G-Cloud 15: Secure File Transfer and Request Management

Public sector organisations buying cloud software often use G-Cloud, the government framework for cloud services. G-Cloud 15 started on 6 August 2026, and its predecessor G-Cloud 14 expires on 28 October 2026. Until then, both frameworks are available for buyers to use.

G-Cloud 15

G-Cloud is a framework agreement. It allows public sector organisations to buy cloud services from suppliers that have already been evaluated. This can save time for potential buyers, as checks on the supplier's quality, technical capability and pricing have already been carried out before a purchase begins.

Changes from G-Cloud 14

• Services are grouped into five lots. Software such as File Transfer and Request Management platforms sits in Lot 2b, Software as a Service (SaaS).
• A more comprehensive supplier evaluation. Every supplier is evaluated against quality, technical capability and price before being featured on G-Cloud 15.
• New suppliers can join at set points of the framework’s four year life span so the range of services available is expected to grow over time.

Finding and buying services

G-Cloud 15 service listings can be searched publicly on the Digital Marketplace. Each listing sets out the service's features, security information, pricing and terms.

There are two routes to a contract.

• Award without competition - for requirements that are straightforward. Buyers typically filter the available services against their requirements and pick a suitable supplier.
• Competitive selection process - for requirements that are complex, high value or need a tailored solution. Buyers ask suppliers to submit proposals and score them against published criteria, such as quality and price, awarding to the best overall response.

Contracts already signed under G-Cloud 14 can continue after it expires. However, any new contract under that framework must be signed before it expires on 28 October 2026. Contracts do not transfer from G-Cloud 14 to G-Cloud 15, so when an existing contract reaches the end of its term (often including on additional + 1 year extension), any replacement needs to be awarded as a new contract under G-Cloud 15.

Checking a listing

Any supplier being featured on the framework confirms that they have passed evaluation. It does not confirm that a particular service meets an organisation's own data protection requirements. Before a buyer awards any cloud services contract to a supplier, it is typically worth checking:

• Where files are hosted and stored.
• Which independent certifications the supplier holds, and whether they can be verified on a public register. For NHS organisations, this typically includes the supplier's status on the NHS Data Security and Protection Toolkit (DSPT).
• Solution, fundamentals. Ensuring the offering is fit for purpose.

How AMS approaches G-Cloud 15

AMS has two services listed on G-Cloud 15, both under Lot 2b, Software as a Service (SaaS): AMS File Transfer and AMS Request Management Portal.

AMS File Transfer is typically used when a file is leaving or coming into an organisation. Transfers are protected with 256 bit AES encryption, and optional controls such as Digital Rights Management can limit downloading or printing. A full audit trail records the process end to end.

The AMS Request Management Portal is used to capture, track and manage Subject Access Requests (SARs), Freedom of Information (FOI) requests and other information requests. It provides secure digital disclosure, built in KPI reporting and a full audit trail of the request process.

AMS is ISO 27001 certified, Cyber Essentials certified and NHS DSPT compliant. All AMS Secure Cloud solutions are hosted in Microsoft Azure UK datacentres, supporting UK data sovereignty requirements.

If you are reviewing how your organisation procures Secure File Transfer or Request Management solutions, we would love to hear about your requirements. Our team will be able to advise on the right fit for you.