Web Application Firewall Partners Framework Agreement
Framework Description
Jisc's Web Application Firewall Partners Framework Agreement buys managed WAF services for UK higher education, further education and research institutions. It has a single lot and two awarded suppliers, Corporate Document Services Limited and Exclusive Networks Limited; the first contract was signed on 14 December 2025. Jisc wraps its own managed service around third-party WAF products. The framework runs to 2 November 2028, with a 12-month extension option to 2 November 2029.
Context & Use Case
Institutions use it to protect public-facing websites, portals and applications from web attacks without buying and running WAF tools themselves. Jisc provides monitoring, tuning and incident response on top of the partner's product, and the service can be bought directly from Jisc or through G-Cloud. It suits security teams that want expert oversight without adding headcount.
Scope of Services
Managed web application firewall provision Third-party WAF products, configured and managed Jisc monitoring, tuning and incident response Integration with institutional security operations Reporting and compliance support
Lots
Single lot
Who Can Apply
WAF vendors, distributors and managed security providers. Both places have been awarded and applications are closed, so others cannot join now. The next chance is a re-procurement, likely around 2 November 2028, or a year later if the extension is used; security vendors with education references should position themselves for it.
Buyer Benefits
Institutions get WAF protection backed by Jisc's sector security expertise, with one service covering product, configuration and incident response. Buying through G-Cloud or directly from Jisc keeps procurement light, and a two-supplier panel gives Jisc product choice and resilience if one vendor's roadmap changes.
Next Steps
If you're a WAF vendor not on the framework, consider whether you could partner with one of the awarded suppliers, and prepare for the next procurement ahead of the 2 November 2028 end date: education case studies, evidence of integration with security operations centres, and pricing for a Jisc-wrapped service. Watch Find a Tender and jisc.ac.uk for early market engagement.
How Athena Can Help
For security vendors, Athena's job here is to prepare you for the next competition. Our competitor scoring and win themes work shows how your offer compares with the two incumbents, and we draft early content on product, integration and the Jisc service wrap.
Meanwhile, G-Cloud and framework applications can open other routes to the same buyers, and public sector bid planning sets your timeline back from the expected re-tender, so your evidence and partners are in place well before the notice appears.
