Purchasing digital goods and services exposes public bodies to technological and compliance risks that should be managed from the tender design stage and embedded in contracts. This article provides a practical checklist, core principles to include in specifications, and sample clauses to adapt to your context.

Why include cybersecurity clauses in procurement

  • Reduce operational risk and the attack surface introduced by suppliers and third parties.
  • Ensure compliance with applicable legal frameworks (e.g., GDPR, NIS2, EU-level resilience rules) by the organizations that deliver services and products.
  • Define responsibilities, service levels and control mechanisms for incidents, vulnerabilities and data handling.

Who should use this guidance

Procurement offices, contract managers, contracting authorities, data protection officers (DPOs), CISOs and legal teams in public administrations and entities issuing tenders or entering ICT contracts.

Key principles to include in tenders and specifications

  • Security by contract: security compliance must be a contractual requirement, not optional.
  • Proportionality: tailor requirements to the risk category of the purchased service or product (e.g., critical infrastructure vs. back-office services).
  • Supply chain transparency: define responsibilities across subcontracting chains.
  • Verifiability: include the public body's right to audit, inspect and test security controls.
  • Continuity and resilience: obligations on backup, continuity and recovery.
  • Data protection and incident reporting aligned with legal duties.

Operational checklist for tender preparation

  1. Identify critical assets, data and processes covered by the contract.
  2. Assess risk category and set baseline security requirements.
  3. Specify applicable legal and regulatory compliance to be met by the supplier (e.g., data protection and network/security rules).
  4. Include obligations for vulnerability management (scans, patching, disclosure).
  5. Require incident response plans and maximum notification times for breaches.
  6. Specify audit and testing rights (including penetration testing) with operational limits and safety conditions.
  7. Regulate subcontracting and supply chain: obligate suppliers to flow down the same requirements to subcontractors.
  8. Define measurable security SLAs (recovery time, detection time, patching rate).
  9. Establish control mechanisms, reporting formats and review cadence.
  10. Provide contractual remedies for non-compliance (penalties, termination, mandatory mitigation).

Technical and organizational controls to consider

  • Access controls and identity management following least privilege principles.
  • Logging and monitoring with retention suitable for investigations.
  • Encryption of data in transit and at rest when appropriate.
  • Secure configuration and system hardening.
  • Patch management with defined maximum timelines for critical updates.
  • Backups, disaster recovery plans and periodic recovery testing.
  • Software supply chain protections (signature verification, dependency management, SBOM where feasible).
  • Supplier staff training programs and physical access controls.

Practical clause examples (adapt and review with legal counsel)

  • Compliance clause

    • "The Supplier shall comply with applicable laws on personal data protection and network and information security, and shall provide documentary evidence upon the Contracting Authority's request."

  • Incident notification clause

    • "The Supplier shall notify the Contracting Authority of any relevant security incident within [proportionate time, e.g. 24/72 hours] of discovery, providing details on the incident, impacts, measures taken and mitigation plan."

  • Vulnerability management clause

    • "The Supplier shall perform periodic vulnerability scans, report critical vulnerabilities and apply patches within the timelines agreed in the security plan. The Supplier shall produce remediation reports when requested."

  • Audit and testing clause

    • "The Contracting Authority has the right to conduct audits, inspections and penetration tests, with reasonable notice, or to commission such activities to authorized third parties; the Supplier shall cooperate and not unduly impede such activities."

  • Subcontracting and supply chain clause

    • "The Supplier remains responsible for compliance with security obligations by its subcontractors and shall disclose to the Contracting Authority any critical subcontractors."

  • Liability and penalties clause

    • "In case of breach of security obligations causing damage to the Contracting Authority, the Supplier shall be liable and subject to contractual penalties and indemnification, within the limits of the Contract and applicable law."

Lifecycle control and post-contract management

  • Plan periodic contract reviews to align with changing technological risk.
  • Require secure winding-down procedures (data return/wipe, data transfer, certification of erasure).
  • Define exit procedures to minimize operational and security impacts.

Aligning with national and EU frameworks without bureaucracy

  • Request evidence of compliance (policies, certifications, attestations) and translate them into measurable operational requirements.
  • Use award criteria that value security capabilities (technical proposals, team CVs, assessment results).

Recommendations and next steps

  • Start embedding security requirements already at the tender design phase.
  • Draft clear, measurable and verifiable clauses: vague language leads to disputes.
  • Coordinate procurement, security and legal teams to calibrate risk and thresholds.
  • Have final clauses reviewed by legal counsel and the DPO/CISO.

Adapt the sample clauses to the specific context and obtain legal and compliance validation. The aim is to make procurement an active tool for managing digital risk, not merely an administrative procedure.