Summary
EU public sector cybersecurity procurement has surpassed €18 billion annually and is growing faster than any other IT segment, driven by the NIS2 Directive, increasing ransomware attacks on public infrastructure, and the EU's push for digital sovereignty. From small municipal contracts for antivirus renewals to multi-million euro SOC-as-a-Service frameworks at the national level, opportunities exist across the full spectrum of company sizes. This guide explains the market structure, key CPV codes, major contract vehicles, and how to position your firm to win.
The EU Government Cybersecurity Market in 2026
European governments have dramatically increased cybersecurity budgets following a wave of high-profile incidents: ransomware attacks on hospitals in Ireland, France, and Germany; the disruption of critical infrastructure in the Baltic states; and systemic vulnerabilities exposed in legacy government IT systems. In 2026, cybersecurity is no longer a line item buried in IT budgets — it is a standalone procurement category commanding dedicated budget allocations at every level of government.
Key drivers accelerating procurement in 2026:
- Full enforcement of NIS2 Directive (2022/2555/EU) — expands mandatory security requirements to thousands of new entities across 18 critical sectors
- EU Cyber Solidarity Act — establishing national and cross-border Security Operations Centres (SOCs)
- Cyber Resilience Act — forcing procurement of products with security built in by design
- National cybersecurity strategies across all 27 member states, most with dedicated public procurement components
- Military and defence cyber programmes through the European Defence Fund
Key CPV Codes for Cybersecurity Tenders
Understanding CPV codes is essential for monitoring TED effectively. Cybersecurity spans multiple code families:
- 72212730 — Security software development services
- 72222300 — Information technology services
- 72212517 — IT software development services (security applications)
- 72220000 — Systems and technical consultancy services
- 72700000 — Computer network services (network security)
- 48761000 — Anti-virus software package
- 48730000 — Security software package
- 79212000 — Auditing services (for security audits)
- 80533100 — Computer training services (awareness training)
- 35120000 — Surveillance and security systems (hardware)
Set up TED alerts for all of the above codes simultaneously — many contracting authorities use broad codes like 72222300 even when procuring specialist services like penetration testing or incident response.
Impact of NIS2 on Public Procurement
The NIS2 Directive is the single biggest demand driver in EU cybersecurity procurement. It expands the scope of mandatory cybersecurity obligations far beyond the original NIS Directive, covering essential entities (energy, transport, health, water, digital infrastructure, public administration, space) and important entities (postal services, waste management, chemicals, food, manufacturing, and more).
Public authorities that fall under NIS2 — which includes most significant public administration bodies — are now legally required to procure and implement:
- Risk analysis and information system security policies
- Incident handling and response capabilities
- Business continuity and crisis management systems
- Supply chain security assessments
- Security in network and information systems acquisition and maintenance
- Cybersecurity hygiene practices and training programmes
- Cryptography and encryption solutions
- Multi-factor authentication systems
Each of these requirements translates into procurement activity. Authorities that lack in-house capability — the majority — must contract these services externally, creating a sustained pipeline of tenders.
ENISA and EU-Level Contracts
The EU Agency for Cybersecurity (ENISA) is itself a significant contracting authority, publishing tenders for research, threat intelligence, training programmes, certification support, and event management. All ENISA tenders appear on TED. Beyond ENISA, the European Commission's DIGIT unit runs cybersecurity framework agreements that cover the Commission itself and are sometimes extended to EU agencies and bodies.
The EU Cyber Solidarity Act has created a new procurement vehicle: the European Cybersecurity Reserve, a pool of trusted managed security service providers that can be deployed during major cross-border incidents. Being admitted to this reserve — managed through ENISA — provides high-visibility credentials and direct contract opportunities.
Typical Tender Structures
EU cybersecurity contracts come in several forms:
- Framework agreements (4-year): Multi-supplier lots covering broad service categories. Require initial qualification bid, then call-off competitions for individual assignments. High-value investment but substantial ongoing revenue.
- Single-contract open procedures: For specific projects — a penetration test, a security audit, a SIEM deployment. Usually €50K–€2M. Most accessible entry point for specialist firms.
- Negotiated procedures: For urgent or highly specialised requirements (incident response retainers, classified system security). Fewer competitors, but require existing credentials.
- Dynamic Purchasing Systems (DPS): Open, ongoing qualification lists used by some national authorities. Join once, receive invitations to quote for individual contracts throughout the system's lifetime.
Qualification Requirements
Cybersecurity contracts typically carry higher qualification bars than general IT services, reflecting the sensitivity of the work:
- ISO 27001 certification — effectively mandatory for any contract involving access to government systems or data
- Professional indemnity insurance — €2–10 million depending on contract value and risk profile
- Security clearances — for defence and intelligence-adjacent contracts; can take 6–18 months to obtain
- Relevant certifications — CREST, CHECK, OSCP, CISSP, CEH depending on service type
- Comparable references — 2–3 similar contracts completed in the last 3 years, ideally in the public sector
- Data processing agreements — GDPR-compliant DPAs, often with specific data residency requirements
Winning Strategy
The evaluation criteria for cybersecurity tenders heavily weight technical quality — typically 60–80% of the score — with price accounting for only 20–40%. This is good news for specialist firms: competing on quality rather than price eliminates the race to the bottom that characterises commodity IT procurement.
Winning bids typically demonstrate: a thorough understanding of the contracting authority's specific threat landscape (referencing their sector, size, and known regulatory obligations); a clear, jargon-free methodology that non-technical evaluators can assess; named senior staff with impressive credentials; a track record of comparable public sector engagements; and proactive proposals around knowledge transfer and building internal capability — contracting authorities increasingly want to improve their own teams, not just outsource to a black box.
Key Takeaways
- Quality scoring dominates (60–80%): EU cybersecurity contracts reward specialist expertise over low price — compete on quality, not cost.
- ISO 27001 and sector certifications (EUCS, CC EAL) are mandatory gates — they get you to the table, but not across it.
- NIS2 Directive (effective 2023) is the single biggest driver of EU cybersecurity spend — every in-scope authority is now obligated to procure security improvements.
- Framework agreements lock out non-members — apply for ENISA, DG DIGIT, and national cybersecurity frameworks before they re-open.
- Named senior staff with clearances and sector-specific public sector references is the primary differentiator in most evaluation matrices.
Actionable Steps
- Audit your ISO 27001 certificate — if expired or pending renewal, prioritise this above all other bid preparation activities.
- Search TED for open framework competitions in your target member states (CPV codes: 72212520, 72227000, 72220000).
- Monitor ENISA and DG DIGIT Prior Information Notices 3–6 months before framework re-competitions.
- Build a public sector reference portfolio — contracting authorities treat prior public sector engagements as primary quality evidence.
- Set up TenderMetric sector alerts for IT Services and Defence to catch new cybersecurity notices the day they appear on TED.