Official UK procurement notice
715884522 - DOBUS Core Contract
Authority: Ministry of Defence (Central government)
What is being bought
Published requirement descriptionProvision of the Defence Out of Bounds Update Service (DOBUS), a managed cyber security patch acquisition, assurance, hosting and distribution service for Defence. The requirement includes the operation and maintenance of a secure and accredited platform for the acquisition, verification and distribution of software and firmware patches and updates across Defence networks. Services include secure hosting, repository management, service desk support, out-of-hours assistance, performance reporting, governance, security compliance, change management and continuous service improvement. The Supplier shall provide a highly available service supporting Defence systems operating at OFFICIAL and SECRET classifications, ensuring timely access to trusted patch content to support cyber resilience and vulnerability remediation across Defence.
CPV: Network management software services
The lotProcurement structure
single lot · no lot value publishedLot #1Awarded
Procedure terms & legal framework
From the official record- Procedure method
- Direct award
- Legal basis
- UKPGA · 2023/54 Procurement Act 2023
- Procurement category
- Services
- Notice status
- Awarded without competition
- Procurement threshold
- Above threshold (FTS publication)
- Regulatory regime
- Defence & security
- Commercial structure
- Stand-alone contract (no framework)
- Competition type
- Direct award (no call for competition)
- GPA / WTO covered
- Unspecified in notice
- Recurring procurement
- Unspecified in notice
- First published
- 15 Jul 2026, 13:59 BST
- Last source update
- 10 Sept 2026, 13:00 BST
- Authority reference
715884522 - DOBUS Core Contract- FTS notice number
2026/S 000-085869- Latest notice
- Contract details notice (UK7)
- Classification (CPV)
- Delivery area
- Official registry OCID
ocds-h6vhtk-06cbffFind a Tender
- Why no open competition
- Defence Security Operational
- Published justification
- Legal Basis
This contract will be awarded in accordance with Section 41 of the Procurement Act 2023 (Direct Award in Special Cases), relying on Schedule 5, Paragraph 20.
The Authority is satisfied that this is a defence authority contract and a defence and security contract within the meaning of Section 7 of the Procurement Act 2023. The requirement supports the maintenance and ongoing operation of Defence systems through the provision, assurance and distribution of security updates and patches and is considered to fall within Section 7(1)(c) as services necessary for the maintenance of military and/or sensitive equipment.
The Authority is satisfied that direct award is necessary to maintain and enhance the operational capability, effectiveness, readiness, safety and security of the Armed Forces during the contract period.
- Justification
The Authority considers that continuation of the service is necessary to maintain operational effectiveness and support the ongoing management of cyber security risks. A sustained reduction in the service would increase operational risk and reduce the efficiency and resilience of Defence digital and information systems.
The contract includes the continued sustainment and enhancement of the existing service to ensure it continues to meet Defence requirements. The Authority has therefore determined that a direct award is necessary and proportionate to maintain the operational effectiveness, resilience and security of this Defence capability while future requirements and procurement options are considered.
DOBUS is a Defence cyber security service that supports the provision of software and firmware security updates across Defence systems and contributes to the security and resilience of Defence digital services.
DOBUS supports the provision of software and firmware updates across Defence systems and contributes to the effective operation and resilience of Defence digital services.
The Authority considers that continuation of the service is necessary to maintain operational effectiveness and ensure continuity of service delivery. This capability supports the ongoing management and distribution of software updates across the Defence estate and remains a critical component of wider Defence digital services.
The current capability has been established within Defence infrastructure, processes and technical environments over an extended period. The Authority has identified significant interoperability, transition and delivery considerations associated with introducing alternative arrangements within the required timescales. Consequently, further work is required to assess future technical options, undertake market engagement and develop an informed approach to any future procurement activity.
The contract includes sustainment and enhancement activities essential to support the continued operation and development of the service while this work is undertaken. The Authority has therefore determined that a direct award is necessary and proportionate to maintain service continuity and operational effectiveness whilst future requirements and procurement options are developed and assessed.
In addition to the grounds relied upon under Schedule 5, Paragraph 20 and Section 7(1)(c) of the Procurement Act 2023, the Authority also considers that technical reasons support the direct award. The services are necessary for the maintenance and ongoing operation of military and sensitive equipment and systems. The capability is closely integrated within Defence technical environments and processes, and any disruption, compromise or unplanned transition would present risks to operational capability, service continuity and security.
- Reasons for Duration
The contract term of 3 years (01 Aug 2026 to 31 July 2029), with break points at the end of Years 1 and 2, represents the period required to maintain continuity of this cyber security capability whilst undertaking service sustainment activities, reviewing longer-term requirements, and assessing future procurement options. The contract duration balances operational necessity with the Authority's intention to consider future competitive procurement arrangements and longer-term capability requirements.
- Future Procurement
During the contract term, the Authority intends to undertake additional market engagement, technical assessment and option analysis to inform the long-term Enterprise Patching strategy. Subject to the outcome of this activity and future approvals, the Authority may undertake a future competitive procurement for the enduring capability.
How it was run
Official notice- Submission deadline
- —
Timeline
15 Jul 2026 → 10 Sept 2026 · 4 dates- Planning notice published97 days ago15 Jul 2026, 13:59 BST
- Next notice expected92 days ago20 Jul 2026, 23:59 BST
- Contract starts82 days ago31 Jul 2026, 00:00 BST
- Latest notice published40 days ago10 Sept 2026, 13:00 BST
Notice history
7 events · 5 releases on Find a Tender · since 15 Jul 2026- Pipeline notice published15 Jul 2026, 13:59 BSTUK1
- Transparency notice published22 Jul 2026, 15:31 BSTUK5
- Status changed to complete22 Jul 2026, 15:31 BST
- Transparency notice published28 Jul 2026, 12:44 BSTUK5
- Contract award notice published29 Jul 2026, 12:25 BSTUK6
- Contract signature expected11 Aug 2026, 23:59 BSTscheduled
- Contract details notice published10 Sept 2026, 13:00 BSTUK7
Routine re-releases (5)
- 2026-07: 2 releases · 15 Jul 2026, 22 Jul 2026
Commercial outcome & contract awards
Published awards, contracts and bid statistics, not a forecast| Awarded to | Value | Date | Status |
|---|---|---|---|
| boxxe Limited12 Aug 2026 – 31 Jul 2029Amended: The notice has been updated to provide additional clarification regarding the legal basis for the proposed direct award and the supporting justification. | £3,942,101 | 29 Jul 2026 | Awarded |
Contracts
715884522 - DOBUS Core Contract · boxxe Limited
- Signed
- 11 Aug 2026
- Value
- £3,942,101
- Period
- 12 Aug 2026 – 31 Jul 2029
- Status
- active
3 agreed KPIs: Delivery Performance · Delivery Performance · Service Performance
- Delivery Performance, Response from a supplier knowledgeable support consultant who will commence work on diagnosing and solving the patching case.
- Delivery Performance, Resolution of patching cases within agreed timeframes based on priority levels.
- Service Performance, Percentage uptime of the DOBUS platform ensuring continuous access to patching services.
Contracting authority & participating public bodies
Bidders & participating suppliers
1 commercial party on the notice- Boxxe LimitedAwarded supplier
Official documents & specifications (5)
Official links; attachments are not copiedNotices published for this procedure
- Contract details notice Contract details notice on Find a Tender
- Contract award notice Contract award notice on Find a Tender
- Transparency notice Transparency notice on Find a Tender
- Transparency notice Transparency notice on Find a Tender
- Pipeline notice Pipeline notice on Find a Tender