CPT_26_03 IT Service management (ITSM)

The National Audit Office (NAO) is the UK's independent public spending watchdog. It supports Parliament in holding government to account and helps improve public services through high-quality audit and assurance work.

The NAO sought to appoint an experienced supplier to provide an enterprise-grade IT Service Management (ITSM) solution and associated support services for internal users across the organisation.

The requirement included the provision, implementation, configuration, and ongoing support of an ITSM platform capable of supporting core ITSM processes, including incident management, service requests, change management, asset and configuration management, workflow automation, reporting, and governance. The solution was required to be scalable, configurable, and proportionate to the NAO's operational needs, and capable of supporting multiple internal functional areas.

The procurement sought a supplier capable of delivering a controlled transition from the incumbent system, including secure data migration, integration with the NAO's Microsoft-based digital estate, and service readiness activities, with minimal disruption to business operations. The solution was required to provide an intuitive user experience, configurable workflows, and accessible reporting, without reliance on complex development or ongoing external consultancy.

The requirement also included robust ongoing platform support, including routine updates, security maintenance and patching, and effective vulnerability management and remediation. This includes the ability to identify, assess, track, prioritise, and remediate security vulnerabilities affecting the ITSM platform and its components, supported by appropriate controls, governance, and reporting.

In addition, the procurement sought a supplier able to demonstrate a sustainable product roadmap and ongoing service support model to ensure long-term service continuity, platform resilience, and alignment with the NAO's future operational and digital requirements.

The successful supplier will also be required to provide assurance that vulnerabilities are managed in line with recognised industry good practice and the NAO's information security and risk management requirements.

The contract will commence on Monday 2 November 2026 and includes an initial six-month mobilisation and implementation period, with service go-live anticipated from Tuesday 1 June 2027.

The initial contract term of three (3) years will commence on the go-live date and will expire on Friday 31st May 2030.

The NAO reserves the option to extend the contract for up to two (2) additional periods of twelve (12) months each, up to a maximum end date of Monday 31st May 2032.

The contract has been awarded with a maximum value of £1.8 million inclusive of VAT over the full potential five-year term.