What is Cyber Security 4? A guide for cyber security suppliers

Cyber Security 4 will replace the Cyber Security Services 3 DPS, and it probably won’t work the same way. Here’s what we know so far, what suppliers have told the Government Commercial Agency (GCA), and how to prepare.

Cyber Security 4 timeline

The Government Commercial Agency (GCA) has published these estimated dates. Cyber Security 4 is still in pre-market engagement, so expect them to move. Check the Cyber Security 4 agreement page for the latest.

• Pre-market engagement: July to December 2026
• Drafting of procurement documents: January to September 2027
• Tender notice published on Find a Tender: autumn 2027
• Framework award: spring 2028
• Cyber Security Services 3 DPS expires: 13th February 2029

Supplier engagement events still to come, all run with techUK:

• 26th November 2026, 2pm to 3.30pm: progress on scope and Procurement Act 2023 mechanisms
• 2nd December 2026, 10am to 11.30am: framework requirements and terms and conditions
• 8th December 2026, 10am to 11.30am: an update for SMEs, with a chance to give your views

What is Cyber Security 4?

Cyber Security 4 (RM3764.4) is GCA’s next agreement for buying cyber security services. It’s being let under the Procurement Act 2023, the law that has governed most UK public sector buying since 24th February 2025, and it will be open to all public sector organisations.

GCA says it will likely include:

• NCSC assured services
• consultancy and advice
• penetration testing
• incident response
• managed security services

The final scope, the type of agreement and the way buyers will run competitions are all still being decided through market engagement.

What it replaces: Cyber Security Services 3

Cyber Security 4 replaces Cyber Security Services 3 (CSS3, RM3764.3), a dynamic purchasing system (DPS). A DPS is a list of qualified suppliers that buyers use to run competitions, and suppliers can apply to join at any time while it’s running.

CSS3 has one lot, covering consultancy and advice, penetration testing (including the NCSC assured CHECK scheme and IT health checks), incident management, data destruction and IT sanitisation, and managed security services such as CREST accredited security operations centres. Its estimated total value is £800 million, and it runs until 13th February 2029.

It’s used for substantial work. NHS England, for example, published plans to procure a £10 million cyber security operations centre and incident response contract through CSS3.

The big question: how will suppliers get on?

This is the change that matters most. CSS3 works like a revolving door: you can apply whenever you’re ready. Cyber Security 4 may work more like a door that opens on a timetable.

GCA has said it is still deciding between an open framework and a closed framework, and its supplier events have also discussed a dynamic market, the Procurement Act’s replacement for the DPS. The differences matter:

• Closed framework. One application window. Miss it and you can’t join until the framework is replaced.
• Open framework. Reopens to new suppliers at set points during its life, so a missed window means a wait rather than a lockout.
• Dynamic market. Like a DPS, suppliers can apply to join at any time.

If Cyber Security 4 becomes a framework rather than a dynamic market, suppliers used to joining CSS3 whenever they like will need to plan around an application window for the first time.

What suppliers have told GCA so far

At GCA’s supplier webinar on 19th October 2026, attendees voted on how Cyber Security 4 should work. These are suppliers’ views, not GCA decisions, but they show where the market is pushing:

• Framework model: an 8-year open framework with no cap on supplier numbers ranked first, ahead of a 4-year open framework and both closed options.
• Reopening: if it’s an open framework, 18 months was the preferred reopening interval.
• Call-off competitions: single-stage competitions drew the most support (21 votes), ahead of shortened competitions (16) and multi-stage competitions (10).
• Innovation: 16 of 19 respondents wanted an innovation route at call-off.

Suppliers also discussed award without competition, particularly for urgent incident response, where several pointed out that “urgent” can mean hours, not weeks.

Who should be looking at Cyber Security 4?

• Current CSS3 suppliers: your place on the DPS won’t carry across, so plan to apply in your own right
• Penetration testing providers, including CHECK and IT health check suppliers
• Incident response providers, including those offering urgent response
• Managed security and SOC providers
• Cyber security consultancies covering risk, audit, architecture, strategy and training
• Data destruction and IT sanitisation suppliers
• SMEs: GCA is running a dedicated SME engagement session on 8th December

How to prepare for Cyber Security 4

The tender isn’t expected until autumn 2027, which is exactly why now is the time to get ready.

1. Take part in engagement. Register for the remaining techUK sessions, and register your interest with GCA to hear about future events. This is your chance to influence how the framework works.
2. Read what’s already published. GCA has shared its supplier Q&A log, slide decks and feedback summaries on the Cyber Security 4 page.
3. Consider joining CSS3 now. Suppliers can still apply to join the DPS while it’s live, and contracts won through it before Cyber Security 4 arrives become the evidence and case studies you’ll need for your application. See our DPS and dynamic market application support.
4. Get your certifications in order. The requirements haven’t been published, but other recent GCA agreements have asked for Cyber Essentials before award, and buyers of cyber services will expect relevant NCSC assurance and ISO 27001 where it fits your services.
5. Build your evidence. Pull together recent public sector cyber work with clear outcomes and numbers, so you’re not starting from scratch when the window opens.
6. Plan for a fixed window. If Cyber Security 4 becomes a framework, there may be only one chance to get on. Know who will write your application, and when, before the tender notice lands.

Next steps

We’ll update this page as GCA confirms the design, scope and dates of Cyber Security 4. To hear as soon as it changes, subscribe to our Supplier Side newsletter.

Framework applications are what we do every day, and our clients average a 97% quality score on competitive frameworks outside G-Cloud. If you’re weighing up whether to join CSS3 now, or want to start preparing for Cyber Security 4, book a chat with Jack.