More and more tenders carry security requirements, and they decide the winner more often than price does. The short answer on how to meet them: read the requirement literally, answer exactly what is asked, and have your basic documents ready before the bid is due. A smaller company with its security work in order regularly beats larger competitors who answer carelessly.
Below: which security requirements show up in public procurement, how to read them correctly, and what you can do now, long before the next bid.
Why the requirements are there
Public buyers are under the same pressure as large private customers. Many of them fall under the Cybersecurity Act and NIS2, which makes them responsible for security across their whole supply chain. That responsibility travels downward: the authority has to be able to show that its suppliers measure up too, and the simplest way is to require evidence in the procurement itself.
For you as a supplier that means the requirements arrive whether or not any regulation applies to you directly. The pattern is familiar from the questionnaires that large private customers send. The difference in procurement is that the rules are harsher: a requirement you do not meet can disqualify the entire bid.
What you will actually face
The wording varies between procurements, but the substance repeats. Expect questions or requirements on:
- An information security policy. Is there an approved policy, and is it followed? A short, clear policy often goes further than a thick binder.
- Access control. Who can reach the buyer’s data, and how is access limited?
- Incident handling. Routines for detecting, handling and reporting incidents. Buyers often want to see deadlines, sometimes 24 or 72 hours (compare our incident flow).
- Data protection. How personal data is handled, where data is stored and which subcontractors are involved.
- Continuity and backup. What happens during an outage, and how quickly are you back?
- Certification or equivalent. ISO 27001 is sometimes asked for, often with the addition “or equivalent”. That addition matters more than most people think.
Mandatory and scored requirements: read them differently
In procurement language the wording is everything. A mandatory requirement is just that. Fail it, or fail to show that you meet it, and the bid is rejected however strong everything else is. A scored requirement earns points in the evaluation but does not sink the bid.
The practical consequence: go through each mandatory requirement on its own and attach a concrete piece of evidence to every one. A policy, a description of a routine, a certificate. The buyer should never have to guess whether you meet it.
A common relief for smaller companies is the phrase “ISO 27001 or equivalent”. You rarely need a certification costing hundreds of thousands of kronor. Documented, systematic security work covering the same ground is often accepted as equivalent. But it has to exist on paper, and you have to be able to produce it.
Preparing before the bid gets urgent
Once the clock is running it is too late to build security work from nothing. The preparation happens in quieter weeks:
- Gather the basic documents. Policy, incident routine, record of processing activities and data processing agreements. Our list of the 7 compliance documents every company should have works as a checklist.
- Build an answer library. Save wording and evidence from every bid and questionnaire. Next time takes half the work.
- Appoint an owner. One person who keeps the documents current and knows where everything is. Without an owner, each bid becomes a stressful treasure hunt.
- Rehearse on a real example. Take an old tender in your industry and test yourselves: could we answer the mandatory requirements today? The gaps you find are your to-do list.
Common mistakes
The most expensive mistake is answering “yes” to a requirement you cannot substantiate. If that surfaces in a review you risk both the contract and your standing, and public buyers have long memories.
Almost as common: answering a different question. The buyer asks about your incident routine and gets a paragraph on your general approach to quality. In an evaluation that reads as no routine at all.
The third mistake is not bidding at all because an ISO requirement looks insurmountable. Check first whether “or equivalent” is there. If it is, you have a real chance, provided your work is documented.
Common questions
Do we have to be ISO 27001 certified to win public contracts? Usually not. Many procurements accept equivalent, documented security work. Read the requirement closely; where it says “or equivalent”, order that you can evidence is often enough.
What happens if we miss a mandatory requirement? The bid is rejected, however strong the rest of it is. Mandatory requirements are binary: met and evidenced, or not.
Can a small company compete with large suppliers? Yes. The evaluation is against the requirements, not against company size. A smaller company with clear documents and precise answers often beats a large one sending generic attachments.
How long does it take to be ready? Focusing on the basic documents, it is a matter of weeks rather than months. Certifications take longer, but as noted, they are not always needed.
Where Polaris comes in
Polaris keeps your policies, routines and evidence in one place, so the next bid starts from a finished library rather than an empty folder. You also see where the gaps are before a buyer finds them.
Want to know where you stand today? Take our Health Check for a position per area.
This article is general guidance, not legal advice. Requirements differ between procurements; always read the tender documents closely and get help where you are unsure.
