Engineering capacity behind UK and EU public sector primes.
FISTA Solutions delivers as a subcontractor to UK and European public sector primes: G-Cloud and Crown Commercial Service framework holders, NHS and local-authority suppliers, and the integrators winning TED-published tenders in Germany, France, the Netherlands, and the Nordics. FISTA supplies English-language engineering capacity from a time zone that overlaps the European working day, with UK and EU data staying in-region.
- 150+
- projects delivered
- 50+
- companies served
- 99.9%
- verified uptime
- 47%
- efficiency gains
- 12+
- countries reached
United Kingdom
Which UK frameworks and portals matter, and where does FISTA fit?
UK public sector IT buying runs through frameworks and the Digital Marketplace, and since February 2025 through the Procurement Act 2023 regime with its central digital platform. Framework holders can be called off directly by thousands of buyers, which is why they need delivery partners. FISTA subcontracts to the holder; the holder contracts with the buyer.
| Framework or portal | What it is | FISTA's role |
|---|---|---|
| G-Cloud on the Digital Marketplace | The cloud services framework any public sector buyer can call off without a further competition | Delivery subcontractor to listed suppliers on call-offs |
| Crown Commercial Service frameworks | Central government agreements for technology, digital, and consultancy services | Sub to framework suppliers on orders |
| Contracts Finder and Find a Tender | Below- and above-threshold notices for UK public contracts, including under the Procurement Act 2023 | Intelligence on which primes are winning; sub to those primes |
| NHS procurement | Trust and integrated-care-system IT buying, plus national frameworks | Sub to NHS suppliers on clinical-adjacent and administrative systems |
| Public Contracts Scotland and Sell2Wales | Devolved-nation procurement portals | Sub to suppliers winning devolved public sector work |
| Local authority procurement platforms | Council and combined-authority sourcing systems | Sub to council suppliers on digital services and modernization |
European Union
How does the EU market work for a subcontractor?
Above the EU thresholds, notices are published on Tenders Electronic Daily; below them, each country runs its own portal, usually in the national language. The language barrier and the preference for established local suppliers make direct bidding impractical for a foreign firm, and make the national integrators that win these tenders the right partners. The Netherlands and the Nordics are the most open to English-language delivery.
| Country | Portal | Practical note for a subcontractor |
|---|---|---|
| EU-wide | TED (Tenders Electronic Daily) | Above-threshold notices; identifies the integrators winning public IT work |
| Netherlands | TenderNed | High English proficiency and an established offshore-delivery culture; best EU entry after the UK |
| Germany | DTVP and Vergabe portals | German-language procurement; sub to German integrators on EU-funded digital programs |
| France | BOAMP and PLACE | French-language procurement; sub to French integrators and consultancies |
| Sweden, Denmark, Norway, Finland | TendSign, Udbud.dk, Doffin, Hilma | English widely accepted in delivery; strong public digital agendas |
Work packages
What work packages does FISTA take in the UK and EU?
Cloud-native services on UK and EU regions, citizen-facing services built to the GOV.UK Service Standard patterns, data platforms, AI agents over public sector knowledge, modernization of legacy line-of-business systems, and accessibility to WCAG 2.2 AA and EN 301 549. Each is delivered against de-identified data with the prime holding the buyer relationship.
- 01
Cloud-native digital services
Services on UK or EU cloud regions with infrastructure as code, hardened pipelines, and observability, designed to the GOV.UK Service Standard and equivalent national patterns.
Cloud - 02
Data platforms and reporting
Pipelines, warehouses, and reporting for councils, trusts, and agencies, with lineage and reconciliation evidence for audit.
Data - 03
AI agents and document intelligence
Claude-based assistants and document-processing pipelines over public sector knowledge, with permissions, evaluation, and human review.
AI - 04
Legacy modernization
API layers and incremental migration for line-of-business systems, sequenced around live service delivery.
Modernization - 05
Accessibility to WCAG 2.2 AA and EN 301 549
Conformance built in for the Public Sector Bodies Accessibility Regulations and the EU Web Accessibility Directive, with test evidence and statements.
Accessibility - 06
Test automation and release engineering
Automated functional, accessibility, and performance testing, and release pipelines the prime's team owns after transfer.
Quality
Flow-downs
What flows down, and how does FISTA handle it?
UK and EU public contracts flow down data protection, security baselines, accessibility, and disclosure of offshore processing. FISTA keeps hosting in-region, uses de-identified development data, covers any necessary access with the right transfer instruments, maps its controls to Cyber Essentials, and leaves security-cleared work with the prime.
| Obligation | What it requires | How FISTA handles it |
|---|---|---|
| UK GDPR and EU GDPR | Lawful processing, data processing agreements, and safeguards for any international transfer | In-region hosting; DPA with the prime; SCCs or the UK IDTA plus transfer impact assessment where access is needed; de-identified data by default |
| Cyber Essentials | The UK's baseline technical controls, often required for government contracts | Engineering controls mapped to the five control areas; certification status stated in the pack |
| NIS2 | Security and incident obligations for essential and important entities across the EU | Secure SDLC, logging, and incident support aligned to the prime's NIS2 obligations |
| WCAG 2.2 AA and EN 301 549 | Public Sector Bodies Accessibility Regulations in the UK; Web Accessibility Directive in the EU | Built in, tested with assistive technology, accessibility statement inputs supplied |
| G-Cloud offshoring disclosure | Suppliers must state where data is stored and processed and where support is delivered | Disclosed accurately in the prime's service definition; FISTA's role and location stated |
| Security-cleared work | Baseline, SC, or DV clearance for some central government roles | Stays with the prime; excluded from FISTA's workshare |
General guidance for teaming planning, not legal advice.
Working day
How does the time zone work?
Faisalabad is UTC+5. A FISTA engineer's morning is a UK team's early morning and a Central European team's mid-morning, which gives four to five hours of shared working time with the UK and five to six with the continent. Stand-ups, reviews, and pairing happen inside that window; asynchronous work fills the rest of the day and lands before Europe starts again.
The overlap is designed into every task order. The specification names the daily window, the ceremonies that happen inside it, and the handover format for work that continues after European hours, so a prime's delivery lead never waits a full day for an answer.
For programs that need it, FISTA shifts working hours toward the European afternoon for the engineers on the package. That is agreed per task order and recorded in the teaming agreement rather than promised generically.
Teaming call → call-off
How does a UK or EU teaming engagement start?
With a call on the framework or tender, the buyer, and the work packages. FISTA sends the due-diligence pack under NDA, the teaming agreement fixes workshare, data handling, and the offshoring disclosure, and the first call-off or task order runs specification to acceptance with evidence the prime can show the buyer.
- 1
Teaming call
Twenty minutes on your pursuits, the work packages you need covered, the flow-downs in play, and whether FISTA's capacity and time zone fit. No deck; a conversation between delivery people.
OutputFit decision and a named pursuit or task-order scope
- 2
Due-diligence pack under NDA
Capabilities statement, rate card by role, key personnel, security practices summary, registration and certification status, references, and FISTA's NDA and teaming templates, or yours.
OutputEverything your contracts and compliance reviewers ask for
- 3
Teaming agreement or subcontract
Scope, workshare, exclusivity per pursuit, rates, flow-down clauses, data handling, IP, key personnel, and exit terms fixed in writing before any task order starts.
OutputSigned agreement with the flow-down set reviewed line by line
- 4
Task-order delivery
Each work package runs specification to verified production: a written spec, a working system, an evidence package, and documentation you can hand to the contracting officer.
OutputAccepted deliverables and a past-performance letter
Regulatory and procurement references on this page are general guidance for planning a teaming engagement, not legal advice. Confirm obligations with your contracts and legal teams for each solicitation.
Clear answers
What primes ask before teaming.
Straightforward guidance for evaluating scope, fit, and the next step.
01Do you need a UK entity to work on G-Cloud?
The framework holder contracts with the buyer and is responsible for the service definition; FISTA subcontracts to the holder. FISTA's contracting entity is FISTA Solutions Inc. in Delaware, and any UK or EU entity status is stated in the due-diligence pack rather than implied here. The holder's service definition discloses FISTA's role and delivery location accurately.
02Can data stay in the UK or EU?
Yes. Hosting stays in the UK or EU region the contract requires, in accounts the prime or buyer owns. Development and test run on de-identified or synthetic data. Where FISTA engineers need access to personal data, the transfer is covered by a data processing agreement and standard contractual clauses or the UK international data transfer agreement, with a transfer impact assessment.
03Does FISTA hold Cyber Essentials?
Certification status is stated in the due-diligence pack exactly as it is on the day it is sent. What the website describes is the engineering: FISTA maps its controls to the five Cyber Essentials control areas, and where a contract makes certification a hard requirement for FISTA's workshare, that is written into the agreement with a date or carved out.
04Do you work in German, French, or Dutch?
Delivery, code, and documentation are in English. The national-language customer interface, user research, and service content stay with the prime, and FISTA supports translated deliverables with native review by the partner. User interfaces are built with localization from the start so national-language content is a configuration, not a rewrite.
05How does the Procurement Act 2023 affect subcontractors?
The Act, in force since February 2025, brought a central digital platform, new notice types, and greater transparency on supply chains, including subcontractor information in some notices. In practice the prime discloses FISTA's role where required and FISTA supplies the details. This is general guidance; the prime's procurement team confirms obligations per notice.
06How quickly can a call-off or task order start?
After the teaming agreement is signed and the work package is specified. Timing depends on scope, environment access, and the seniority required, and FISTA states it per task order. The first evidence gate is set in the specification so the prime sees progress within the first week of the call-off.
Six markets
Every market FISTA subcontracts in
- 01SLED and federal civilianUnited StatesOpen the market brief
- 02G-Cloud, CCS, NHS, TEDUK and EuropeOpen the market brief
- 03Digital Agency-era programsJapanOpen the market brief
- 04UAE, KSA, Qatar, Kuwait, Bahrain, OmanMENAOpen the market brief
- 05Federal supply arrangements, provincesCanadaOpen the market brief
- 06BuyICT, DTA, statesAustraliaOpen the market brief
Continue exploring
Related capabilities
Sub-first, on the record
Name the framework or the tender. We will propose the workshare.
Tell us which framework you hold or which tender you are pursuing, the buyer, and the work packages. FISTA sends the pack and a workshare that keeps data in-region and the buyer with you.