Topic 6.3 — Procurement & Commercial

In one sentence: How you buy and contract for digital determines who controls your data, whether your services stay safe and interoperable, and whether public money delivers value — so procurement is a strategic and clinical-safety discipline, not a back-office formality.

Why this matters in health and care#

Almost nothing large in digital health and care is built entirely in-house. Electronic patient records, shared care records, patient-facing apps, infrastructure, analytics platforms, and the specialists who deliver them are bought from suppliers under contracts that can run for five, seven, or ten years. The commercial choices you make at the point of purchase — what you specify, who can bid, who owns the data, how you exit — shape the service far longer than any single delivery sprint. A poor contract locks in a poor service, and in this sector a poor service is not just inconvenient; it can be unsafe, inequitable, and a breach of public trust.

The stakes are concrete. Public bodies in the United Kingdom spend hundreds of billions of pounds a year through procurement, and health and care is one of the largest components. Every pound is public money, subject to statutory duties of transparency and value, and to scrutiny by auditors, regulators, and — when things go wrong — Parliament and the press. A botched procurement wastes that money twice: on the failed contract and again on the remediation. Worse, a contract that hands a supplier control of clinical data with no exit route can trap an organization for a decade, unable to switch even when the service degrades.

Procurement is also where equity and safety are quietly decided. Buy a system that cannot exchange data with others (see Topic 4.3 — Interoperability & Data Standards) and you have bought a silo that fragments care; specify only the cheapest input rather than the safest outcome and you may get exactly what you paid for. Getting the commercial ways of working right is inseparable from getting the clinical and equity outcomes right.

Core concepts#

Public procurement and its principles. Government procurement in the United Kingdom is the regulated process by which public bodies buy goods, works, and services. Since the Procurement Act 2023 came into force (for contracts advertised from early 2025), the regime for most public bodies in England, Wales, and Northern Ireland rests on a small set of principles that every commercial decision must honour: transparency, fair and equal treatment of suppliers, the pursuit of value for money and the public good, and integrity (acting with honesty and avoiding conflicts of interest). Health-specific rules — notably the NHS Provider Selection Regime for the procurement of health care services — sit alongside the general regime, so you must know which applies to a given purchase.

Build vs buy vs configure. Every requirement invites three broad options: build it yourself, buy an off-the-shelf product, or buy a platform and configure it. Building gives control but demands durable in-house capability; buying is faster but risks lock-in and misfit; configuring a commercial off-the-shelf product is the common middle path. The decision hinges on whether the capability is a genuine differentiator (rare — usually worth building or heavily shaping) or a commodity (usually worth buying), and on the honest total cost of ownership over the whole life, not just the licence price (see Topic 6.0 — Financial Management & Business Cases).

Routes to market. Rather than run a full competition every time, public bodies often buy through pre-established routes. A framework agreement is an arrangement with one or more suppliers, established by a central purchasing body, from which buyers call off contracts under agreed terms. In the UK the Crown Commercial Service (CCS) operates cross-government frameworks including G-Cloud (cloud hosting, software, and support) and the Digital Marketplace; NHS bodies operate health frameworks; and dynamic markets (the Procurement Act successor to dynamic purchasing systems) let new suppliers join over the life of the arrangement. These routes trade some bespoke tailoring for speed, pre-assured terms, and lawful compliance.

Outcome-based vs input-based specification. An input specification tells the supplier exactly what to build and how; an outcome or performance-based contract defines the result you want and the measures of success, and lets the supplier propose how. Outcome-based specification suits complex, evolving digital services, but demands mature measurement and a client who can judge outcomes rather than count deliverables.

Vendor lock-in, portability, and open standards. Vendor lock-in is being unable to switch supplier without prohibitive cost, because your data, integrations, or skills are trapped in one vendor's proprietary world. The commercial antidotes are data portability (your data exportable in usable form), open standards (see open standard) written into the contract, and explicit exit and transition arrangements agreed before you sign, not after the relationship sours.

Social value. The Public Services (Social Value) Act 2012 requires public bodies to consider the wider economic, social, and environmental benefits of what they buy — local employment, skills, carbon reduction, health inequalities. Social value is now routinely weighted in evaluation, and under the Procurement Act the pursuit of public good is explicit.

SME access, contract management, and intelligent-client capability. Policy actively encourages access for small and medium-sized enterprises (SMEs) and start-ups, because a market dominated by a few giants is fragile and expensive. Once a contract is signed, contract management and supplier relationship management determine whether the value on paper is realized in practice. Where contract management enforces the terms, supplier relationship management is the in-life discipline of governing performance, sustaining a working partnership, and managing supplier risk and concentration across the years the contract runs. Underpinning all of it is intelligent-client capability: enough in-house understanding to specify, evaluate, and hold suppliers to account. You can outsource delivery; you can never outsource accountability.

Best practices#

1. Decide build vs buy vs configure deliberately, on total cost of ownership. Ask whether the capability is a true differentiator or a commodity, and cost the whole life — licences, integration, exit, and the in-house skills you must keep — not the sticker price. The default in a resource-constrained public body is to buy or configure a commodity and reserve building for the rare genuine differentiator. Write the reasoning down so it can be revisited when circumstances change.

2. Engage the market before you specify, transparently. Pre-market engagement — supplier days, requests for information, published pipelines — lets you learn what the market can offer and lets suppliers prepare, without giving anyone an unfair edge. Done openly and recorded, it produces better specifications and more, and more diverse, bidders. Done secretly with a favoured supplier, it corrupts the competition and breaches the integrity principle; keep it even-handed and documented.

3. Specify outcomes, not just inputs, where the work is complex. For evolving digital services, define the outcomes, service levels, and measures you care about, and let suppliers propose the how, rather than freezing a detailed solution you will regret. This suits agile delivery and lets better ideas surface. It only works if you can genuinely measure the outcomes and resist the temptation to drift back into managing tasks; pair it with clear acceptance criteria (see Topic 3.5 — Delivery Lifecycles).

4. Write portability, open standards, and exit into the contract before you sign. Require that data be held in, or exportable to, open and interoperable formats (see Topic 4.3 — Interoperability & Data Standards), that interfaces use published standards, and that a costed exit and transition plan exists from day one. The moment of maximum leverage is before signature; afterwards the supplier has every incentive to make leaving hard. Treat open standards as a commercial lever, not merely a technical preference.

5. Choose the route to market on fit, not habit. A framework or dynamic market is faster and lawfully safer than a bespoke competition, but only if its terms fit your need and its call-off rules give real competition rather than a rubber stamp. Check that the route allows the outcome-based, agile contracting you want and does not quietly exclude the SMEs you are trying to reach. Do not default to last time's framework simply because it is familiar.

6. Weight social value and SME access honestly. Give social value a meaningful, published weighting tied to outcomes you will measure — local skills, reduced inequalities, carbon — and design the process so smaller firms can compete: proportionate requirements, prompt payment, SME-sized lots, no needless turnover thresholds. Token weighting that no one checks after award is theatre; genuine SME participation makes your supply market more resilient and often more innovative.

7. Resource contract and supplier relationship management from day one. The value promised in a bid evaporates without active management: track performance against service levels, hold regular reviews, manage change, and build a relationship robust enough to survive problems. Name an accountable contract owner with the time and authority to do the job, not a signature that files the contract and moves on. Most realizable value — and most risk — lives in the years after award (see Topic 9.0 — Collaborating with Partner Organizations).

8. Keep intelligent-client capability in-house. Retain enough architecture, clinical-safety, data, and commercial expertise to specify well, evaluate credibly, and challenge suppliers as equals. Outsourcing delivery is legitimate; outsourcing the ability to understand what you have bought is how organizations become captured by their vendors. You remain accountable to patients, regulators, and the public no matter who does the work (see Topic 6.4 — Governance & Assurance).

9. Make agile delivery work inside a compliant contract. Fixed-price, fixed-scope contracts fight iterative discovery, but you can reconcile them: contract for outcomes and capacity, use phased break-points and off-ramps, price by sprint or capped time-and-materials, and align payment to working software rather than documents. Build change mechanisms into the contract so learning during delivery can be absorbed lawfully, honouring procurement rules while still delivering the way modern digital services demand.

10. Manage the relationship actively through the life of the contract, not just the transaction. Run a regular cadence of governance meetings that reviews performance against service levels and the outcomes that matter clinically and operationally, agrees a joint roadmap, and resolves issues before they escalate. Treat your strategic suppliers as partners with a shared stake in the service, not adversaries to be caught out; the relationship, not the paperwork, is what carries you through the inevitable problems. Keep decisions, actions, and performance data documented so reviews build on evidence rather than memory, and so accountability survives changes of personnel on either side.

11. Monitor supplier risk and concentration in-life, and keep exit readiness live. Watch the financial health of your critical suppliers — accounts, credit signals, ownership changes — so a failure or acquisition does not surprise you, and track how dependent you have become on any single provider across your portfolio. Keep the exit and transition plan a living document, rehearsed and re-costed rather than filed and forgotten, so leaving remains a real option. Agree clear escalation routes for when a supplier underperforms — from operational review to commercial and board level — and use them early, before a degrading service becomes a safety or continuity risk.

Questions to discuss with your team#

1. For this requirement, are we buying a commodity or a differentiator — and what is the honest whole-life cost of each option, including exit? This question forces the build-vs-buy-vs-configure decision into the open before momentum carries you toward the familiar supplier or the lowest headline price. In health and care the trap is subtle: a capability that feels unique to your trust is usually a commodity dozens of others have already bought, while genuinely differentiating work is rarer than teams like to believe. The debate should surface the real total cost of ownership — integration, data migration, the in-house skills you must retain, and above all the cost of leaving — rather than the licence fee that dominates most business cases. Weigh the pull toward building (control, fit, pride) against the discipline of buying a commodity and directing scarce engineering effort at what only you can do. Consider concrete comparators: what did a neighbouring organization pay over five years, and what did they pay to exit? A good answer names the differentiator explicitly, costs the whole life including a credible exit scenario, and records the reasoning so it can be challenged later; a weak one compares sticker prices and calls the cheapest option value for money.

2. How would we leave this supplier if we had to — and have we written that into the contract before we sign? Exit is where lock-in is either prevented or cemented, and it is almost always neglected because, at signing, everyone is optimistic and the relationship is new. The tension is that the moment you have maximum leverage to demand data portability, open standards, and a costed transition plan is exactly the moment no one wants to talk about divorce. In a clinical setting the consequences are severe: patient data trapped in a proprietary format, integrations only the incumbent understands, and a service you cannot improve because switching would cost more than tolerating the status quo. Debate whether the contract actually guarantees data export in open, usable formats, whether interfaces use published standards, and whether a transition plan and its costs are agreed now rather than negotiated from weakness later. Consider real scenarios: the supplier is acquired, doubles its price, or lets the service degrade — what are your options on each? A strong answer describes a credible exit route with named formats, standards, timescales, and costs already in the contract; a poor one assumes you will simply renew because leaving is unthinkable, which is the definition of lock-in.

3. Do we have the in-house capability to be an intelligent client for this — and if not, how do we build it rather than hand accountability to the supplier? This question tests whether you can specify, evaluate, and hold a supplier to account, or whether you depend on the very people you are meant to be managing. It matters acutely in digital health because accountability for clinical safety, data protection, and equity cannot be outsourced no matter who writes the code (see Topic 1.6 — Clinical Safety & Risk Management and Topic 1.7 — Information Governance, Data Protection & Cyber Security); a supplier's assurance is not a substitute for your own understanding. The tension is that intelligent-client capability costs scarce skills that boards are tempted to cut in favour of visible delivery, and suppliers may quietly prefer a client who cannot challenge them. Discuss where your real gaps are — architecture, commercial, clinical safety, data — and whether you are filling them with retained expertise or papering over them with consultancy that deepens the dependency. Consider what happens at contract review or dispute: can your people credibly interrogate the supplier's performance and technical claims? A good answer identifies specific capabilities to retain and a plan to build them; a weak one assumes the supplier will tell you what you need to know.

4. Can we actually measure the outcomes we intend to specify — and if not, are we honest that we are still buying inputs? Outcome-based specification is the right instinct for complex digital services, but it only delivers if you can define, capture, and judge the outcomes that matter, and many organizations write outcome language over an input mindset. The tension is that clinical and operational outcomes — reduced waits, safer prescribing, closed equity gaps — are slow, multi-causal, and hard to attribute to one system, so teams quietly retreat to counting deliverables and calling it outcomes. In digital health the risk cuts both ways: specify outcomes you cannot measure and you cannot hold the supplier to account; specify inputs for evolving work and you freeze a solution you will outgrow (see Topic 3.5 — Delivery Lifecycles). Debate which outcomes you can genuinely instrument, what proxy measures and service levels you will accept in the meantime, and who on your side has the analytical capability to judge them. Consider whether your acceptance criteria tie payment to demonstrated working software and real service levels rather than documents. An honest answer names the measures, admits where you are really buying inputs, and commits to building the measurement maturity the contract assumes; a weak one sprinkles the word "outcomes" through a specification no one can score.

5. Are our social value and SME commitments real levers we will enforce, or weighting we will forget after award? Social value and SME access are statutory and policy expectations, but they curdle into theatre when they are weighted on paper at evaluation and never checked again once the contract is running. The tension is genuine: a meaningful social-value weighting and SME-friendly design — proportionate requirements, right-sized lots, prompt payment, no needless turnover thresholds — can widen and strengthen your supply market, yet they add process and can favour bidders who write good social-value narratives over those who deliver them. In health and care the prize is concrete — local digital skills, reduced access inequalities, lower carbon — but only if someone measures delivery after award rather than filing the promises. Discuss what weighting is high enough to change bidder behaviour, which commitments you will write into the contract as enforceable obligations, and who owns checking them in-life. Consider whether your process quietly excludes the SMEs and start-ups you claim to want, through scale, turnover, or insurance requirements they cannot meet. A strong answer ties social value to measurable, contracted outcomes and names the owner who will hold suppliers to them; a weak one treats the weighting as a box ticked at evaluation and forgotten by go-live.

6. How exposed are we to the failure or dominance of a single supplier across our portfolio — and are we managing that concentration deliberately? Individual procurements are usually judged in isolation, but risk accumulates across the portfolio: buy enough from one dominant provider and its financial distress, acquisition, or price rise becomes an organizational and clinical-continuity risk, not just a commercial inconvenience. The tension is that consolidating on a single strategic supplier brings real benefits — integration, simpler management, volume discounts — while quietly deepening the dependency that makes you unable to leave or negotiate. In digital health a critical supplier's failure can threaten live clinical services, so concentration is a safety question as much as a commercial one (see Topic 9.0 — Collaborating with Partner Organizations). Debate how dependent you have become on any one provider, whether you monitor the financial health and ownership of your critical suppliers, and what your continuity plan is if one fails or is acquired. Consider whether your escalation routes — from operational review to commercial and board level — are agreed and used early rather than after a service has degraded. A good answer tracks concentration across the portfolio, watches supplier risk signals, and keeps exit and continuity plans live and rehearsed; a weak one manages each contract alone and discovers its dependency only when a supplier is already in trouble.

In practice: a health & care example#

An integrated care system (ICS) wants to commission a shared care record uniting acute, community, mental health, primary care, and social care views of a patient. An earlier attempt failed when a single supplier delivered a closed platform the ICS could neither extend nor afford to leave.

The commercial team starts differently. Open pre-market engagement — a published pipeline, a supplier day, a request for information — reveals that several suppliers, including two SMEs, can meet the need if the specification is written around outcomes and open standards rather than a fixed technical design. They decide to buy and configure rather than build, judging the record a commodity while reserving in-house effort for local integration and clinical-safety assurance.

The specification is outcome-based: it defines clinical outcomes, information-governance requirements, interoperability standards (interfaces must use recognized health data standards; see Topic 4.3 — Interoperability & Data Standards), and service levels, and leaves the how to bidders. Crucially, the contract requires data to remain exportable in open formats, mandates a costed exit and transition plan from day one, weights social value — local digital skills, reduced access inequalities — at a meaningful published percentage, and sizes lots so an SME can bid for the integration work. They procure through a compliant route whose call-off rules permit outcome-based, phased contracting, pricing delivery by capped sprints with break-points and tying payment to working software demonstrated to clinicians, not documents.

After award, the ICS does not disband the team. A named contract owner runs monthly performance reviews and a quarterly supplier relationship review, and the retained intelligent-client function — an architect, a clinical-safety officer, a commercial lead — challenges the supplier as an equal. Two years on, when the supplier proposes a price rise, the ICS credibly threatens to exercise its exit rights, because the data is portable and the standards are open. The rise is negotiated down. Commercial design, not luck, kept the ICS in control.

Sector lenses#

Startup#

A digital-health start-up is usually the supplier, not the buyer, so its commercial focus is winning public-sector work without the balance sheet, track record, or bid team that incumbents wield. The frameworks and SME-access policies exist partly for you, but you must invest early in the assurance that buyers demand — clinical safety, data protection, interoperability evidence — because a great product with weak assurance loses to a mediocre one that ticks the boxes. Get onto the relevant framework or dynamic market, respond to published pipelines, and treat social value and open standards as opportunities to differentiate rather than hurdles. When you do buy — hosting, tooling — keep your own contracts short and portable so you never become the thing you are trying to disrupt. Cash flow is fragile, so negotiate prompt payment and phased milestones you can actually finance.

Small business#

An established small provider or supplier — a GP practice, a community pharmacy, a care home or domiciliary-care provider, a single-site clinic, or a small health-tech firm past the start-up stage — buys digital under the same duties as a large trust but with a fraction of the capability. When you are the buyer, you rarely run your own competition: your practical leverage is choosing well from a supplier's off-the-shelf options and reading the contract for the traps that matter most to you — data portability, exit costs, and price rises you cannot absorb on a tight cash position. Insist that your patient data stays exportable in open formats and that leaving is costed, because lock-in hurts a small provider far more than a large one that can fund a migration. Lean on framework terms, shared procurement through your ICS or a buying group, and sector bodies for model contracts, rather than negotiating alone from weakness. When you are the supplier, size your bids to lots you can actually deliver and finance, and treat your own assurance — clinical safety, data protection, interoperability — as the price of being taken seriously by public buyers.

Enterprise#

A large trust, ICS, or health-tech firm runs high-value, long-duration contracts where the dominant risks are lock-in and weak post-award management. The enterprise temptation is to default to the incumbent and the familiar framework, and to treat signing as the finish line rather than the start. The discipline is to write portability, open standards, and exit into every contract, to weight social value and SME access genuinely, and to resource contract and supplier relationship management as a standing function rather than an afterthought. Enterprises carry the scale to be a demanding, intelligent client — and the scale to be captured if they let their in-house capability wither. Board-level accountability to regulators and auditors makes a failed procurement a governance incident, not merely a delivery setback (see Topic 6.4 — Governance & Assurance).

Government#

At national and system level, procurement is an instrument of policy as much as a purchase. Central bodies — the Crown Commercial Service and NHS commercial functions — shape whole markets through the frameworks, standards, and terms they set, and can use that leverage to mandate interoperability, open standards, social value, and SME access across hundreds of buyers at once. Government procurement operates under the full glare of transparency duties, National Audit Office scrutiny, and parliamentary accountability, so integrity and value for money are not optional. The defining tension is between central standardization, which delivers scale and consistency, and local flexibility, which delivers fit; push mandates too hard and adoption stalls, too softly and the market fragments. The centre's most powerful role is to make the compliant path also the good path — well-designed routes to market that make interoperable, portable, SME-friendly buying the easiest option, not the hardest.

Common failure modes#

• Lowest-price wins, whole-life cost ignored. Award on the headline price and the cheap bid becomes expensive through integration, change, and exit costs. Fix: evaluate on total cost of ownership and outcomes, and weight quality and social value meaningfully.
• No exit plan. The contract is signed with no data portability, open standards, or transition arrangements, and the organization is trapped. Fix: negotiate a costed exit before signature and mandate open formats and standards.
• Specifying inputs for complex work. A rigid, detailed specification freezes a solution you outgrow and blocks agile delivery. Fix: specify outcomes and service levels; use phased, capped contracting.
• Signing as the finish line. No one manages the contract after award, and the promised value never materializes. Fix: resource contract and supplier relationship management with a named, empowered owner.
• Hollowed-out client. In-house capability is cut, and the organization cannot specify, evaluate, or challenge its suppliers. Fix: retain and invest in intelligent-client capability; never outsource accountability.
• Framework by habit. The familiar route is used without checking it fits, excluding better suppliers or blocking agile terms. Fix: choose the route to market on fit for the specific need.
• Social value and SME access as theatre. Weighted on paper, never measured or enforced after award. Fix: tie social value to measurable outcomes and check delivery through contract management.

Maturity model#

Checklist#

• The build vs buy vs configure decision is made deliberately, on whole-life total cost of ownership, and recorded.
• Open, even-handed, documented pre-market engagement has informed the specification.
• The specification is outcome-based where the work is complex, with measurable service levels.
• Data portability, open standards, and a costed exit and transition plan are written into the contract before signature.
• The route to market is chosen on fit and compliance, and permits the agile, phased contracting you need.
• Social value is weighted meaningfully and tied to outcomes you will measure after award.
• SME and start-up access is designed in: proportionate requirements, appropriate lot sizes, prompt payment.
• Payment milestones are tied to working software and outcomes, not documents, with phased break-points.
• A named, empowered contract owner runs performance and supplier relationship reviews from day one.
• Intelligent-client capability (architecture, clinical safety, data, commercial) is retained and funded.
• Accountability for safety, data protection, and equity stays with the buyer regardless of who delivers.
• The procurement honours the public-procurement principles: transparency, equal treatment, value for money, integrity.

Key sources#

• Procurement Act 2023 and Transforming Public Procurement guidance — Cabinet Office / GOV.UK. https://www.gov.uk/government/collections/transforming-public-procurement
• Provider Selection Regime — NHS England (procurement of health care services). https://www.england.nhs.uk/publication/the-provider-selection-regime-statutory-guidance/
• Crown Commercial Service — frameworks and routes to market (including G-Cloud and the Digital Marketplace). https://www.crowncommercial.gov.uk/
• Public Services (Social Value) Act 2012 — UK legislation. https://www.legislation.gov.uk/ukpga/2012/3/enacted
• GOV.UK Service Manual — buying and contracting for digital and technology services. https://www.gov.uk/service-manual
• Technology Code of Practice — Central Digital and Data Office / GOV.UK (open standards, avoiding lock-in). https://www.gov.uk/guidance/the-technology-code-of-practice
• Open Standards Principles — GOV.UK (open standards in government IT). https://www.gov.uk/government/publications/open-standards-principles
• National Audit Office — reports and good-practice guidance on commercial and contract management. https://www.nao.org.uk/
• See also Topic 4.3 — Interoperability & Data Standards, Topic 5.4 — Enterprise Resource Planning (ERP), Topic 6.0 — Financial Management & Business Cases, and Topic 9.0 — Collaborating with Partner Organisations.

References#

1. Government procurement in the United Kingdom — Wikipedia — https://en.wikipedia.org/wiki/Government_procurement_in_the_United_Kingdom
2. Procurement Act 2023 — Wikipedia — https://en.wikipedia.org/wiki/Procurement_Act_2023
3. Framework agreement — Wikipedia — https://en.wikipedia.org/wiki/Framework_agreement
4. Performance-based contracting — Wikipedia — https://en.wikipedia.org/wiki/Performance-based_contracting
5. Vendor lock-in — Wikipedia — https://en.wikipedia.org/wiki/Vendor_lock-in
6. Open standard — Wikipedia — https://en.wikipedia.org/wiki/Open_standard
7. Data portability — Wikipedia — https://en.wikipedia.org/wiki/Data_portability
8. Public Services (Social Value) Act 2012 — Wikipedia — https://en.wikipedia.org/wiki/Public_Services_(Social_Value)_Act_2012
9. Small and medium-sized enterprises — Wikipedia — https://en.wikipedia.org/wiki/Small_and_medium-sized_enterprises
10. Total cost of ownership — Wikipedia — https://en.wikipedia.org/wiki/Total_cost_of_ownership
11. Supplier relationship management — Wikipedia — https://en.wikipedia.org/wiki/Supplier_relationship_management
12. Contract management — Wikipedia — https://en.wikipedia.org/wiki/Contract_management
13. Transforming Public Procurement — Cabinet Office / GOV.UK — https://www.gov.uk/government/collections/transforming-public-procurement
14. The Provider Selection Regime: statutory guidance — NHS England — https://www.england.nhs.uk/publication/the-provider-selection-regime-statutory-guidance/
15. Crown Commercial Service — GOV.UK — https://www.crowncommercial.gov.uk/
16. Public Services (Social Value) Act 2012 — UK Legislation — https://www.legislation.gov.uk/ukpga/2012/3/enacted
17. The Technology Code of Practice — Central Digital and Data Office / GOV.UK — https://www.gov.uk/guidance/the-technology-code-of-practice
18. Open Standards Principles — GOV.UK — https://www.gov.uk/government/publications/open-standards-principles
19. GOV.UK Service Manual — Government Digital Service — https://www.gov.uk/service-manual
20. National Audit Office — commercial and contract management good practice — https://www.nao.org.uk/