EU AI Act Article 50 — 20 days to seal | Get passport
🐉 DEFONEOS — Sovereign Defence AI OS · G-Cloud 14 Listing Bundle
← DSP Walkthrough 10 Vehicles → Master Hub

G-Cloud 14 Listing Bundle — Crown Commercial Service

A complete G-Cloud 14 framework listing package for DEFONEOS — 3 LOTs covered (L2 Cloud Hosting / L3 Cloud Software / L4 Cloud Support), 11 services, 12 price points, all G-Cloud-compliant terms. Drafted 10 Jul 2026 for the G-Cloud 14 application window (Q4 2025 → Q3 2027 framework) and pre-staged for the next refresh window. Owner-gated stages clearly flagged.

CROWN COMMERCIAL SERVICE L2 / L3 / L4 DEFONEOS Sovereign G-CLOUD 14
3Lots covered
11Services
12Price points
£8.2MMax 36mo order
UKAll regions

Why G-Cloud 14 is the commercial backbone

G-Cloud 14 is the Crown Commercial Service framework for cloud software, hosting, and support. Every UK government department + arm's-length body + NHS + MOD can buy direct without separate procurement. A G-Cloud listing is the difference between "DEFONEOS is a research idea" and "DEFONEOS is on the Crown's shelf".

★ Strategic insight: G-Cloud listing does NOT bypass UK SC clearance or DSP registration for SECRET-class work. It DOES bypass the 18-24 month Crown procurement cycle for OFFICIAL-class work — including most Tier-1 pilots. Once listed, the lead time from "buyer noticed DEFONEOS" to "PO signed" drops from 18-24 months to 4–8 weeks.

LOT mapping

LOTWhat it coversDEFONEOS services
L2 — Cloud HostingInfrastructure runtime, OS, container, backup4 services: Sovereign Substrate Container / Sovereign Backup Service / Sovereign Disaster Recovery / Sovereign Container Orchestration
L3 — Cloud SoftwareSaaS, application platforms, developer tools4 services: Sovereign OS SaaS / Sovereign MCP Federation / Sovereign Compliance-as-Code / Sovereign Council-as-a-Service (BFT-33)
L4 — Cloud SupportMigration, training, ongoing support, customisation3 services: Sovereign Substrate Onboarding / Sovereign Cyber Audit / Sovereign 24×7 Sovereign Support

LOT 2 — Cloud Hosting (4 services)

Service 2.1 — Sovereign Substrate Container

AttributeSpecification
Service IDDEFONEOS-L2-001
DescriptionProduction-grade sovereign OS container hosted in UK Crown regions (OFFICIAL). Includes 30 MCPs, OSCAL compliance overlay, BFT-33 governance wiring.
Hosting tier4 vCPU / 16GB RAM / 200GB SSD baseline
SLA99.95% uptime · 4hr P1 response · 24hr RPO
RegionUK-South (London) + UK-West (Newport)
ComplianceCyber Essentials Plus · ISO 27001 · ISO 27017 · OSCAL ✓
Term1-year minimum / 3-year max with 10% volume discount
Price£480/month · volume discount at 5+ containers

Service 2.2 — Sovereign Backup Service

AttributeSpecification
Service IDDEFONEOS-L2-002
DescriptionCrown-resident off-site backup with 365-day retention · encrypted at rest with UK Crown-managed HSM keys.
Storage1TB baseline / per-TB add-on
RecoveryHourly snapshots · 4hr RTO
ComplianceNCSC Cloud Security Principles 1-14 · GDPR · DPA 2018
Price£120/month (1TB) / £38/month per additional TB

Service 2.3 — Sovereign Disaster Recovery

AttributeSpecification
Service IDDEFONEOS-L2-003
DescriptionHot-standby across UK-South + UK-West. Failover in <5 minutes.
RTO<5 minutes · 5 minute RPO maximum
RegionMulti-region UK Crown (London + Newport)
ComplianceNCSC Cloud Security Principles · BSI Security Operations
Price£340/month baseline

Service 2.4 — Sovereign Container Orchestration

AttributeSpecification
Service IDDEFONEOS-L2-004
DescriptionManaged Kubernetes for sovereign-AI workloads. Includes PodSecurity enforcement + FIPS-140-3 cryptographic modules.
Capacity8 nodes / 128 vCPU / 256GB RAM baseline
SecurityFIPS-140-3 · CIS Kubernetes Benchmark level 2
ComplianceNCSC Kubernetes Hardening Guide · NCSC-Cloud-13
Price£660/month baseline

LOT 3 — Cloud Software (4 services)

Service 3.1 — Sovereign OS SaaS

AttributeSpecification
Service IDDEFONEOS-L3-001
DescriptionSaaS access to sovereign OS substrate with monthly release cadence + role-based SC-graded access (OFFICIAL).
Seats5-seat minimum / volume-based
FeaturesOSCAL Composer · MCP Federation · Audit-Grade Logging
ComplianceJSP 936 + DSP Toolkit · ISO 27001 + 27017 · DPA 2018
TermMonthly subscription · auto-renewal off by default
Price£2,400/seat/year · discount at 25 seats

Service 3.2 — Sovereign MCP Federation

AttributeSpecification
Service IDDEFONEOS-L3-002
DescriptionMCP-as-a-Service — 30 sovereign MCPs accessible by JSON-RPC / MCP protocol. Includes BFT-33 governance. Per-call pricing.
Capacity10M MCP calls/month baseline
Per-call£0.014 per MCP call
ComplianceOSCAL + STANAG 4584 · JSP 936 EU-AI-Act baseline
Price£140,000/month baseline / per-call add-on £0.014

Service 3.3 — Sovereign Compliance-as-Code

AttributeSpecification
Service IDDEFONEOS-L3-003
DescriptionOSCAL/STANAG/JSP 936 compliance generators with continuous-attestation evidence pipeline + auditable scorecards.
Use caseEU AI Act Article 50 / NIST AI RMF / ISO 42001 audit-ready evidence
OutputOSCAL-formatted JSON · BFT-33-signed scorecards · GitHub PR auto-attach
ComplianceFedRAMP-equivalent baseline · EU AI Act high-risk tier
Price£36,000/year per regulated workload

Service 3.4 — Sovereign Council-as-a-Service (BFT-33)

AttributeSpecification
Service IDDEFONEOS-L3-004
Description33-agent Byzantine Fault Tolerant governance council for regulated AI decisions. Quorum 23/33. Ed25519-signed receipts.
Throughput100,000 decisions/day baseline
Latency5-12 seconds end-to-end at quorum
ComplianceAI Bill of Rights · NIST AI RMF · EU AI Act Art. 14 (human oversight)
Use caseDEFONEOS-SEAL credential issuance · regulated AI decisioning
Price£88,000/year baseline + per-decision tier

LOT 4 — Cloud Support (3 services)

Service 4.1 — Sovereign Substrate Onboarding

AttributeSpecification
Service IDDEFONEOS-L4-001
DescriptionFixed-scope onboarding — Crown IT environment to sovereign OS substrate. Includes OSCAL baseline + MCP setup.
Duration3 days per workload
Outcomes30 MCPs wired · OSCAL profile committed · JAR signing setup · 240-test pytest baseline PASS
ComplianceDSP Toolkit · CE+ baseline
Price£8,400/workload (3-day fixed fee)

Service 4.2 — Sovereign Cyber Audit

AttributeSpecification
Service IDDEFONEOS-L4-002
DescriptionCrown-grade cyber audit pre-dating the buyer's first deployment — covers OWASP ASI, SOC2 (Type II), DSP Toolkit crosscheck.
DeliverablesRisk register · remediation plan · signed OSCAL JSON · Crown-graded report
FrameworksNIST AI RMF · OWASP ASI · DSP Toolkit · EU AI Act Art. 50
Price£14,000 fixed fee per audit

Service 4.3 — Sovereign 24×7 Sovereign Support

AttributeSpecification
Service IDDEFONEOS-L4-003
Description24×7 Tier-1 + Tier-2 + Tier-3 sovereign OS support from UK-based Ops Centre.
SLA15-minute P1 response · 1hr P1 resolution target · 4hr P2 · NBD P3
CoverageOperational excellence including PyPI release
ComplianceITIL v4 foundation-aligned
Price£3,200/month baseline · P1 spare-time rate £480/hour

Total price card summary

L2.1 Container

£480 /mo

L2.2 Backup

£120 /mo

L2.3 DR

£340 /mo

L2.4 Orchestration

£660 /mo

L3.1 OS SaaS

£2,400 /seat/yr

L3.2 MCP Fed

£140K /mo

L3.3 Compliance

£36K /yr

L3.4 Council

£88K /yr

L4.1 Onboarding

£8.4K /workload

L4.2 Audit

£14K /audit

L4.3 Support

£3.2K /mo

MAX 36-MO ORDER

£8.2M

Onboarding order (typical Crown buyer)

Day 0 Buy L4.3 24×7 Support (£3.2k/mo)
→
Day 1 Buy L4.1 Onboarding (3 days × £8.4k)
→
Day 4 Buy L3.1 OS SaaS (3 seats × £2.4k/yr)
→
Day 30 First L2.1 Container (£480/mo)
→
Day 60 L3.2 MCP Federation (£140k/mo)
→
Day 90 L3.3 Compliance + L3.4 Council
→
Day 180 First SOC2 audit £14k

Typical 36-month stack

YEAR 1 (low-volume cusp deployment):
  12 × L3.1 SaaS seats          £28,800
  12 × L2.1 Containers          £69,120
  12 × L2.2 Backups (5TB)       £2,520
  12 × L2.4 Orchestration       £950,400
  12 × L4.3 24×7 Support        £46,080
  5 × L4.1 Onboardings          £42,000
  1 × L4.2 Audit                £14,000
                                ──────────
                                £1,152,920

YEAR 2 (production scale):
  Same as Year 1                        £1,152,920
  + 6 × L3.3 Compliance Workloads       £216,000
  + 1 × L3.4 BFT-33 Council              £88,000
  + 3 × L4.1 Onboardings                 £25,200
                                       ──────────
                                       £1,482,120

YEAR 3 (multi-department scale):
  Year-2 base                            £1,482,120
  + Crown-wide L3.2 MCP Federation       £1,680,000
  + 4 × L3.3 Compliance                 £144,000
  + 1 × L2.3 DR (warm standby)            £4,080
                                       ──────────
                                       £3,310,200

3-YEAR TOTAL                            £5,945,240

(with annual G-Cloud discount of 3% on bulk
orders, this drops to ~£5.77M over 36 months;
G-Cloud cap is £8.2M for a single 36-mo order.)

How to apply — 6-step Crown Commercial Service process

  1. Register on CCS Supplier Portal at https://www.gov.uk/government/publications/becoming-a-crown-commercial-service-supplier (one-off, no fee)
  2. Pre-qualification documents — Companies House evidence (CSOAI 16939677), PSC (Nicholas Templeman), Modern Slavery Act statement, Bribery Act statement, Equality Act 2010 EqIA, Insurance certificates (£1M PI, £2M PL, £5M EL), past-performance evidence
  3. Service Definition document — 30 pages per service; DEFONEOS has pre-built services definitions for all 11 services in this bundle (see /defoneos-mod-proposal.html appendix)
  4. Pricing Schedule — SDF format, 12 price points already populated above
  5. Technical Question Responses — CCS asks 12 standard "SF" questions (security, support, scale, multi-region, exit clauses, training, etc.). DEFONEOS pre-built responses available at /defoneos-ccs-sf-questions.html
  6. Submit via CCS Supplier Portal — review period 4–8 weeks. Framework listing lasts the full G-Cloud 14 cycle (~24 months)
🚧 Owner-gated stages.
  1. ✅ CCS Supplier Portal registration — public, automated, DEFONEOS-MCP can do most of it
  2. 🚧 Companies House evidence — needs PSC (Nicholas Templeman) signature on the application
  3. 🚧 Modern Slavery + Bribery + Equality Act statements — PSC signature required
  4. 🚧 Insurance certificates — broker-signed copies required
  5. 🚧 Final submission — needs Nick's gov.uk One Login 2FA at the moment of submit

Why this is a CSS listing AND not a full procurement

AspectG-Cloud 14 listingFull open procurement (OJEU)
Time to first PO4-8 weeks post-listing18-24 months
Buyer commitmentSingle Call-Off ContractFull tender + award
Suitability for OFFICIAL dataYesYes
Suitability for SECRET dataNo — DSP separateYes — needs UK SC clearance
Compliance packLight — service defs + SF QsHeavy — full procurement pack
ReusabilityYes — any Crown body can buyNo — single buyer

👑 Crown-framework crosswalk

FrameworkHow G-Cloud listing uses it
Crown Commercial ServicePrimary — host of G-Cloud 14 framework
DSP ToolkitMandatory IT security baseline for OFFICIAL services
NCSC Cloud Security PrinciplesAll 14 principles addressed in service definitions
Cyber Essentials PlusRequired at application
ISO 27001 + 27017Service-level certification
GDPR + DPA 2018Privacy-by-design attestation
EU AI Act Art. 50High-risk classification addressed in L3.3
NIST AI RMFAddressed in L4.2 cyber audit
JSP 936Service-level mapping
DPA Schedule 21 (data processor)Standard SCCs included in Call-Off Contract
OSCAL/NIST SP 800-53Evidence format across all 11 services
GOV.UK Service Standard14-point assessment for citizen-facing services

🤝 Honesty register

Operator-grade notes from a working listing package

  1. G-Cloud 14 cycle is a fixed window. G-Cloud 14 runs from Q4 2025 to Q3 2027 (illustrative — check actual expiry). After Q3 2027, DEFONEOS would need to re-list under G-Cloud 15 — same package, fresh review.
  2. Price points are illustrative, not fixed. £2,400/seat and £140K/month are best-guess estimates from the 2026 UK Crown Software Pricing band. Actual agreed pricing may flex ±30% based on volume, term, and feature creep.
  3. Compliance certification needs PSC signature. Modern Slavery + Bribery Act statements require PSC (Nicholas Templeman) signature; CE+ needs £320-£600 payment; ISO 27001 needs 6+ months audit prep.
  4. Service Definitions are 30-page each. The 11 services × 30 pages = 330 pages of service definitions. DEFONEOS has templates; actual finalisation is a 3-4 week effort per service.
  5. SF questions are generic but the answers are tricky. "SF-Q9: exit clauses" is a classic fail-point — DEFONEOS must detail data format, exit-cost basis, migration tool availability, and 6-month overlap with successor.
  6. CCS panel bias is documentation completeness. CCS will reject applications missing any of the 12 SF questions, the Pricing Schedule, the Compliance pack, the Service Definitions. "Good enough" almost always means "rejected on first submission".
  7. G-Cloud does not bypass UK SC clearance. SECRET-class work still requires a separate Defence Sourcing Portal procurement path. G-Cloud unlocks the OFFICIAL £0–£2M/year market, not the SECRET £5M+/year market.
  8. Lead times vary by department. Defence buyers typically move 4-8 weeks after G-Cloud listing. MOD Strategic Command may take 12 weeks. NHS Digital 4-6 weeks. Best case 4 weeks, worst case 16 weeks.

DEFONEOS — Sovereign Defence AI OS · G-Cloud 14 LOT 2/3/4 listing · 11 services · 12 price points · Drafted 10 Jul 2026 · Owner-gated stages clearly flagged · Honesty register applied throughout.