Cloud-Native Development for UK GovTech -- Compliance Built In

UK GovTech Cloud Architecture 2026

UK GovTech cloud-native in 2026 is shaped by four GOV.UK common platform integrations that every GDS-assessed service must use or justify not using: (1) GOV.UK One Login (citizen authentication -- replaces Verify and departmental auth), (2) GOV.UK Pay (payment processing -- Stripe under the hood, GOV.UK branded checkout), (3) GOV.UK Notify (transactional notifications -- email, SMS, letters), (4) GOV.UK Design System (WCAG 2.1 AA accessible component library). AWS architecture: Next.js 15 on ECS Fargate eu-west-2 + Aurora PostgreSQL + GOV.UK common platforms. Crown Commercial Service G-Cloud 14 hosts ClickMasters GovTech services -- procurement without additional OJEU tendering.

GOV.UK One Login Integration Pattern

GOV.UK One Login: DCMS-operated single sign-on for citizens across UK government services. Integration: (1) OAuth 2.0 PKCE Authorization Code flow (register application on GOV.UK One Login developer portal -- sandbox and production credentials separate), (2) identity levels (P5: email-verified -- low risk services, P9: verified identity -- passport/driving licence -- for benefit claims, tax, high-value services), (3) token validation (JWT access token -- validate signature against GOV.UK One Login JWKS endpoint), (4) user info endpoint (GET /userinfo -- returns sub, email, phone -- P9 adds verified identity claims), (5) logout (GOV.UK One Login provides back-channel logout -- ensure session destroyed on logout). GDS assessment: GOV.UK One Login integration is assessed at Alpha/Beta/Live -- assessors expect to see it used (or strong justification for departmental auth).

GDS Service Standard Assessment Preparation

GDS Service Standard (18 points from December 2023) key technical requirements: (1) Understand users and their needs (point 1 -- user research evidence), (2) Solve a whole problem for users (point 2 -- end-to-end service), (3) Provide joined-up experience (point 3 -- cross-government consistency), (4) Make the service simple to use (point 4 -- GOV.UK Design System), (5) Make sure everyone can use the service (point 5 -- WCAG 2.1 AA, axe-playwright, NVDA testing). Technical preparation for Live assessment: (a) WCAG 2.1 AA -- axe-playwright zero violations, NVDA manual test documented, (b) performance (GOV.UK performance monitoring -- average page load < 2 seconds), (c) deployment pipeline (automated testing, staging environment), (d) security (CE Plus, pen test within 12 months). ClickMasters GDS preparation: 4-week pre-assessment mock assessment -- identify gaps before formal assessment.

Crown Commercial Service G-Cloud 14

G-Cloud 14: UK government cloud services procurement framework (Crown Commercial Service). G-Cloud 14 lot 4 (Specialist Cloud Services): ClickMasters registered -- government departments can procure ClickMasters cloud-native GovTech development without OJEU tender process. G-Cloud 14 registration requirements: (1) Cyber Essentials or CE Plus, (2) ISO 27001 (or equivalent), (3) service description on Digital Marketplace, (4) pricing transparency (day rates published), (5) terms and conditions (Crown Copyright, Data Protection). G-Cloud procurement speed: government department can award a G-Cloud 14 contract in 2-4 weeks vs 12-24 months for OJEU tender. ClickMasters GovTech: all GovTech staff augmentation and development available via G-Cloud 14.

GDS Service Standard

GOV.UK Design System

GOV.UK One Login

GOV.UK Pay

Cyber Essentials Plus

UK GDPR