ISO 27001 (information security)

The demand curve

Notices demanding it per 10,000 published, by year — rate-normalised so corpus growth never masquerades as demand. Complete years only.

The pale bars are 2025 onward. The Procurement Act went live on 24 February 2025 and changed how notices are written, so the step across that date is partly a change in convention and not only a change in demand. We have not measured how much of it is which, so please do not read this as a trend.

The receipts

Notices that demand it, and the sentence each demand was found in. Nothing is counted here without one.

• Under Vehicle Inspection Equipment 2026mandatory

  Driver and Vehicle Standards Agency

  Cyber Security - ISO27001 and Cyber Essentials Plus where applicable (Must Have)

• Hydrocarbon Oil Analysismandatory

  HM Revenue & Customs

  The service provider must possess, or be able to demonstrate, working towards achieving the current ISO/IEC 9001:2015, ISO/IEC 27001:2022, and ISO/IEC17025 certification, accredited by UKAS or a comparable body.

• Telephonymandatory

  THE EXTRACARE CHARITABLE TRUST

  The supplier shall hold ISO 27001 (preferred) or Cyber Essentials Plus certification at the time of bidding and maintain certification for the duration of the contract.

• Natural History Museum - Bulk Storage Solutionmandatory

  Natural History Museum

  Any supplier would need to be certified to ISO27001 and Cyber Essentials Plus.

• North and East Digital Twinmandatory

  NETWORK RAIL INFRASTRUCTURE LIMITED

  Compliance with Network Rail’s information and cyber security standards, as well as relevant industry standards (e.g., ISO 27001, GDPR), is mandatory.

• Data Protection Officer as a Servicemandatory

  The Police and Crime Commissioner for Humberside

  We also require security certification at both ISO 27001 and Cyber Essentials Plus levels, and staff security clearance must conform to BS7858:2019.

• VantageRE - ICT & Telephony Tendermandatory

  Vantage RE Limited

  In particular, ISO 27001 certification is a mandatory requirement for all responding vendors.

• Wasabi - off-site object storagemandatory

  Brighton & Hove City Council

  The service must integrate with our existing Veeam infrastructure, provide a minimum of 600TB storage, and comply with UK GDPR and ISO 27001 standards.

• Risk Management System Projectmandatory

  Royal Berkshire Fire and Rescue Service

  12.1 Security: Must comply with ISO 27001 and UK Cyber Essentials standards.

• Security Operations Centre (SOC) and Managed Detection Response (MDR) Servicesmandatory

  Associated British Ports

  The supplier should be able to provide physically present forensic support at our group or port locations (within the UK) to assist with a major incident within 4 hours.The security partner must demonstrate having audited security standards in place including ISO 27001.

• Firewall Support and Maintenancemandatory

  THE UNIVERSITY OF CHICHESTER

  The University is amongst the first of HEIs to achieve institution wide ISO27001, and also has Cyber Essentials and Cyber Essentials Plus Accreditation, where this is required (with additional security protocols) for Defence Contactor work.

• ISO Corporate Compliance - F03mandatory

  Ministry of Defence

  DE&S ISO/IEC 27001:2022 - currently certified to ISO/IEC 27001:2013 (to implement on expiry of existing contract which expires in July 2026).

See it live

2 open tenders demand ISO 27001 (information security) right now.