Do we need ISO 27001 to win a public sector contract? What buyers actually ask for
Sometimes, but not always. Whether you need ISO 27001 for a public sector contract depends on the contract, the buyer and what data or systems you'd handle. Some tenders require it, some ask for something else such as Cyber Essentials, and many simply ask you to describe how you manage information security. The only reliable answer is in the tender documents themselves.
The good news for a business owner: whichever way the wording goes, a security system that is real and runs every day gives you a credible answer, makes questionnaires faster, and lets you bid for bigger customers with more confidence.
What buyers tend to ask for
Requirements vary widely, so treat this list as a guide to what you may see, not a rule.
- A certificate. Some tenders ask for ISO 27001 certification, or for an equivalent. Check whether it's a mandatory requirement or a scored one, and whether "equivalent" is accepted.
- Cyber Essentials. Many public sector contracts ask for a Cyber Essentials certificate, which is a different, simpler scheme. See Cyber Essentials versus ISO 27001.
- Answers to a questionnaire. A set of questions about your policies, staff, suppliers and incident handling, scored by the buyer.
- Evidence you're working towards it. Some buyers accept a clear plan and records that show progress. Ask them what they would accept; don't assume.
- Passing it down the chain. If you're a subcontractor, the main supplier may require you to meet whatever they promised the buyer.
How to read the requirement
- Mandatory or desirable? A mandatory pass/fail requirement is different from a scored question.
- Certificate or evidence? Some wording asks you to hold certification; some asks you to demonstrate controls.
- Which scope? Does it have to cover the service you'd deliver?
- What's the date? A certification body awards certificates after audits, and that takes time, so a tight deadline may rule out starting from scratch.
If it's unclear, ask the buyer through the tender's clarification process. Public sector buyers expect questions, and asking is not a sign of weakness. Our guide to what to do when a tender asks for ISO 27001 has the steps.
What to show if you don't have a certificate yet
Nothing here is a guarantee, but a few things generally help your case:
- A defined scope for the service you'd deliver.
- A risk register with named owners, so you can explain what you've chosen to protect and why.
- Approved policies that match how you actually work.
- Evidence of regular tasks: access reviews, supplier checks, incident records.
- A named person responsible, and senior people involved.
The point isn't to impress. It's to know your risks, so your answers are specific and true, and so the business doesn't depend on one person's memory.
Questions people ask
Does ISO 27001 guarantee we'll win? No. Buyers score on many things, and security is one of them.
Is ISO 27001 the same as Cyber Essentials? No. They're different schemes with different scope and depth.
Can software get us certified? No. Certification is awarded by an accredited certification body. Software and advisers can help you prepare.
How ClearIMS helps
ClearIMS helps organisations build and run an ISO 27001-aligned ISMS. Once AI drafting is activated for your organisation, the AI drafts your scope, risk register, Statement of Applicability and policies for review; a named person approves every record, and the AI never approves anything. When a buyer sends a security questionnaire, ClearIMS can import it, assign sections to the people who know the answers and draft answers from your approved records, with sources. The auditor portal gives your external auditor scoped, read-only access through a link that expires. We make the software: your certificate is yours, awarded by your certification body.
Have a tender in front of you? Book a 20-minute call or try the demo company to see a set-up ISMS first. More for your sector: public-sector suppliers, NHS suppliers and ISPs and altnets.