What Are The Most Secure Databases for Government Contractors?

Ask most search tools what the most secure database for a government contractor looks like and you'll get an answer about FedRAMP authorisation, CMMC levels and DoD Impact Level 5. All three are American. If you're a UK contractor holding stakeholder data for a council, a government department or an NHS trust, none of them apply to your contract, and quoting them in a supplier assurance questionnaire will not help you.

The UK has its own set of requirements, and they're specific. This guide covers what they are, which ones bite on stakeholder and consultation data, and the questions to put to a vendor before you commit.

Key takeaways

• ISO 27001:2022 and Cyber Essentials Plus are the baseline, not a differentiator. A certificate citing ISO 27001:2013 expired on 31 October 2025.
• Cyber Essentials is contractual, not optional. PPN 014 requires it on central government, agency, NDPB and NHS contracts that touch personal data or OFFICIAL information.
• FedRAMP, CMMC and DoD IL5 carry no weight in UK procurement. A vendor leading with them was built for a different market.
• UK data residency removes an ongoing diligence burden. Relying on the UK-US data bridge means re-checking your vendor's certification status indefinitely.
• Certification proves the supplier has controls. Only the audit trail proves the controls were used, and that's what a scrutiny process actually asks for.
• Ask where the data sits, how granular the permissions are, and what happens to your records when the contract ends. Get all three in writing.

What are the most secure databases for government contractors?

For UK government work, the most secure databases are those certified to ISO 27001:2022, holding Cyber Essentials Plus, hosted on UK infrastructure, and designed around role-based access and a complete audit trail. Certification alone isn't enough. The database also has to evidence who accessed what, when, and why.

That combination is what a client's supplier assurance team actually checks. Certification proves the supplier has controls. The audit trail proves the controls were used.

Why does this matter more for contractors than for the client?

Because you carry the client's obligation without the client's authority. A council can set its own risk appetite. You inherit theirs, in a contract schedule, and you're the one who has to evidence compliance when they ask.

The data makes it sharper. Stakeholder records are personal data by definition: names, addresses, contact details, stated positions on a scheme, sometimes political affiliation or objections to a development. On infrastructure work it extends to landowners affected by compulsory purchase, elected representatives and community groups organising against the project. A breach there isn't just a reporting exercise, it's a live problem with the people your client needs on side.

And the practical question is rarely 'was it secure'. It's 'can you produce the record'. When a DCO examination, an FOI request or a select committee question lands, the value of the database is entirely in what it can prove.

What is a secure stakeholder database in government?

A secure stakeholder database is a single, access-controlled system that holds every stakeholder record and every interaction with that stakeholder, on infrastructure the client's security policy permits, with an audit trail that can be produced on demand.

The distinction that matters is between storage and evidence. A locked spreadsheet on SharePoint is storage. It won't tell you who opened it in March, which rows were edited, or whether the contact who asked to be removed in January is still in the mailshot list. A stakeholder relationship management (SRM) platform is built to answer those questions, because in government work someone eventually asks them.

Tractivity, the UK stakeholder relationship management platform, has been built around that requirement since 2002. Across 20+ years of UK public sector work the pattern has been consistent: the record only counts if it's defensible.

What does 'secure' actually mean in a UK government contract?

Five requirements do most of the work. If a contract touches personal data or OFFICIAL-classified information, expect all five to appear somewhere in the schedules:

• Cyber Essentials, and often Cyber Essentials Plus. Procurement Policy Note 014, updated February 2025 and effective from 24 February 2025, requires central government departments, executive agencies, non-departmental public bodies and NHS bodies to apply Cyber Essentials requirements to contracts involving citizens' personal information, government staff data, or ICT systems that store or process information classified at OFFICIAL. Certification has to be evidenced at the point data is passed to the supplier, and renewed annually for the life of the contract. Cyber Essentials Plus adds independent technical verification rather than self-assessment, and higher-risk contracts increasingly specify it.

• ISO 27001:2022. The current version of the information security management standard. This one catches people out: the transition window from ISO 27001:2013 closed on 31 October 2025, so any certificate still citing the 2013 standard has lapsed. If a vendor's website says 'ISO 27001 certified' without a version, ask which one, and ask for the scope statement. A certificate scoped to the vendor's corporate IT rather than the platform processing your stakeholder data isn't the assurance you think you're buying.

• UK data residency and the NCSC Cloud Security Principles. The NCSC's 14 Cloud Security Principles are the standard framework for assessing a cloud service, covering data in transit, asset protection and resilience, separation between customers, supply chain security and personnel security. Many UK contracts also specify where data physically sits. Tractivity hosts on Microsoft Azure UK South by default, with EEA, US and other regions available where a client's policy requires it.

• Government Security Classifications. Most stakeholder engagement data sits at OFFICIAL, sometimes with the OFFICIAL-SENSITIVE handling caveat where the material is politically sensitive or identifies individuals who could be harmed by disclosure. Your database needs access controls fine enough to honour that caveat, which in practice means restricting at project, module and record level rather than giving everyone in the team the same view.

• Sector-specific assurance. NHS work brings the Data Security and Protection Toolkit, audited annually. Utilities supply chains bring schemes like Achilles UVDB. Listing on G-Cloud 14 via the Crown Commercial Service Digital Marketplace isn't a security certification, but it does mean the commercial and security terms have already been assessed, which shortens procurement considerably.

One more on the horizon. The Cyber Security and Resilience Bill is before Parliament with Royal Assent expected during 2026 and phased implementation running into 2028. It introduces a 24-hour initial incident notification to regulators from first awareness, followed by a full report within 72 hours, and brings managed service providers into scope for the first time. If your database sits with a supplier who manages it for you, that relationship is likely to be regulated in a way it isn't today. Worth reading the schedules on any contract you sign this year with that in mind.

Why FedRAMP and CMMC don't apply to your UK contract

FedRAMP is the US federal government's cloud authorisation programme. CMMC is the US Department of Defense's supply chain maturity model. DoD Impact Level 5 is a US defence hosting classification. All three are genuinely rigorous, and all three are irrelevant to a contract with a UK local authority, department or NHS trust.

This matters more than it sounds. A supplier holding FedRAMP Moderate but no Cyber Essentials certification cannot satisfy PPN 014. A supplier hosting in a US region cannot satisfy a UK data residency clause. If you're comparing platforms and one of them leads with American credentials, that's usually a sign the product was built for a different market and the UK requirements were added later.

Where does your data actually sit?

Data residency is where most evaluations get vague, and it's the question with the longest tail.

For UK public sector work, many procurement frameworks require personal data to stay within UK jurisdiction. That's a contractual requirement more often than a legal one, but it binds you either way. If a vendor stores your stakeholder data in the United States, you're relying on the UK Extension to the EU-US Data Privacy Framework, the UK-US data bridge.

The bridge is valid, and because it's a separate arrangement it wouldn't automatically fall if the EU-US framework were struck down. But relying on it isn't a one-off tick. The ICO expects you to check that the receiving US business holds active status on the Data Privacy Framework list, that it has self-certified specifically for the UK Extension, and that its certification covers the category of data you're sending. Businesses can withdraw or lose active status, so that's a periodic check for as long as the arrangement runs. Special category data needs additional measures on top.

UK hosting removes all of that. It's worth pricing the diligence you avoid, not just the hosting you buy.

Ask every vendor directly: where is my data stored at rest, what would change that, and can I have it in writing?

What makes a stakeholder database audit-ready?

Audit-readiness means the database can answer four questions without advance preparation: who did you engage, when, how, and what came of it. Four capabilities make that possible.

Automatic timestamping. Every interaction logged with a date and time at the moment it happens: emails sent, meetings recorded, survey responses received, issues raised. Manual date entry creates errors, and errors are what a challenge process looks for.

Role-based access controls. Different people need different views. A programme manager sees everything; a subcontractor sees only their assigned stakeholders. Permissions should be configurable at project, module and record level, because that's what lets you honour an OFFICIAL-SENSITIVE caveat rather than just claim you have.

Complete engagement history. Pull up a contact and see everything: every meeting, every email, every survey response, every issue raised and how it was resolved. That connected view is the difference between a stakeholder database and a contact list.

Exportable records. Auditors, regulators and FOI officers work in Word, Excel and PDF. Pre-built reports that answer the questions those people actually ask save weeks over a programme's life. Tractivity ships 150+ pre-built reports covering board packs, regulator submissions and FOI responses, in tabular, matrix, graph, demographic and mapping views.

How do you evaluate GDPR and compliance capability?

UK GDPR compliance isn't a feature you bolt on. It has to be in how the system handles lawful basis, consent, subject rights and retention.

Lawful basis and consent. Stakeholder consent is more complicated than marketing consent. The same person can be held on different lawful bases across different projects, legitimate interests for a statutory consultation, consent for a newsletter. The system needs to track which basis applies where, record when and how consent was obtained, and enforce restrictions automatically. That last part is the one that matters: if someone opts out, the platform should block the next mailshot rather than rely on a colleague checking a list.

Data subject rights. Stakeholders can ask for access, correction or erasure, and you have one calendar month to act. You should be able to retrieve everything held on an individual from a single search. If that means checking a database, three inboxes and a survey tool, you don't have one month, you have a problem.

Retention. Records shouldn't outlive their purpose. Look for retention rules that flag records past review date and support scheduled deletion. A stakeholder database with no retention policy accumulates risk quietly for years.

Why integrated engagement matters, and where to be careful

Most contractor teams run engagement on a patchwork: a spreadsheet for contacts, Outlook for email, one tool for surveys, another for events. Every tool is a silo, and building a complete picture means manual collation.

That fragmentation is a compliance problem, not just an efficiency one. Data in five places is harder to apply retention to, harder to search for a subject access request, and harder to audit. It also hides gaps: the stakeholder promised a follow-up who never got one, the issue raised that nobody closed.

Consolidating helps on both counts. Each third-party tool you remove is one fewer data processor, one fewer contract, one fewer breach surface. Tractivity's base SRM licence covers the stakeholder database, mapping and segmentation, interaction logging, mail synchronisation, surveys and online consultations, mailshots, event and meeting management, and issue and commitment tracking, in one system with one processor agreement.

Two honest caveats, because 'all-in-one' claims deserve scrutiny from you as a buyer:

• Tractivity does not send SMS. If a vendor's channel list matters to your programme, check it item by item rather than accepting the phrase.
• The Engage-360 public portal, the branded public-facing site where community members self-register and respond, is a separately-priced module rather than part of the base licence. It's scoped to the size of your engagement programme.

Apply the same two questions to any vendor: what's actually in the licence, and what's quoted separately.

Where each type of database breaks

Four options come up repeatedly. Each fails at a predictable point:

• Spreadsheets. The most common starting point and the least defensible. A University of Hawaii study found 94% of spreadsheets contain errors, with an error in roughly one in every 20 cells. Beyond accuracy, a spreadsheet can't enforce access restrictions, can't log who read a record, and can't prove an opt-out was honoured. It fails supplier assurance on the first question.

• A generic CRM. Salesforce, Dynamics and HubSpot are secure products. The problem isn't the security, it's the data model. A CRM is built around a linear path from lead to customer: one contact, one account, one deal. Stakeholder engagement is many-to-many, the same person is a resident, a parish councillor and a member of an action group, and their position shifts over three years. Teams force the fit with custom objects, and every customisation is a new thing to secure, document and re-test at each assurance review.

• An in-house database. Full control, and full responsibility. You own the certification, the penetration testing, the patching, the access reviews and the evidence pack for every client questionnaire. For a contractor whose core business is engineering or planning, that's a standing cost with no commercial return.

• A purpose-built SRM platform. Designed for the many-to-many model, with accreditations already in place and the audit trail on by default. The trade-off is that you're adopting someone else's security posture, so the diligence happens before you buy rather than after.

How do you assess vendor reliability?

A stakeholder database on a multi-year programme is a long commitment. Four things worth checking beyond the feature list.

Support that runs on your clock. When something breaks at four on a Friday before a consultation closes, you need support in UK working hours that understands UK regulatory context. Ask what's included and what's charged.

Implementation. Ask for a typical timeline for an organisation like yours, what onboarding is included, and whether training or setup carries a fee. Tractivity implementations run two to six weeks from contract to live system, with a dedicated UK-based Client Success Manager and unlimited UK-based support included.

References in your sector. A contractor should speak to another contractor. Generic references from a different sector tell you little about how the system holds up under your kind of scrutiny.

Business continuity, and the exit. Ask about backup frequency, encryption, disaster recovery and how often recovery is actually tested. Then ask the question most evaluations skip: what happens to my data when the contract ends, in what format, and how quickly? Get it in writing before you sign, not after.

The procurement question bank

Fourteen questions, grouped the way an assurance team works through them. Get written answers to all fourteen and you have most of a supplier assurance pack ready before your client asks for one.

Security

1. Where is my data stored at rest, and what would change that?
2. Can you produce your ISO 27001 certificate, its version and its scope statement?
3. Do you hold Cyber Essentials or Cyber Essentials Plus, and when does it renew?
4. When was your last penetration test, who conducted it, and can we see the summary?
5. How granular are the permissions, project, module, record?
6. What does the audit trail capture, reads as well as writes?
7. What happens to my data when the contract ends?

Compliance

1. How does the system handle multiple lawful bases within a single stakeholder record?
2. Show me how a subject access request would be actioned, start to finish.
3. What retention tools are built in, and can deletion be scheduled?
4. How are consent withdrawals enforced, by the system or by the user?
5. If there are AI features, where do the models run and is customer data used for training? In Tractivity, AI Sentiment and AI Summarise run inside the same Microsoft Azure UK environment as the rest of the platform, and customer data is never used to train or fine-tune models.

Commercial and operational

1. What is in the base licence, and what is quoted separately?
2. Are you on a framework? G-Cloud 14 listing means the commercial and security terms are pre-assessed, which can take months out of a procurement.

What the evidence looks like when it works

Certification gets you through procurement. The audit trail is what gets you through scrutiny.

EDF used Tractivity across Hinkley Point C and Sizewell C, two of the most heavily examined infrastructure programmes in the UK, logging around 30,000 stakeholder issues at a 100% response rate and evidencing more than 650 events. Anglian Water manages 13,000+ stakeholders on its Cambridge nationally significant infrastructure project in the same system it uses for regulator engagement. Transport for the South East holds 3,000+ contacts and cut the time spent on stakeholder management to less than a quarter of what its spreadsheet-based process took.

Those numbers are the point. Not that the data was stored securely, but that three years later someone could ask 'who did you engage, when, and what did they say', and the answer took minutes.

How Tractivity answers these requirements

Tractivity holds ISO 27001:2022, Cyber Essentials Plus, NHS DSPT and Achilles UVDB Silver Plus, is listed on G-Cloud 14 via the Crown Commercial Service Digital Marketplace, and is penetration tested annually by a CREST-approved organisation. Hosting is Microsoft Azure UK South by default, with EEA, US and other regions available. Accessibility is WCAG 2.2 Level A today, with Level AA on track for 2026, and Welsh language support is included for organisations under the Welsh Language Standards.

Pricing is published rather than quoted on request: £9,495 per year for the base SRM licence plus £500 per additional user, with no record caps and no per-user feature gates inside the platform. The Engage-360 public portal is a separately-priced module, scoped to the size of your engagement programme.

Sixteen UK central, devolved and local government organisations use Tractivity, including HM Treasury, the Welsh Government, the Department for Transport and Companies House.

See where your record would fail

If you're bidding for public sector work this year, the fastest way to find the gap is to put the fourteen questions above to whoever currently holds your stakeholder data, including your own IT team.

Book a 20-minute walkthrough and we'll work through your actual contract requirements against the platform, not a generic demo.