UK public sector frameworks are how most councils, NHS bodies, universities and government departments buy backup storage. A framework is an agreement that a central body has already competed, with a list of approved suppliers and standard terms, so that a buyer can place an order without running a full procurement of its own. Choosing the right framework and the right route within it decides how quickly a backup target can be bought and how well it fits the need.
This post describes the legal background, the frameworks that matter for backup storage, the ways of awarding a contract under them and how to write a requirement that produces comparable answers. It is a general overview and not legal advice.
Public procurement in the UK is governed by the Procurement Act 2023, which came into force on 24 February 2025 and replaced the Public Contracts Regulations 2015 along with the separate regimes for utilities, concessions and defence. Frameworks that were set up before that date continue under the old regulations until they expire, so buyers currently work with both. The central body for common goods and services was known as Crown Commercial Service until 1 April 2026, when it became the Government Commercial Agency.
Two agreements are relevant, and they are meant for different kinds of purchase.
| Framework | What it covers | Dates | Use for backup storage |
|---|---|---|---|
| Technology Products and Associated Services 2 (RM6098) | Technology hardware, software and related services, including servers, storage and backup | 10 October 2023 to 9 October 2027 | On-premises backup targets, as hardware, software or both |
| G-Cloud 15 (RM1557.15) | Cloud hosting, cloud software and cloud support services | From 6 August 2026 | Backup delivered as a cloud service |
The technology products framework is divided into lots, including a combined lot for hardware, software and associated services and separate lots for hardware and for software, alongside specialist lots for health, education and information-assured technology. A backup target bought as an appliance, or as software to run on servers the buyer already has, belongs here. G-Cloud is the route for services consumed from a provider's cloud, with call-off contracts that can run for several years. The distinction matters because the two frameworks compare offers differently and carry different terms.
Frameworks generally offer more than one way to place an order. Under the technology products framework a buyer can run a further competition among the suppliers on a lot, make a direct award where the terms allow it, or buy low-value, low-complexity items from an online catalogue. G-Cloud 15 offers award without competition for straightforward, low-value needs on lowest price, and a competitive selection process awarded on the most advantageous tender.
Direct award is quick and suits a like-for-like capacity extension. For a new backup target it is rarely the best route, because the meaningful differences between offers, such as how immutability is enforced and what a restore costs in time, do not show up in a catalogue price. A further competition with a clear requirement takes longer and gives suppliers the chance to answer the actual need. Comparing backup storage offers in procurement gives a structure for scoring the answers.
Public sector requirements in the UK usually draw on guidance from the National Cyber Security Centre. Two points recur. The first is Cyber Essentials, the government-backed baseline scheme: frameworks can include a schedule obliging the supplier to hold and maintain certification, and buyers should decide whether they need it. The second is the centre's guidance on backups, which expects offline or otherwise protected copies and routine restore testing, and whose principles for ransomware-resistant backups ask that copies cannot be destroyed by an attacker with stolen credentials and that earlier versions remain restorable. NHS organizations also complete the Data Security and Protection Toolkit each year.
These references become useful when they are turned into testable statements. A requirement that backup copies be immutable for a defined period, with no account able to shorten that period, can be demonstrated. What immutable backups protect against sets out what such a control covers and what it leaves to other measures.
A further competition is only as good as the requirement it is based on. For backup storage, four things should be stated plainly. Usable capacity after protection overhead, today and at the end of the contract, with growth assumptions shown. The backup software in use and the interface it will write to. The restore performance expected, defined as a workload and a time. And the retention and immutability behavior required. Asking for whole-life cost in place of purchase price brings support, power and expansion into view, which is the comparison made in cloud versus on-premises backup recovery cost.
Timing belongs in the requirement too. Budget cycles concentrate orders toward the end of the financial year, when delivery times lengthen. Hardware lead times explains how to plan around that, and why a design that can start on existing servers is easier to schedule.
ARTESCA is object storage software used as a backup target. It is deployed in the customer's own data center, either as a software appliance on industry-standard x86 servers or as a pre-configured hardware appliance in all-flash or hybrid configurations, which corresponds to the hardware and software routes of a technology products framework. Immutability is provided by S3 Object Lock, and in compliance mode no account, including ARTESCA administrators, can remove a lock before it expires.
The repository has its own administrative accounts, separate from the backup server and the production directory. ARTESCA grows within the same deployment from roughly 50 TB to 8.5 PB and is used as a target for Veeam and other backup software.
A short pre-market step pays for itself: confirm which framework and lot fit the purchase, check its expiry date against the planned timetable, and write the four requirement points above before speaking to suppliers. Buyers who do this get answers they can compare, and they avoid discovering after award that the cheapest compliant offer does not do what the backup design assumed.