Guide
Selling SaaS to government: the terms public buyers ask for
What public sector buyers require from software as a service vendors, including security, data residency, service levels, exit plans and licensing terms, and how to prepare your SaaS for public sales.
Government buys more and more software as a service, from case management and booking systems to analytics and collaboration tools. But public buyers have rules that private buyers don't, and SaaS vendors who prepare for them sell much faster.
What public buyers ask for
Security
- A recognized certification or assessment, such as ISO 27001, SOC 2, FedRAMP in the US, IRAP in Australia, or Cyber Essentials in the UK.
- Answers to a security questionnaire.
- Single sign-on, multi-factor authentication and audit logs.
Data
- Hosting in an approved country or region. See data residency and sovereignty.
- Clear terms on who can access data, including your staff and subprocessors.
- Data export in open formats, and deletion at the end.
Service
- Uptime commitments, support hours and response times.
- A status page and incident notification.
- Accessibility to WCAG 2.1 AA, with an accessibility conformance report.
Contract
- Termination for convenience, and an exit plan to move data out.
- Price protection for multi-year terms.
- Changes to your terms that can't apply without the buyer's agreement.
- Acceptance that contracts and prices may be disclosed under freedom of information laws.
Your standard terms may not apply
Many public buyers won't sign vendor click-through terms, or only with an order of precedence that puts their terms first. Read the buyer's terms and know which of yours matter most, such as liability caps, acceptable use and IP in your platform.
Use the marketplaces
Much public SaaS buying goes through catalogues: G-Cloud in the UK, the BuyICT Cloud Marketplace in Australia, GSA Schedules and agency vehicles in the US, and cloud and software arrangements in Canada. Listing makes you easy to buy.
Build a public sector pack
Keep these ready to send:
- Security overview and certifications.
- Data processing agreement and list of subprocessors.
- Hosting locations.
- Accessibility conformance report.
- Service level agreement.
- Exit and data portability plan.
- Public sector pricing.
Common questions
Do government buyers accept standard SaaS terms?
Sometimes for low-value purchases, but often they require their own terms or an addendum that overrides parts of yours. Expect to negotiate or accept public sector terms.
Do I need FedRAMP to sell SaaS to US government?
For most federal agency cloud use, yes, or an agency authorization. State and local buyers have their own requirements, sometimes based on StateRAMP (now GovRAMP).
How do public buyers pay for SaaS?
Often annually in advance or monthly, through a purchase order. Multi-year terms may need yearly budget approval.