---
title: "Nexus (Sonatype) Pro and Repository Firewall"
ocid: "ocds-b5fd17-2f5bfa02-472b-48fe-8a1b-cfe29d052962"
canonical_url: "https://d3tenders.com/contract/?ocid=ocds-b5fd17-2f5bfa02-472b-48fe-8a1b-cfe29d052962"
markdown_url: "https://d3tenders.com/contract/ocds-b5fd17-2f5bfa02-472b-48fe-8a1b-cfe29d052962.md"
json_url: "https://d3tenders.com/contract/ocds-b5fd17-2f5bfa02-472b-48fe-8a1b-cfe29d052962.json"
source: "Contracts Finder"
current_stage: "Award"
buyer: "FCA"
published: "2026-08-13"
---

# Nexus (Sonatype) Pro and Repository Firewall

Buyer: FCA  
Current stage: Award  
OCID: ocds-b5fd17-2f5bfa02-472b-48fe-8a1b-cfe29d052962

[View canonical contract page](https://d3tenders.com/contract/?ocid=ocds-b5fd17-2f5bfa02-472b-48fe-8a1b-cfe29d052962)  
[Download OCDS JSON](https://d3tenders.com/contract/ocds-b5fd17-2f5bfa02-472b-48fe-8a1b-cfe29d052962.json)

## Summary

The FCA procured software supply-chain security services centred on Sonatype Nexus Pro and Repository Firewall. The requirement included 200 self-hosted Repository Firewall licences to detect and block malicious or high-risk open-source components before they enter the FCA’s repositories. It also covers quarantining suspicious components and continuous auditing against security, licensing and quality policies, helping prevent non-compliant artefacts from entering development workflows. Nexus Pro is intended to address critical operational, security and compliance risks, while improving resilience and role-based access controls. The service is categorised as a professional service and is delivered for the FCA in London. The buyer is the Financial Conduct Authority, based at 12 Endeavour Square, London.

This procurement is complete and has been awarded through a selective call-off from a framework agreement. The tender submission deadline was 1 April 2026 at 12:00. The FCA made the award to SOFTCAT LTD - FCA on 15 April 2026. The awarded value is £80,000, against an estimated procurement value of £90,000. The contract runs from 1 May 2026 to 30 April 2027. The award is active and covers the Sonatype Nexus Pro and Repository Firewall requirement. The procurement was evaluated and conducted as a services call-off, with the outcome represented by a single award to Softcat. The requirement was not identified as suitable for small or medium-sized enterprises or voluntary, community and social enterprises.

This award indicates demand from the FCA for specialist software composition analysis and repository security capability, rather than general IT support. Suppliers positioned for comparable requirements would need to provide Sonatype Nexus Pro and Repository Firewall, including self-hosted deployment and licensing at meaningful organisational scale. Credible delivery capability would include automatically identifying and blocking malicious or high-risk open-source components, quarantining suspicious items, and applying continuous security, licensing and quality policy checks. Suppliers should also understand software supply-chain risk, compliance controls, repository governance, resilience and role-based access control. Experience supporting secure development workflows and integrating controls into existing repositories would be relevant. The framework call-off route and the stated unsuitability for SMEs indicate that established, framework-appointed technology suppliers are best placed.

## Notice

Sonatype Firewall - Purchasing 200 licences for Sonatype Repository Firewall (self-hosted) to strengthen our software supply chain by automatically detecting and blocking malicious or high-risk open-source components before they enter our repositories. It also enables quarantining of suspicious components and continuous auditing against security, licensing and quality policies to prevent non-compliant artefacts from entering the development workflows. Nexus Pro - To mitigate existing risks from critical capabilities essential for meeting our operational, security, and compliance needs, to improving resilience and RBAC controls.

## Key Details

| Field | Value |
| --- | --- |
| Publication source | Contracts Finder |
| Latest notice | https://www.contractsfinder.service.gov.uk/Notice/6383507c-861f-4299-ac5b-34a0719006fe |
| Notice type | Award Notice |
| Procurement type | Framework |
| Procurement category | Services |
| Procurement method | Selective |
| Procurement method details | Call-off from a framework agreement |
| Tender suitability | Not specified |
| Awardee scale | Not specified |
| All stages | Award |

## Dates

| Field | Value |
| --- | --- |
| Publication date | 13 Aug 2026 |
| Submission deadline | 1 Apr 2026 |
| Future notice date | Not specified |
| Award date | 15 Apr 2026 |
| Contract period | 1 May 2026 - 30 Apr 2027 |
| Recurrence | Not specified |

## Values

| Field | Value |
| --- | --- |
| Tender value | £90,000 |
| Lots value | Not specified |
| Awards value | £80,000 |
| Contracts value | Not specified |

## Status

| Field | Value |
| --- | --- |
| Tender status | Complete |
| Lots status | Not specified |
| Awards status | Active |
| Contracts status | Not specified |

## Buyer

| Field | Value |
| --- | --- |
| Main buyer | FCA |
| Locality | LONDON |
| Postcode area | East London |
| Postcode | E20 1JN |
| Country | England |
| ITL 1 | TLI London |
| ITL 2 | TLI4 Inner London - East |
| ITL 3 | TLI41 Hackney and Newham |
| Local authority | Newham |
| Electoral ward | Stratford Olympic Park |
| Westminster constituency | Stratford and Bow |
| Delivery location | TLI London |

## Supplier

| Field | Value |
| --- | --- |
| Number of suppliers | 1 |
| Supplier names | SOFTCAT LTD - FCA |

## CPV Codes

### Divisions

- 73 - Research and development services and related consultancy services

### Codes

- 73400000 - Research and Development services on security and defence materials

## Release History

- 13 Aug 2026 at 07:26 - Award - Award Notice - https://www.contractsfinder.service.gov.uk/Notice/6383507c-861f-4299-ac5b-34a0719006fe

## Documents

- https://www.contractsfinder.service.gov.uk/Notice/6383507c-861f-4299-ac5b-34a0719006fe
  13th August 2026 - Awarded contract notice on Contracts Finder

## Provenance

This Markdown file is an alternate public rendering of the D3 Tenders contract record. The canonical page is https://d3tenders.com/contract/?ocid=ocds-b5fd17-2f5bfa02-472b-48fe-8a1b-cfe29d052962. The underlying structured data is available as OCDS JSON at https://d3tenders.com/contract/ocds-b5fd17-2f5bfa02-472b-48fe-8a1b-cfe29d052962.json.