SectorsIT
Tenders in IT
In IT tenders, information security weighs heavily. You deliver not only software or a service, you often also get access to data of the buyer and of the people it serves.
What buyers ask for
- The BIODutch government organisations work with the Government Information Security Baseline (BIO). The renewed BIO2 was published in September 2025 and is based on ISO/IEC 27001:2022 and 27002:2022. Suppliers of products and services to government have to meet BIO requirements, depending on the risk and the type of service.
- ISO 27001An ISO 27001 certificate is the usual way to show that your information security is in order. Look at the scope: does your certificate cover the service the contract asks for? And if it says only “ISO 27001” without “or equivalent”, ask about it. Read selection criteria and knock-outs.
- GDPR and data processing agreementIf you process personal data for the buyer, the buyer signs a data processing agreement with you. The buyer stays responsible for what it outsources, so it asks about your security measures, your sub-processors and where the data is stored.
- Purchasing termsIT contracts come with their own general terms, such as the Dutch central government terms for IT contracts (ARBIT), in the ARBIT-2022 version since September 2022. Read the terms before you decide. Liability and intellectual property can be a reason for a question, or for a no-bid.
In a private tender
At a company, an IT process often starts with an RFI or a demo. Users want to see that it works, the IT department wants to know how it fits with what is already there, and procurement wants the cost over the whole term. Read RFI, RFP and RFQ and the decision-making unit.
How Atvalio helps
Atvalio reads the documents, knows your company and helps you write. You decide and you submit. In this sector that looks like this:
- UnderstandSecurity requirements, certificates with their scope, privacy requirements and the terms in one list, with the page.
- DecideA recommendation that sets the requirements and terms against your certificates and your risks.
- AskA question for the clarification round about “or equivalent”, the scope of a certificate or liability.
- WriteYour answers per award criterion from your profile: your architecture, your security and your implementations.
- CheckA simulated committee reads along, and Atvalio checks that every requested piece of evidence, such as a statement or certificate, is attached.
What often goes wrong
- Fictional exampleA certificate with the wrong scopeA software company holds an ISO 27001 certificate, but its scope covers only the development team and not the hosting the contract asks for. The buyer asks for the certificate including its scope, and the company does not meet the requirement. Atvalio sets the scope from your profile against what the contract asks and flags the gap.
Read on
- Selection criteria and knock-outs: read them, challenge them, or team up
- Instructions, specifications and clarification questions: how to influence a public tender
- RFI, RFP and RFQ: what is the difference, and what do you do with them?
- Bid or no bid: when should you tender, and when not?
- Price and quality calculator
ATVALIO TENDERS
Atvalio Tenders is in development. On the waiting list, you can be the first to start a 14-day trial on a real tender.
Want Atvalio to do this for you?
Sources
Rules and certificates change. Always check what the documents of your tender say. Most sources are in Dutch.