How We Certified a G-Cloud Supplier 36 Hours Before Deadline
Published 29 July 2026
The situation
A 22-person cloud consultancy had submitted a G-Cloud application confident their existing certificate was still valid. It had expired three weeks earlier. Contract award was 36 hours away. If they missed the certificate check, the award would be withdrawn.
Hour zero to six: scope and evidence pull
The first call was 30 minutes. We locked down the scope – whole organisation, Microsoft 365 tenant, 22 laptops, no on-prem servers, one office router. Their MSP pulled a patch status report from Intune inside two hours. That was the single biggest accelerator; without an existing endpoint management tool the same evidence takes days.
Hour six to eighteen: MFA gap
MFA was enforced on admin accounts but not on all cloud user accounts – a common gap after the 2026 Danzell tightening. Rolling MFA to 22 users through Conditional Access with a staged rollout took most of the second afternoon. Their IT lead sat with each staff member to enrol authenticator apps. No shortcuts.
Hour eighteen to thirty: pre-check and submission
We ran the pre-check against the IASME question set, flagged three answers that needed evidence tightening, and let them re-answer overnight. The submission went in at 9am on the deadline day. The certificate issued at 2pm, seven hours before contract award. They won the work.
What went right
- They had endpoint management already (Intune) – the single biggest evidence accelerator.
- The IT lead had authority to change MFA policy on the spot.
- Scope was clean – no shadow-IT arguments to resolve.
- They took the pre-check seriously and re-answered honestly.
What nearly derailed it
- An unsupported Windows Server 2012 sitting in a corner that nobody had documented. Removing it from scope took two hours of legitimate work.
- A subcontractor who processed customer data on the supplier's behalf without their own certificate. Solved by isolating them out of scope, but only just.
What we tell every supplier now
Start the moment you commit to bidding, not the moment the award clock starts. Book a fast-track slot the day you decide. Full framework detail is in the G-Cloud 15 hub and the deadlines guide.
– Harpal Bilan, IASME-licensed Cyber Essentials Assessor