Cyber Security Services 3

A flexible commercial agreement that offers an extensive range of cyber security services to help improve organisational cyber resilience and security posture.  

Updates

15 July 2026: We are currently designing the next iteration of this agreement: RM3764.4 Cyber Security 4. Visit the agreement page for further details on buyer and supplier market engagement.

Description

This dynamic purchasing system (DPS) is available to all UK central government departments, wider public sector organisations and charities. The services available fall under the following categories:

  • NCSC assured services
  • consultancy and advice
  • penetration testing
  • incident response
  • managed security services

The DPS allows you to shortlist suppliers based on your needs using a range of filters. Once you have established your shortlist you can use this to run a further competition.

Benefits

  • official route to market to buy NCSC assured services
  • agility and flexibility to meet the public sector’s cyber security needs
  • suppliers can apply to join at any time
  • a dynamic filtering system, giving customers flexibility based on need
  • quality and price can be assessed based on an individual customer’s need
  • a dynamic pool of suppliers that can grow and evolve with the market

Products and suppliers

Please read the 'How to buy' tab below for detailed instructions on how to find out which suppliers are on this agreement.

Lot 1: Cyber Security Services 3
You can access the following services:
  • consultancy and advice including:
    • risk assessment and management
    • audit and reviews
    • security architecture
    • certification
    • training
    • policy
    • security specialists
    • supply chain analysis
    • cyber transformation
    • security strategy
  • penetration testing including the National Cyber Security Centre (NCSC) assured service CHECK and IT health check
  • incident management including cyber incident response, disaster recovery, threat intelligence and business continuity disaster recovery (BCDR)
  • data destruction and IT sanitisation, the process of removing data so it cannot be accessed
  • managed security services including crest accredited Security Operations Centre (SOC) and managed detection and response

Expires:

How to buy

  1. Register as a buyer.
    • note: although pages are headed ‘Supplier registration’ this is also where you can register as a buyer
  2. Navigate to the Cyber Security Services 3 DPS and log in with your username and password, click on ‘confirm’ at the bottom of the text, and agree to the terms of use.
  3. On your ‘Manage your DPS Category Exports’ page you now have 2 options (in the bottom right-hand corner of the page):
    • view appointed suppliers
    • click on the link to create a new category export, this is how you filter the suppliers that meet your needs
  4. Use the filtering tool to specify your needs, this will create a list of capable suppliers.
  5. Save your filtered list of capable suppliers by clicking the ‘Save Category’ option.
    • on the ‘Manage your Category Exports’ page export the list of suppliers and contact details (export to an Excel spreadsheet)
  6. Log out of the DPS.
  7. Use the list to run a further competition. Invite the suppliers identified by the DPS to bid against your detailed specification and evaluation criteria.
    • the list is valid for 2 working days only, from the date of its creation, because new suppliers may be applying to join at any point
    • if your further competition excludes eligible suppliers it potentially breaches procurement regulations. Obtain a fresh supplier list (steps 3.2 to 5) if you do not use your list within 2 working days by clicking the ‘Search Again’ option for your export
    • you can use your own eSourcing tool or the our eSourcing tool to run a further competition. The our eSourcing tool is free to use for public sector buyers
  8. Evaluate responses and award contract.

Detailed buyer guidance is available in the documents section. Additionally, you can watch the How to use the Cyber Security Services 3 Dynamic Purchasing System video. 

Documents

Updates

Crown Commercial Service (CCS) became Government Commercial Agency (GCA) on 1 April 2026. Documents published before this date may still refer to CCS. All contract documents remain valid for existing and new contracts, and there are no changes to how you work with us.

Documents