Summary
Common Procurement Vocabulary (CPV) codes are the EU's standardised classification system for public procurement, used across all 27 member states and by EU institutions on TED (Tenders Electronic Daily). For cybersecurity vendors, understanding the full CPV landscape is essential for monitoring opportunities systematically — a single missed code family can mean overlooking hundreds of relevant contracts per year. This reference guide provides a complete catalogue of CPV codes relevant to cybersecurity procurement, explains how the CPV system works, covers how to configure TED alerts, and identifies the highest-volume codes and emerging codes to watch in 2026.
How CPV Codes Work
CPV codes are 8-digit numerical codes with a check digit, organised into a hierarchical taxonomy. The structure is: Division (first 2 digits) → Group (first 3 digits) → Class (first 4 digits) → Category (first 5 digits) → Sub-category (all 8 digits). For example, the code 72212730 breaks down as: 72 (IT services division) → 722 (software programming group) → 7221 (application software programming class) → 72212 (programming services category) → 72212730 (security software development).
Contracting authorities choose CPV codes to classify their procurement notice. For cybersecurity, there are two problems: the CPV taxonomy was last significantly revised in 2008, predating cloud computing, EDR, SIEM, and many current security concepts; and procurement officers often use broad parent codes (e.g., 72000000 — IT services) rather than specific security subcodes. This means relying on CPV codes alone will miss many relevant contracts. Effective monitoring requires CPV codes combined with keyword searching in contract titles and descriptions.
Security Software CPV Codes
- 48730000 — Security software package (top-level code for security software)
- 48731000 — Security management software package
- 48732000 — Data security software package
- 48761000 — Anti-virus software package
- 48900000 — Miscellaneous software packages and computer systems
- 72212730 — Security software development services
- 72212517 — IT software development services (security applications)
- 72212480 — Sales, inventory and distribution software development services (sometimes misused for security tools)
Security Services CPV Codes
- 72220000 — Systems and technical consultancy services (penetration testing, security architecture, NIS2 consulting)
- 72222300 — Information technology services (broad security services)
- 72700000 — Computer network services (network security, SOC, managed detection)
- 72315000 — Data network management and support services (network security management)
- 72250000 — System and support services (managed security services, MSSP)
- 72300000 — Data services (data security, data classification)
- 72600000 — Computer support and consultancy services (security support)
- 72212000 — Programming services for application software (security development)
Audit and Compliance CPV Codes
- 79212000 — Auditing services (security audits, ISO 27001 assessments, NIS2 compliance audits)
- 79212100 — Internal audit services
- 79212300 — Statutory audit services
- 79131000 — Documentation services (data mapping, RoPA, policy documentation)
- 79100000 — Legal services (data protection legal advice, DPO services)
- 73000000 — Research and development services (cybersecurity research, threat intelligence studies)
Hardware and Infrastructure CPV Codes
- 35120000 — Surveillance and security systems and devices (security hardware appliances)
- 32420000 — Network equipment (firewalls, switches, routers)
- 32422000 — Network components
- 35125300 — Security cameras (CCTV — physical security, sometimes paired with cybersecurity)
- 30200000 — Computer equipment and supplies (secure computing hardware)
- 32000000 — Radio, television, communication, telecommunication and related equipment
Training and Education CPV Codes
- 80533100 — Computer training services (cybersecurity awareness, technical security training)
- 80000000 — Education and training services
- 80510000 — Specialist training services (advanced security qualifications)
- 80531000 — Technical and vocational training services
- 80570000 — Personal development training services (CISO/executive security training)
Setting Up TED Alerts by CPV Code
TED's alert system (ted.europa.eu) allows you to save searches and receive email notifications when matching notices are published. To set up effective cybersecurity CPV monitoring:
- Create an account on TED and access the "My TED" section
- Use the Expert Search to combine multiple CPV codes with OR operators
- Add keyword filters for your specific services to refine results
- Filter by country if you are focused on specific member states
- Set notification frequency to daily for fast-moving opportunities
- Supplement TED alerts with national procurement portal alerts (BOAMP in France, Vergabe.de in Germany, TenderNed in Netherlands) where pre-threshold contracts are published
A recommended starting CPV alert set for cybersecurity: 48730000, 48761000, 72220000, 72222300, 72700000, 79212000, 80533100, 35120000, 32420000 — covering the major code families across software, services, audit, training, and hardware.
Most Active Codes by Volume and Codes to Watch in 2026
Highest volume cybersecurity codes in 2025 (by number of TED notices): 72222300, 72220000, 72700000, 48730000, 79212000 — broad service and consultancy codes that capture the majority of security contract activity.
Codes to watch in 2026: 72212730 (security software development — rising with NIS2-driven custom development), 80533100 (security awareness training — driven by NIS2 Article 20 mandate), 73000000 (R&D services — ENISA and national cybersecurity agency research procurement), 79131000 (documentation services — GDPR and NIS2 policy and records work). The hardware codes 35120000 and 32420000 are also trending upward as government network security refresh cycles accelerate.
For the most granular market intelligence, use TenderMetric's alert service to monitor all relevant CPV codes and keywords simultaneously across TED and all major national portals, ensuring no relevant opportunity is missed regardless of how a contracting authority has chosen to classify their requirement.