Crown Commercial Service Security Framework: 2026 Guide

Last updated: 17 October 2026

Pulse Operations notes the Crown Commercial Service security framework most relevant to physical and manned guarding needs is RM6257, running 1 November 2022 to 30 April 2026 with 4 lots and 37 suppliers, while cyber security procurement sits on a separate route, Cyber Security Services 3, now extended to February 2029 with an estimated value of £800 million.

Key Takeaways

• RM6257 (Security – Physical, Technical and Support Services) runs from 1 November 2022 to 30 April 2026 and lists 37 suppliers across 4 lots, per Crown Commercial Service (2022).
• Cyber Security Services 3 has been extended to February 2029, taking its estimated contract value to £800 million, per UKAuthority (2026).
• CCS delivered £3.8 billion in commercial benefit to the public sector in 2022/23, up from £2.8 billion the year before, per TSP Security Frameworks (2023) and STM Group / Crown Commercial Service (2022).
• 71% of the 121 suppliers on Cyber Security Services 2 were SMEs, showing these frameworks are not closed to smaller firms, per GOV.UK (2017).
• Buyers and suppliers routinely confuse the commercial framework ("Security Services") with the government-wide Security Policy Framework — they are not the same thing.

What is the Crown Commercial Service and what does it do in security procurement?

The Crown Commercial Service (CCS) is an executive agency of the Cabinet Office that negotiates and manages framework agreements so that central government departments, local authorities, the NHS, police forces, education bodies and other public sector organisations can buy goods and services without running a full tender from scratch each time. CCS does not deliver security services itself — it pre-qualifies suppliers, sets commercial terms, and lets buyers "call off" against an agreement that has already cleared procurement law.

For security specifically, CCS operates more than one route. Physical and technical security sits under RM6257, while cyber security consultancy and services sit under the separate Cyber Security Services 3 dynamic purchasing system. A dynamic purchasing system (DPS) is a flexible, open-ended procurement model under which new suppliers can join throughout its life, unlike a fixed-term framework with a closed supplier list.

CCS's scale matters to anyone deciding whether to go through it or to the open market. CCS helped the public sector achieve commercial benefits equal to £3.8 billion in 2022/23, up from £2.8 billion in 2021/22 — a trajectory that signals growing reliance on these agreements rather than ad hoc tendering, per TSP Security Frameworks (2023) and STM Group / Crown Commercial Service (2022). For security and FM operators bidding into this market, Pulse Operations's guide, How to win your next security tender, sets out how these scored agreements actually get awarded once a supplier has cleared the entry gates.

What does RM6257 cover, and what are its lots?

RM6257, titled Security – Physical, Technical and Support Services, is the current CCS framework for manned guarding, technical security systems and related support, running from 1 November 2022 to 30 April 2026 with 4 lots and 37 approved suppliers, per Crown Commercial Service (2022). Buyers call off against whichever lot matches their need rather than running a fresh OJEU-style tender for every contract.

The lot structure typically separates services by category — for example manned guarding and physical security officers, technical security systems (CCTV, access control, intruder alarms), security consultancy and risk assessment, and support services such as key holding or mobile patrols. Exact lot titles and supplier lists sit on the official Crown Commercial Service RM6257 agreement page, which Pulse Operations advises buyers to check before assuming a given supplier covers a given lot.

With the agreement due to lapse on 30 April 2026, buyers currently relying on RM6257 need a watch point for the re-tender or extension announcement — a gap here would force affected contracts back onto the open market or an interim arrangement. Suppliers already on the framework, and those hoping to join a successor agreement, should treat the compliance gates — SIA licensing, BS 7858 screening records, insurance and Martyn's Law readiness — as live requirements now, not something to assemble after a tender notice drops. The guide, the ACS self-assessment: how to evidence it, explains how the Approved Contractor Scheme's 78 indicators map onto records most operators already hold but can't easily produce on demand.

Who is eligible to buy through the Crown Commercial Service security framework?

Public sector bodies across the UK are eligible to buy through CCS frameworks, including central government departments, local councils, NHS trusts, police and fire services, housing associations, and further and higher education institutions. Eligibility is set out in the specific framework's customer access schedule rather than assumed — not every public body can use every framework, and some charities or arm's-length bodies qualify only where explicitly named.

A private sector facilities management company managing a public building under contract, for instance, may or may not be able to call off on a client's behalf, depending on the terms of that specific agreement. Buyers should check the eligibility schedule on the Crown Commercial Service page before assuming access, particularly for devolved administrations in Scotland, Wales and Northern Ireland, which sometimes run parallel frameworks through their own procurement bodies.

Where an organisation is not eligible, or wants wider market competition than a closed framework supplier list offers, the alternative is an open tender under the Procurement Act 2023 — the legislation that reshaped public procurement rules from February 2026 onward, replacing the old Public Contracts Regulations 2015 with a "most advantageous tender" test rather than "most economically advantageous tender." That shift matters for security bids: price and quality are weighed explicitly, and bidders need evidenced claims, not assertions, to score well.

What security clearances and accreditations do suppliers need?

Security clearances required on CCS frameworks typically include SIA (Security Industry Authority) licensing for all operatives carrying out licensable activities such as manned guarding, door supervision or close protection. Beyond licensing, suppliers are commonly expected to evidence BS 7858 screening — the British Standard for security screening of individuals employed in a security environment — and, for roles touching government premises or assets, National Security Vetting at Counter Terrorist Check (CTC), Security Check (SC) or Developed Vetting (DV) level depending on sensitivity.

For technical and cyber-adjacent work, Cyber Essentials and Cyber Essentials Plus — the NCSC-backed scheme that verifies basic cyber hygiene controls — are frequently mandated, as set out in the Cabinet Office's Procurement Policy Note on the Cyber Essentials scheme. Government sites or data holding sensitive material are classified under the Government Security Classifications Policy, which determines what clearance level staff handling that site or data must hold.

For NPPV (Non-Police Personnel Vetting), typically required where a contractor's staff access police premises or information, the requirement is set by the individual police force rather than by CCS centrally, so buyers should confirm specifics in the call-off documentation.

"Every bid says professional, SIA-licensed, 24/7 control room — so none of it scores. Walk in with evidence instead: photo-verified patrols, delivered-vs-contract numbers, and a portal login the evaluators can open themselves. Proof the incumbent can't match changes the conversation." — Mo Hassan, Founder, Pulse

That evidence point applies as much to framework renewal bids as to open tenders: a supplier re-applying for a successor to RM6257 needs its screening records, licence checks and site documentation ready to produce, not promised.

How does CCS framework procurement compare with other routes?

Cyber Security Services 3 illustrates why structure matters for suppliers deciding where to invest bid effort: it was published 4 January 2023 as a dynamic purchasing system for 60 months with an estimated value of £0–£255 million, per Find a Tender / bidstats.uk (2023), and has since been extended to February 2029 with the estimated contract value rising to £800 million, per UKAuthority (2026). Because it's a DPS rather than a closed framework, suppliers can apply to join at any point rather than waiting for a re-tender window — a materially different entry path than RM6257's fixed supplier list.

For physical security firms with no cyber offering, RM6257 and its eventual successor remain the relevant route; for consultancies or MSSPs, Cyber Security Services 3's rolling entry is the more accessible door. Buyers choosing between an open tender and a framework call-off should weigh speed (frameworks are faster) against competition (open tenders can surface better value if the framework's supplier pool is thin for a specific need).

What mistakes do buyers and suppliers make with this framework?

Buyers most commonly conflate the CCS commercial framework with the government-wide Security Policy Framework (SPF) — a risk management policy covering how HM Government protects its own assets, not a procurement vehicle. The two share the word "security" and little else; confusing them leads to buyers asking suppliers for the wrong documentation or assuming SPF compliance substitutes for framework eligibility checks.

Suppliers frequently under-prepare their compliance evidence, assuming a policy statement will suffice where assessors and evaluators want records: screening done to BS 7858 with a file per person, not a policy that merely asserts screening happens, per Pulse Operations's guide, How to win your next security tender. Another recurring error is leaving TUPE (Transfer of Undertakings, Protection of Employment) planning until after award — on most re-tenders the incumbent's staff transfer to the new contractor under TUPE, and buyers scoring mobilisation quality expect a credible plan for this at bid stage, not after.

On the buyer side, a frequent pitfall is assuming every lot within a framework carries the same supplier list — RM6257's 4 lots don't all contain the same 37 suppliers, and checking the specific lot's roster before issuing a mini-competition avoids wasted cycles. Suppliers also sometimes misjudge price/quality weighting: published splits commonly run from 60/40 to 30/70 in favour of quality, meaning a bid priced 5% higher can still win comfortably if it scores a grade better on quality — chasing the lowest price alone is optimising the smaller factor.

Your crown commercial service security framework checklist

• Confirm which CCS framework matches your need — RM6257 for physical/technical security, Cyber Security Services 3 for cyber consultancy.
• Check the eligibility schedule on the Crown Commercial Service page before assuming your organisation can call off.
• Verify which of the 4 RM6257 lots and its specific supplier list applies to your requirement.
• Request evidenced SIA licensing, BS 7858 screening records and Cyber Essentials (or Plus) certificates from shortlisted suppliers rather than policy statements.
• Note RM6257's 30 April 2026 end date and plan for a successor agreement or bridging arrangement.
• Ask suppliers for a TUPE and mobilisation plan if this is a re-tender with an incumbent in place.
• Weight your mini-competition scoring toward the published price/quality split rather than lowest price alone.
• Distinguish framework eligibility from Security Policy Framework (SPF) compliance — they are governed separately.

FAQ

What is the Crown Commercial Service security framework?

The Crown Commercial Service security framework most commonly refers to RM6257, the Security – Physical, Technical and Support Services agreement running from 1 November 2022 to 30 April 2026 with 4 lots and 37 suppliers, per Crown Commercial Service (2022). Cyber security sits on a separate route, Cyber Security Services 3.

What security clearance is required for CCS frameworks?

Required clearances depend on the contract, but commonly include SIA licensing for licensable guarding activities, BS 7858 screening, and National Security Vetting (CTC, SC or DV) for roles accessing sensitive government sites. Cyber-facing roles typically need Cyber Essentials or Cyber Essentials Plus under the Cabinet Office's procurement policy note.

Is Cyber Essentials mandatory for Crown Commercial Service contracts?

Cyber Essentials is mandatory for many CCS contracts involving the handling of sensitive and personal information, as set out in Cabinet Office procurement policy. Higher-risk contracts may require Cyber Essentials Plus, which adds independent technical verification to the self-assessment base.

What is the difference between RM6257 and Cyber Security Services 3?

RM6257 covers physical and technical security — manned guarding, CCTV, access control and consultancy — as a fixed-term framework with 37 suppliers. Cyber Security Services 3 is a dynamic purchasing system for cyber consultancy and services, open to new suppliers throughout its term, extended to February 2029 per UKAuthority (2026).

How do I become a supplier on a CCS security framework?

Suppliers apply when CCS runs a tender to establish or refresh a framework, submitting evidence against selection criteria such as financial standing, insurance, SIA licensing status and screening compliance. For a dynamic purchasing system like Cyber Security Services 3, suppliers can apply to join at any point during its term rather than only at launch.

How long does a Crown Commercial Service framework agreement last?

Terms vary by agreement. RM6257 runs for roughly three and a half years, from 1 November 2022 to 30 April 2026, per Crown Commercial Service (2022), while Cyber Security Services 3 was set up for 60 months from its January 2023 publication and has since been extended to February 2029.

What is the Government Security Classifications Policy?

The Government Security Classifications Policy is HM Government's framework for classifying information assets by sensitivity, which determines the level of protective security and personnel vetting required around them, as set out on GOV.UK. It underpins many of the clearance requirements attached to CCS security contracts rather than being a procurement framework itself.

Securing your next framework win with Pulse Operations

Winning a place on a framework like RM6257, or holding one through re-tender, comes down to the same thing evaluators always ask for: evidence, not assertions. Pulse Operations exists to generate that evidence as a by-product of day-to-day delivery — photo-verified patrols, a tamper-evident daily occurrence book, and a compliance runway tracking SIA, BS 7858, DBS and Martyn's Law expiries in one place, so an assessor's request for screening records doesn't trigger a scramble through filing cabinets.

At Priority First, the founding team's own London security and FM operation where Pulse was built before being offered to other operators, all 152 checkpoints across a West London mixed-use development were made photo-mandatory, moving the site from no way to prove a 3am plant room check to 540+ logged patrols in the first five months live since February 2026 — production data as of July 2026.

If your business is preparing a framework application, a re-tender submission, or simply wants its compliance evidence ready before the next assessment, book a conversation with Pulse Operations to see how the platform maps onto what evaluators actually ask for.

Related Reading

• Case Study Format for Security Tenders (UK Guide 2026)
• Bid Writing for Security Companies: UK Guide 2026
• Security RAMS Template: UK Guide + Free Framework 2026

★ Add pulse-operations.co.uk as a preferred source on Google