where this leaves us
The badges aren't the interesting part of what we do, the work still is: fixing the process that's actually broken, building the integration that actually holds, giving an operations team a system they can trust. G-Cloud 15 and Cyber Essentials don't change any of that. What they do change is how many good conversations get to start in the first place.
