Castilla-La Mancha’s €72.2m cyber tender resets the field
Spain’s biggest cyber procurement sits in a thinly contested market, while Poland’s uKSC pipeline is producing low-bid-count opportunities for qualified suppliers.
Castilla-La Mancha has put €72.2m behind telecommunications and cybersecurity services, despite Spain accounting for 12 notices in this window. The buyer, Secretaría General de la Consejería de Hacienda, Administraciones Públicas y Transformación Digital de Castilla-La Mancha, is using its CiberReg initiative to build cyber-resilience through awareness, skills and a training laboratory. For suppliers, that makes this more than a connectivity requirement: it is a route into a regional capability programme.
The window contains 165 cybersecurity notices from 151 buyers across 19 countries. The Spain tender is the standout disclosed opportunity, but the sharper bid decision is geographic: Poland produced 70 notices at 2.1 bids on average, while Spain’s 4.3 and France’s 5 point to a materially more contested proposition.
Where this market is going
Cybersecurity’s coverage-neutral share is now 5.49%, a rise of 0.78 percentage points. The monthly path is lumpy rather than steady: 4.46% in 2025-09 rose to 4.98% in 2025-10, then fell through 4.4% in 2025-11 and 4.25% in 2025-12. It recovered to 4.44% in 2026-01, 4.71% in 2026-02, 4.78% in 2026-03 and 5.03% in 2026-04.
Momentum then accelerated to 5.84% in 2026-05 and 6.1% in 2026-06, before dropping to 5.55% in 2026-07 and recovering to 5.87% in 2026-08. That pattern supports pursuing active requirements, but not treating the current share as evidence of a smooth expansion in underlying demand.
Cybersecurity: share of all classified public IT tenders
Share, not volume. Monthly, last 12 complete months.
Where the tenders were published
Notices by buyer country, 7 days to 2026-09-28.
How hard the competition is
The 52 awards measured show 2.6 bids on average, but the country split is the commercial signal. Poland sits at 2.1 bids, Czechia at 2.7 and Germany at 3.5; Spain reaches 4.3 and France 5. In France and Spain, assume that technical differentiation and demonstrable delivery quality decide whether a bid gets through a crowded field, even though price is the stated award criterion in 70 notices and quality in 16. In Poland and Czechia, the constraint is more likely to be qualification, credible staffing and delivery capacity than price alone.
This is not a market dominated by wide-open contests. Single-bid awards account for 54%, while SMEs are the winning bidder in 84%. Incumbency, local eligibility and the ability to mobilise matter more than a blended bid average suggests. A large supplier should use its references to clear qualification barriers; an SME should not assume that low bid counts mean an easy price-led sale.
How these contracts are awarded
Stated award criterion, for the tenders that declared one.
What is driving it
Poland’s uKSC is the immediate procurement trigger, cited in 34 tenders in this window. The amended act creates national cybersecurity requirements across covered sectors and a registration route for key and important entities, so it is producing both product procurement and compliance work. Its tender references reached 273 in the latest 30 days, against 227 in the previous 30 days. Elsewhere, NIS2 held at 3 references in both periods; DPM 2.0 moved to 2 from 0; CBAM moved to 1 from 0; and DORA fell to 0 from 1.
The next compliance-led cyber work sits in financial data and identity controls. The Solvency II Review requires revised reporting and risk frameworks to be transposed by 29 January 2027 and applies from 30 January 2027. Bank Account Registries and BARIS require national mechanisms capable of identifying account holders, with expanded register scope applying from 10 July 2027 and Commission interconnection due by 10 July 2029. The EU AML Package also applies from 10 July 2027. These are chiefly compliance and integration programmes, but they create product demand where access control, identity verification, auditability and protected data exchange are in scope.
Regulations named in live tenders
Tenders citing each framework, last 30 days.
The calendar ahead
| Date | Framework | Milestone | Where |
|---|---|---|---|
| 2027-01-29 | Solvency II Review (Directive 2025/2) | transposition deadline | EU |
| 2027-01-30 | Solvency II Review (Directive 2025/2) | applies from | EU |
| 2027-07-10 | Bank Account Registries + BARIS (AMLD6 2024/1640 art. 16) | applies from | EU |
| 2027-07-10 | EU AML Package (AMLR 2024/1624 + AMLA 2024/1620) | applies from | EU |
What shifted this week
Demand by type of work, against its own 12-week average
Percentage difference from the same vertical’s recent baseline.
Whose technology is being named
Fortinet is named in 7 notices across 2 countries, 27% above its 12-week average of 5.5. Check Point is the stronger upward mover, appearing in 5 notices across 4 countries, 107% above its 12-week average of 2.4. Those are openings, particularly where buyers are refreshing security estates and support arrangements. Cisco appears in 1 notice in 1 country, against a 12-week average of 1.3, but has no calculated movement figure in the data.
Palo Alto Networks is the displacement story: 1 notice in 1 country, 59% below its 12-week average of 2.4. Put Fortinet’s 7 notices beside the named Castilla-La Mancha telecommunications and cybersecurity tender, but do not mistake that for evidence of a Fortinet role: the tender record does not name a vendor. Fortinet does have a product-level public-sector signal at Bracknell Forest Borough Council, where the researched notice names FortiGate firewalls, switches, support and subscriptions. Repeat demand is also concentrated: Miejskie Wodociągi i Kanalizacja w Bydgoszczy appears in 5 tenders and Nemocnice TGM Hodonín in 4, making both useful accounts for partner and renewal mapping.
Vendors named in this window’s tenders
Notices naming each vendor, with movement against the same vertical’s 12-week average.
Who is buying repeatedly
| Tenders | Buyer | Country | Example |
|---|---|---|---|
| 5 | Miejskie Wodociągi i Kanalizacja w Bydgoszczy - spółka z o.o. | PL | Poland – Computer equipment and supplies – Dostawa, wdrożenie, uruchomienie, konfiguracja urządzeń będących el |
| 4 | Nemocnice TGM Hodonín, příspěvková organizace | CZ | Czechia – Software package and information systems – Zvýšení kybernetické bezpečnosti Nemocnice TGM Hodonín – |
| 2 | Національний Банк України | UA | Програмна продукція для моніторингу, керування та забезпечення безпеки IT-інфраструктури з функцією керування |
| 2 | Instytut Chemii Bioorganicznej Polskiej Akademii Nauk, Poznańskie Centrum Superkomputerowo-Sieciowe | PL | Poland – Software package and information systems – Przedmiotem zamówienia jest modernizacja systemu zabezpiec |
| 2 | Compras de la Corporación de Radio y Televisión Española S.A. | ES | Spain – Software-related services – Mantenimiento y suscripción de licencias antivirus |
| 2 | HLAVNÍ MĚSTO PRAHA | CZ | Czechia – Information systems and servers – Zajištění obnovy licencí pro technologii Rapid7 |
| 2 | Gmina Miejska Dzierżoniów | PL | Dostawa urządzeń informatycznych: stacja robocza 2 szt., monitor zakrzywiony 4 szt., tablet polowy 1 szt. |
| 2 | Державна податкова служба України | UA | Послуга з проведення авторизації з безпеки інформаційно-комунікаційної системи «Автоматизована система роботи |
An organisation running several tenders in one window is usually working through a programme rather than buying once.
The biggest tenders
The disclosed values cover only the 52 notices that published a value in EUR, not the size of the market. Castilla-La Mancha leads with €72.2m for telecommunications and cybersecurity services linked to CiberReg. Clean Hydrogen Joint Undertaking has a €15m managed IT services framework for itself and other EU Joint Undertakings, covering IT operations and cybersecurity services. SAS pass Culture is buying a €7m remote identity-verification solution; SURF B.V. has a €6.89m Security Incident Response 2.0 framework, fitting its security support role for Dutch education and research; and Sociedad Andaluza para el Desarrollo de las Telecomunicaciones has a €2.64m framework for an advanced protection solution.
Values as published by the buyer, for the 52 of 165 tenders in this window that stated one in EUR.
Deadlines worth watching
Who won
Suppliers with the most awards this window
Awards published in the window, by named winner.
Sources consulted
Pages the writer read for context while drafting this column. The figures above come from the notices, not from these.
Bid teams should prioritise Polish uKSC accounts where qualification can suppress competition, while treating Castilla-La Mancha and the financial-regulatory calendar as longer-cycle pursuits requiring a partner, delivery and compliance story before the formal procedure starts.
Method
Built from 165 public procurement notices published between 2026-09-21 and 2026-09-28, classified into the Cybersecurity vertical. Every figure on this page is computed from those notices; the commentary is written around them. Sources: bzp, ted, prozorro. Tenders featured in earlier editions of this column are excluded from the named lists above.
Frequently Asked Questions
What is cybersecurity’s current share of procurement notices?
Cybersecurity represents 5.49% of the classified corpus, up 0.78 percentage points.
Which countries have the most competitive cybersecurity bids?
France averages 5 bids and Spain 4.3, compared with Germany at 3.5, Czechia at 2.7 and Poland at 2.1.
How much disclosed cybersecurity tender value is in the window?
The 52 notices publishing EUR values account for €108.6m, with a median value of €512,500.
