DIPS 2 (RM6413): a supplier’s guide to Digital and IT Professional Services

DIPS 2 is in pre-market engagement. The proposed structure and requirements below may change. The published tender documents will determine the final rules.

What is DIPS 2?

Digital and IT Professional Services 2 is a planned route for customers with defence and security requirements to buy professional services. Government Commercial Agency (GCA) is developing RM6413 with the Ministry of Defence (MOD).

The October draft lists Digital Delivery; Software Engineering and Application Development; Data, Artificial Intelligence (AI) and Analytics; Knowledge and Information Management; Cyber Security and Information Assurance; Cloud, Infrastructure and Network Services; Technical Assurance and Architecture Services; Project, Programme and Portfolio Management; IT Service Management and Operational Support; and Business Analysis, Transformation and Change Services. Suppliers should check the detailed service lines rather than assume that a broad description of their business proves scope fit.

The October draft excludes contingent labour and resource augmentation, and hardware and software procurement. Think in terms of delivering services and outcomes, not supplying named individuals or selling products. This matters when choosing which contracts to use as evidence.

RM6249 is the predecessor, not a specification for DIPS 2. Its lots, supplier numbers, buying procedures and requirements should not be carried across as rules for the new agreement.

Proposed DIPS 2 lot structure

Proposed structure - subject to change. The current October section proposes three lots. The indicative contract bands appear in the August material reproduced in its appendix; they have not been newly confirmed as October boundaries. The final documents must confirm the exact boundaries, including where contracts worth exactly £5m or £20m belong.

August bands reproduced in the October presentation, not final lot definitions

Proposed lot	Indicative contract band	What suppliers should assess
Lot 1	Above £20m	Capacity for large, complex delivery and the breadth of relevant contract evidence.
Lot 2	£5m to £20m	Relevant service coverage, delivery scale and the evidence needed for direct participation.
Lot 3	Below £5m, through a neutral-vendor model	Whether to investigate operating the arrangement or delivering through it. These are different routes.

A contract-value band describes work bought through a lot. It is not the same as the value of historical contracts used to demonstrate technical ability. Do not read a lot band as a complete entry requirement.

A neutral vendor is an organisation operating an arrangement through which buyers can access delivery suppliers. Bidding to operate that arrangement is different from seeking delivery opportunities through it. A specialist SME should not assume it needs to meet the operator's requirements, or that delivery access will be automatic.

Is DIPS 2 right for your business?

Start with the services you can deliver and evidence, rather than the size of the framework. Relevant questions apply to larger suppliers, established small and medium-sized enterprises (SMEs), specialist providers and potential consortium members alike.

• Do your services fit the intended scope, rather than recruitment or product procurement?
• Can customers confirm relevant delivery, contract values, dates and service coverage?
• Can you deliver at the proposed scale and complexity, including mobilisation and ongoing capacity?
• What cyber, personnel-security, financial or commercial gaps need attention?
• Is a direct bid credible, or would a consortium or supply-chain route be more realistic?
• How would you find, win and deliver work after appointment?

Previous MOD experience is not described as universally mandatory: the draft evidence material for Lots 1 and 2 permits public- or private-sector references. Civil-sector suppliers should assess relevance and readiness, not rule themselves out solely because their customers are outside defence.

Equally, a recognisable customer name is not enough. The evidence needs to show what your organisation delivered, how it relates to the proposed service scope and what capacity you can commit. Advice Cloud's Framework Readiness Review helps assess readiness before committing to an application.

Routes for SMEs and specialist suppliers

Investigate participation routes early, but reassess them against the final procurement documents. Appointment and supply-chain participation are not interchangeable.

Route	Who it may suit	What to check
Direct bid	A supplier able to meet the relevant lot requirements itself.	Scope, evidence, capacity and final participation conditions.
Consortium or partnership	Organisations with complementary capabilities.	Participation rules, responsibility for delivery and how evidence can be relied upon.
Subcontracting	Specialists supporting an appointed supplier.	Commercial terms, security obligations and actual delivery demand.
Neutral-vendor delivery route	Suppliers investigating the proposed Lot 3 arrangement.	The eventual access process, obligations and commercial model.

A supply-chain role is not a direct framework appointment. None of these routes promises acceptance, preferential access or work. Discuss responsibilities with prospective collaborators before treating a route as settled.

Entry requirements and what to prepare

Technical Ability Certificates

Technical Ability Certificates (TACs) are customer-confirmed evidence of relevant delivery, not promotional case studies. The October draft describes provisional evidence requirements for Lots 1 and 2.

Unambiguous elements of the draft TAC proposals, subject to final documents

Proposed evidence requirement	Lot 1	Lot 2
TACs permitted	Up to 3	Up to 2
Evidence period	Previous 3 years	Previous 5 years
Reference sector	Public or private sector	Public or private sector
Service coverage	9 of 10 service lines proposed	Exact coverage awaits clarification
Contract-value evidence	£20m minimum per submitted TAC proposed	£5m threshold discussed; exact aggregation and boundary await clarification

The Lot 2 slides refer to exceeding £5m but illustrate £4m plus £1m. A note about nine service lines also appears below a table specifying five for Lot 2. The draft scope and TAC checklist also use different names for one service line, so they must not be assumed interchangeable. These inconsistencies are unresolved here: do not treat the example or either coverage figure as a definitive rule.

Neutral-vendor operators are a separate case. The October draft proposes 7 of 8 technical requirements, £150m of transacted spend excluding charges, circa 70 call-offs or statements of work annually, up to two TACs and a four-year evidence period, using public-sector references. The accompanying checklist names seven requirements despite the 7-of-8 heading, so the missing eighth requirement needs clarification. These are provisional operator proposals, not conditions for an SME delivery supplier. Do not apply operator thresholds to an SME seeking supply-chain work; check the final operator and delivery-supplier provisions separately.

Map relevant contracts now. Confirm dates, values and actual service coverage; identify customer referees and obtain permission to use evidence. Keep classified or restricted information out of working bid material unless the appropriate handling process expressly permits it.

Cyber assurance and personnel security

Defence Cyber Certification (DCC) Level 0 brings together Cyber Essentials with aligned scope, UK General Data Protection Regulation (UK GDPR) compliance and resilient networks and systems. Use the IASME Level 0 explanation and the MOD's DCC statement for current guidance.

MOD has asked industry partners to achieve Level 0 by 31 December 2026. That request is separate from final DIPS 2 participation conditions and contract-specific obligations. Level 0 is not a guarantee of eligibility or assurance that every contract's requirements are met.

For personnel security, assess which roles may require clearance, available sponsorship and mobilisation lead times. National security vetting requires appropriate sponsorship; it is not something an individual simply buys or independently applies for. See United Kingdom Security Vetting applicant guidance.

Other readiness areas

Area	Published position	Sensible preparation
Financial evidence	Final DIPS 2 financial thresholds await procurement documents.	Prepare current accounts and understand delivery exposure.
Registrations and insurance	October proposes certifications and insurance, but final conditions and some timing details remain unresolved.	Check company details, registrations, cover and renewal dates.
Delivery capacity	Lot design remains provisional.	Assess mobilisation, governance, resilience and available resources.
Consortium responsibilities	Final participation and evidence rules remain to be confirmed.	Agree roles, accountability and commercial assumptions.
Applicable policies	Final documents determine which obligations apply and when.	Identify gaps and distinguish framework-award duties from call-off or mobilisation duties.

October includes proposed ISO and cyber certifications by lot, plus insurance and policy requirements at different stages. These are draft requirements, not final conditions. Delivery-partner onboarding and insurance timing are not fully consistent in the slides. Do not treat familiar standards or financial ratios as universal mandatory conditions; confirm the final lot-specific requirements and timing.

How buyers will award work

Appointment creates a route to compete for work, not a guarantee of contracts or revenue. Individual contracts must follow the final permitted framework procedures. RM6249 buying rules and G-Cloud marketplace advice are not substitutes for those documents.

Prepare a credible delivery proposition alongside the application: understand likely buyer needs, assemble relevant evidence and decide how your organisation will respond to opportunities. Check any proposed call-off mechanisms again when the tender is published.

DIPS 2 timetable and what to do now

Provisional October engagement timetable. These are planning estimates, not submission deadlines.

Milestone	Proposed timing	Source and qualification
Tender launch	March 2027	October supplier surgery and GCA summary; not an application deadline.
Lots 1 and 2 award	September 2027	October lot-specific timetable; subject to change.
Lot 3 award	November 2027	October lot-specific timetable; subject to change.
Lot 3 go-live	February 2028	October lot-specific timetable; subject to change.

The GCA summary gives September 2027 as the general framework award estimate. The October engagement material separates Lots 1 and 2 from the later Lot 3 milestones. Use that distinction for planning, without treating either source as a fixed commitment.

The October material proposes a four-year initial term with two possible one-year extensions, written as 4+1+1. This is not a final agreement period. The earlier notices estimate eight years, and an October structure slide still mentions up to eight years alongside 4+1+1. The duration needs clarification, not an inferred end date.

Value also needs reconciliation. The April pipeline and May preliminary market-engagement notices give £2.4bn excluding VAT and £2.88bn including VAT. October material displays £2.8bn including VAT. These are different dated estimates, not interchangeable figures. No value is shown in the headline facts table; framework value is not guaranteed expenditure.

1. Review service fit and potential participation route.
2. Map relevant delivery evidence and customer contacts.
3. Assess cyber, security and mobilisation gaps.
4. Check financial and commercial readiness.
5. Explore suitable partners where needed.
6. Follow official engagement updates and tender publication.
7. Reassess bid/no-bid and lot choice against the final documents.

How Advice Cloud can help

Framework Readiness Review is the starting point for assessing whether to pursue DIPS 2. Consider your potential route, readiness and evidence before committing time to an application.

Where an application is appropriate, explore framework listing and application support and bid support services. Support does not guarantee appointment or subsequent work.

For alternative routes, compare the scope and buying models in our G-Cloud supplier guide and frameworks index. Neither is a substitute for checking defence-specific needs.

Frequently asked questions

When is the DIPS 2 tender expected?

March 2027 is the published planning estimate. It is not a submission deadline. Follow the GCA agreement page and formal tender notice for confirmed dates.

Are the lots and entry requirements final?

No. October engagement material describes proposals. Final procurement documents will determine the lot boundaries, participation conditions and evidence rules.

Can SMEs participate?

SMEs can investigate a direct bid, consortium, subcontracting or the proposed neutral-vendor delivery route. Each depends on the final rules and the supplier's evidence and capacity; none guarantees access or work.

Do suppliers need previous MOD experience?

Not universally under the draft Lots 1 and 2 TAC proposals, which permit public- or private-sector references. Relevance, security readiness and the final conditions still matter.

What is a Technical Ability Certificate?

A TAC is customer-confirmed evidence of relevant delivery. The draft sets out proposed evidence periods and coverage, but the Lot 2 aggregation and service-line inconsistencies still need clarification.

How is a neutral-vendor operator different from a delivery supplier?

The operator runs the arrangement. A delivery supplier performs work accessed through it. Operator evidence requirements should not be imposed on a supplier simply exploring delivery opportunities.

Do we need DCC or security-cleared personnel?

MOD's Level 0 request and contract-specific security obligations are separate from final DIPS 2 participation rules. Assess relevant roles, sponsorship and lead times; Level 0 does not guarantee eligibility.

Is DIPS 2 an open framework?

The latest engagement proposal is a standard framework, not an open framework. That remains subject to final documents; do not assume either reopening opportunities or that this is your only route to defence work.

Does appointment guarantee work?

No. Appointment provides a procurement route. Suppliers must still compete under the final permitted procedures and demonstrate a credible proposition to buyers.

Sources and latest updates

Information checked on 27 October 2026. Engagement design remains provisional. Final procurement documents take precedence over engagement proposals and older appendices.

• October supplier surgery, version 1.1: latest engagement design and draft evidence proposals reviewed for this guide.
• GCA RM6413 agreement page: summary status and planning milestones.
• techUK engagement archive: access to engagement sessions and material; session dates may differ from upload dates. The GCA link names 2 October while the PDF cover names 5 October; this guide therefore refers to the October surgery without assigning an exact session or upload date.
• Earlier pipeline notice, 033696-2026 and preliminary market-engagement notice, 045246-2026: earlier plans, not final conditions. Both notice bodies were checked for this update; their estimates predate the October design.
• IASME DCC Level 0 explanation, MOD DCC statement and UKSV applicant guidance: cyber and personnel-security context.

27 October 2026: Replaced predecessor-led guidance with the proposed DIPS 2 structure, supplier routes, readiness advice and lot-specific timetable. Flagged the value, term and TAC inconsistencies rather than treating them as final rules.