Find a TenderAwarded without competitionContract details notice
Published 15 Jul 2026, 13:59 BST

Official UK procurement notice

715884522 - DOBUS Core Contract

Official notice

Authority: Ministry of Defence (Central government)

ServicesDirect awardAbove thresholdDefence & security
Sectors: IT Services & Software (72) Delivery: UK
Contract value (direct award)£4,900,000≈ £980k / year · £5,880,000 inc. VAT
Awarded 29 Jul 2026no call for competition
Awarded to boxxe Limited
Contract term 5 yrsends 31 Jul 2031 · starts 31 Jul 2026

What is being bought

Published requirement description

Provision of the Defence Out of Bounds Update Service (DOBUS), a managed cyber security patch acquisition, assurance, hosting and distribution service for Defence. The requirement includes the operation and maintenance of a secure and accredited platform for the acquisition, verification and distribution of software and firmware patches and updates across Defence networks. Services include secure hosting, repository management, service desk support, out-of-hours assistance, performance reporting, governance, security compliance, change management and continuous service improvement. The Supplier shall provide a highly available service supporting Defence systems operating at OFFICIAL and SECRET classifications, ensuring timely access to trusted patch content to support cyber resilience and vulnerability remediation across Defence.

CPV: Network management software services

The lotProcurement structure

single lot · no lot value published
Lot #1Awarded 5 yrs
Contract period: 31 Jul 2026 – 31 Jul 2031 (5 yrs)
Delivery: UK

Procedure terms & legal framework

From the official record
Procedure method
Direct award
Legal basis
UKPGA · 2023/54 Procurement Act 2023
Procurement category
Services
Notice status
Awarded without competition
Procurement threshold
Above threshold (FTS publication)
Regulatory regime
Defence & security
Commercial structure
Stand-alone contract (no framework)
Competition type
Direct award (no call for competition)
GPA / WTO covered
Unspecified in notice
Recurring procurement
Unspecified in notice
First published
15 Jul 2026, 13:59 BST
Last source update
10 Sept 2026, 13:00 BST
Authority reference
715884522 - DOBUS Core Contract
FTS notice number
2026/S 000-085869
Latest notice
Contract details notice (UK7)
Classification (CPV)
Network management software services
Delivery area
UK
Official registry OCID
ocds-h6vhtk-06cbff Find a Tender
Why no open competition
Defence Security Operational
Published justification
  1. Legal Basis

This contract will be awarded in accordance with Section 41 of the Procurement Act 2023 (Direct Award in Special Cases), relying on Schedule 5, Paragraph 20.

The Authority is satisfied that this is a defence authority contract and a defence and security contract within the meaning of Section 7 of the Procurement Act 2023. The requirement supports the maintenance and ongoing operation of Defence systems through the provision, assurance and distribution of security updates and patches and is considered to fall within Section 7(1)(c) as services necessary for the maintenance of military and/or sensitive equipment.

The Authority is satisfied that direct award is necessary to maintain and enhance the operational capability, effectiveness, readiness, safety and security of the Armed Forces during the contract period.

  1. Justification

The Authority considers that continuation of the service is necessary to maintain operational effectiveness and support the ongoing management of cyber security risks. A sustained reduction in the service would increase operational risk and reduce the efficiency and resilience of Defence digital and information systems.

The contract includes the continued sustainment and enhancement of the existing service to ensure it continues to meet Defence requirements. The Authority has therefore determined that a direct award is necessary and proportionate to maintain the operational effectiveness, resilience and security of this Defence capability while future requirements and procurement options are considered.

DOBUS is a Defence cyber security service that supports the provision of software and firmware security updates across Defence systems and contributes to the security and resilience of Defence digital services.

DOBUS supports the provision of software and firmware updates across Defence systems and contributes to the effective operation and resilience of Defence digital services.

The Authority considers that continuation of the service is necessary to maintain operational effectiveness and ensure continuity of service delivery. This capability supports the ongoing management and distribution of software updates across the Defence estate and remains a critical component of wider Defence digital services.

The current capability has been established within Defence infrastructure, processes and technical environments over an extended period. The Authority has identified significant interoperability, transition and delivery considerations associated with introducing alternative arrangements within the required timescales. Consequently, further work is required to assess future technical options, undertake market engagement and develop an informed approach to any future procurement activity.

The contract includes sustainment and enhancement activities essential to support the continued operation and development of the service while this work is undertaken. The Authority has therefore determined that a direct award is necessary and proportionate to maintain service continuity and operational effectiveness whilst future requirements and procurement options are developed and assessed.

In addition to the grounds relied upon under Schedule 5, Paragraph 20 and Section 7(1)(c) of the Procurement Act 2023, the Authority also considers that technical reasons support the direct award. The services are necessary for the maintenance and ongoing operation of military and sensitive equipment and systems. The capability is closely integrated within Defence technical environments and processes, and any disruption, compromise or unplanned transition would present risks to operational capability, service continuity and security.

  1. Reasons for Duration

The contract term of 3 years (01 Aug 2026 to 31 July 2029), with break points at the end of Years 1 and 2, represents the period required to maintain continuity of this cyber security capability whilst undertaking service sustainment activities, reviewing longer-term requirements, and assessing future procurement options. The contract duration balances operational necessity with the Authority's intention to consider future competitive procurement arrangements and longer-term capability requirements.

  1. Future Procurement

During the contract term, the Authority intends to undertake additional market engagement, technical assessment and option analysis to inform the long-term Enterprise Patching strategy. Subject to the outcome of this activity and future approvals, the Authority may undertake a future competitive procurement for the enduring capability.

How it was run

Official notice
Submission deadline
—

Timeline

15 Jul 2026 → 10 Sept 2026 · 4 dates
  1. Planning notice published97 days ago
    15 Jul 2026, 13:59 BST
  2. Next notice expected92 days ago
    20 Jul 2026, 23:59 BST
  3. Contract starts82 days ago
    31 Jul 2026, 00:00 BST
  4. Latest notice published40 days ago
    10 Sept 2026, 13:00 BST

Notice history

7 events · 5 releases on Find a Tender · since 15 Jul 2026
  1. Pipeline notice published
    15 Jul 2026, 13:59 BST
    UK1
  2. Transparency notice published
    22 Jul 2026, 15:31 BST
    UK5
  3. Status changed to complete
    22 Jul 2026, 15:31 BST
  4. Transparency notice published
    28 Jul 2026, 12:44 BST
    UK5
  5. Contract award notice published
    29 Jul 2026, 12:25 BST
    UK6
  6. Contract signature expected
    11 Aug 2026, 23:59 BST
    scheduled
  7. Contract details notice published
    10 Sept 2026, 13:00 BST
    UK7
Routine re-releases (5)
  • 2026-07: 2 releases · 15 Jul 2026, 22 Jul 2026

Commercial outcome & contract awards

Published awards, contracts and bid statistics, not a forecast
Awards 1
Awarded value £3,942,1011 award exc. VAT
Contracts signed 1latest 11 Aug 2026
Awarded toValueDateStatus
boxxe Limited12 Aug 2026 – 31 Jul 2029Amended: The notice has been updated to provide additional clarification regarding the legal basis for the proposed direct award and the supporting justification.£3,942,10129 Jul 2026Awarded

Contracts

  • 715884522 - DOBUS Core Contract · boxxe Limited

    Signed
    11 Aug 2026
    Value
    £3,942,101
    Period
    12 Aug 2026 – 31 Jul 2029
    Status
    active
    3 agreed KPIs: Delivery Performance · Delivery Performance · Service Performance
    • Delivery Performance, Response from a supplier knowledgeable support consultant who will commence work on diagnosing and solving the patching case.
    • Delivery Performance, Resolution of patching cases within agreed timeframes based on priority levels.
    • Service Performance, Percentage uptime of the DOBUS platform ensuring continuous access to patching services.

Contracting authority & participating public bodies

Ministry of Defence

Contracting authorityPublic authority - central government GB-PPON: PHVX-4316-ZVGZ MoD Corsham, Corsham, South West, SN139NRContact name, email, phone

Bidders & participating suppliers

1 commercial party on the notice
  • Boxxe LimitedAwarded supplierGB-COH: 02109168 Floor 3, Artemis House, Eboracum Way, York, Yorkshire & Humber, YO317REContact email, phone

Official documents & specifications (5)

Official links; attachments are not copied

Notices published for this procedure

  • Contract details notice contractContract details noticeUK7Contract details notice on Find a Tender
  • Contract award notice awardContract award noticeUK6Contract award notice on Find a Tender
  • Transparency notice awardTransparency noticeUK5Transparency notice on Find a Tender
  • Transparency notice awardTransparency noticeUK5Transparency notice on Find a Tender
  • Pipeline notice planningPipeline noticeUK1Pipeline notice on Find a Tender