Earlier this year, we asked organisations working across cyber security procurement and service delivery a straightforward question: what makes the process harder than it needs to be?
The people who responded did not give us vague complaints. They shared detailed examples of where procurement can create problems for buyers and suppliers alike.
Cyber security is difficult to buy well. Procurement teams are expected to compare specialist services, technical claims, professional credentials and organisational assurance, often without the technical context they need. We wanted to understand where things were going wrong, acknowledge the experience people had shared with us and do something useful with it.
Poorly defined scopes make fair comparison difficult
Poorly written tender scopes came up repeatedly. If a tender does not clearly explain the assets involved, the outcome required, the constraints or the expected depth of work, suppliers have little choice but to fill in the gaps themselves. The bids may all answer the same question on paper, but they can be based on completely different assumptions, prices and levels of effort.
That is bad for buyers as well as suppliers. It becomes almost impossible to compare bids fairly, and problems can emerge after the contract is awarded because the buyer and supplier were never working from the same understanding in the first place.
Evidence requirements can be difficult to satisfy
We also heard how difficult it can be to provide the references and project evidence requested in a tender. Cyber security work is often confidential. A supplier may have exactly the right experience but be unable to name the client or share enough detail to satisfy a rigid evidence requirement. Buyers are right to ask for evidence, but the request has to reflect the reality of the work. Where a conventional client reference is not possible, there should be room for other credible ways to demonstrate experience and capability without compromising confidentiality.
“Restrictive accreditation requirements are only one example of how procurement wording can unintentionally disadvantage capable suppliers. The cyber security industry also faces challenges around unrealistic reference requirements, despite the confidential nature of security testing work, and poorly defined scopes that make it difficult for buyers to compare suppliers on a genuine like-for-like basis. Fair procurement depends on clear requirements, proportionate evaluation criteria and recognition of the different routes through which organisations can demonstrate competence and capability.”
Requirements are not always proportionate or clear
Certification requirements were another source of frustration. Buyers need confidence in the organisation they appoint and the people who will deliver the work. But long lists of overlapping credentials do not automatically provide better assurance, particularly when it is unclear what each one is meant to prove. Organisational assurance and individual competence are both important, but they are not the same thing. Tender wording needs to be clear about which is required, who it applies to and how it relates to the work being bought. Otherwise, capable suppliers and professionals can be excluded by requirements that add complexity without adding meaningful assurance.
“There is often ambiguity between company and individual certifications. Customers are not always clear on whether they want the company to be aligned to a standard, or every person working on the project.”
Buyers may be purchasing compliance rather than the outcome they need
Several contributors told us that organisations sometimes buy a cyber security service because an insurer, auditor or internal process requires them to show that a test has taken place. The conversation can quickly become about finding the cheapest or quickest way to tick that box, rather than understanding the risk and choosing the assessment that will genuinely help. A vulnerability scan, a penetration test and a broader security exercise are not interchangeable. Good procurement starts with the problem the organisation needs to solve and the outcome it needs to achieve. The technical approach should follow from that, with appropriate input from people who understand the work.
“Buyers will commonly state how long they think an assessment should take.”
Feedback and transparency matter
Writing a serious tender response takes time. When the only feedback is a generic score or a few standard sentences, suppliers learn very little from the process and may be left wondering how the decision was reached. Clear criteria and useful feedback are not an optional courtesy. They help suppliers improve and give buyers a stronger, more defensible decision-making process. Turning feedback into practical action We did not want to collect this feedback, agree that the problems were frustrating and leave it there. It helped us create The Cyber Scheme’s Procurement Fairness and Framework Review initiative.
Our reporting tool gives suppliers, professionals, buyers and other stakeholders somewhere to share procurement wording or requirements that may restrict participation, overlook legitimate assurance routes or create barriers without a clear technical or regulatory reason. This is not about naming and shaming procurement teams or framework owners. It is about building a clearer picture of the problems people are encountering and using that evidence to encourage procurement that is fair, proportionate and focused on genuine capability.
We are grateful to everyone who trusted us with their experience. Their feedback has shaped both this work and the practical resources we are developing next. If you have seen procurement wording or requirements that do not look right, tell us. You can submit the detail, anonymously if you prefer, through our Procurement Fairness and Framework Review reporting tool below.
What happens next?
Download our free Buyer Checklist
Ten practical questions to help produce clearer requirements, support fair competition and improve procurement outcomes. Download the checklist here.
Report a concern
Have you encountered procurement wording or requirements that create unnecessary barriers or overlook legitimate assurance routes? Tell us through our Procurement Fairness and Framework Review initiative.