If you sell to public buyers in Germany or Poland, ISO 27001 is named routinely: 1,548 and 829 tender notices over the last 365 days, seven in ten of every mention across Europe. If you sell to public buyers in France, Spain or Italy, it is named rarely, in fewer than one notice in a thousand, even though those three publish more notices than Poland. Greece names it in about 2% of everything it buys, the highest share of any country. The source is TED, the EU's own procurement portal, the query is below, and the numbers are mentions, not requirements.
This continues the count that compared ISO 27001 with SOC 2, which answered "which standard" for Europe as a whole. This one answers "where".
The table
Full-text mentions of ISO 27001 (all three spellings) in TED notices published between 3 September 2025 and 3 September 2026, by the buyer's country. "Notices" is everything that country's buyers published in the same window, and "share" is the first as a percentage of the second. SOC 2 and NIS2 are counted the same way, for the same window.
| Buyer country | Notices | Naming ISO 27001 | Share | SOC 2 | NIS2 |
|---|---|---|---|---|---|
| Germany | 166,430 | 1,548 | 0.93% | 48 | 89 |
| Poland | 127,606 | 829 | 0.65% | 19 | 149 |
| Greece | 10,255 | 211 | 2.06% | 1 | 4 |
| Romania | 45,630 | 116 | 0.25% | 0 | 28 |
| Belgium | 20,620 | 98 | 0.48% | 6 | 68 |
| Hungary | 11,181 | 84 | 0.75% | 0 | 19 |
| Bulgaria | 30,859 | 71 | 0.23% | 0 | 1 |
| Spain | 73,048 | 58 | 0.08% | 1 | 26 |
| Slovenia | 12,983 | 50 | 0.39% | 0 | 0 |
| Netherlands | 23,570 | 48 | 0.20% | 7 | 41 |
| Italy | 38,185 | 47 | 0.12% | 1 | 10 |
| France | 93,027 | 45 | 0.05% | 2 | 27 |
| Norway | 12,975 | 40 | 0.31% | 4 | 3 |
| Slovakia | 10,230 | 32 | 0.31% | 0 | 1 |
| Czechia | 53,828 | 27 | 0.05% | 0 | 56 |
| Finland | 16,011 | 25 | 0.16% | 0 | 5 |
| Croatia | 17,664 | 23 | 0.13% | 11 | 23 |
| Sweden | 23,577 | 15 | 0.06% | 1 | 3 |
| Denmark | 8,580 | 10 | 0.12% | 2 | 13 |
| Latvia | 19,578 | 9 | 0.05% | 0 | 0 |
| Austria | 13,209 | 8 | 0.06% | 0 | 8 |
| Ireland | 11,844 | 5 | 0.04% | 0 | 10 |
| Luxembourg | 2,961 | 4 | 0.14% | 0 | 1 |
| Portugal | 18,776 | 4 | 0.02% | 0 | 3 |
| Cyprus | 2,298 | 3 | 0.13% | 0 | 0 |
| Switzerland | 12,162 | 3 | 0.02% | 0 | 0 |
| Estonia | 8,042 | 1 | 0.01% | 0 | 3 |
Lithuania, Malta, Iceland and Liechtenstein published notices in the window and none named ISO 27001. The United Kingdom published 165 notices to TED, one of which did; since 2021 UK tenders go to its own Find a Tender service, so TED says almost nothing about the UK.
Across all of them: 3,415 notices naming ISO 27001, out of 906,049 published. That is 0.38% of European public procurement, which is a small share of everything and a large absolute number for one certification.
Three readings
Volume is Germany and Poland. Between them, 2,377 of the 3,415 mentions. A German public body names ISO 27001 in roughly one notice in a hundred, and it publishes 166,000 notices a year, so the absolute number is unmatched. Poland's share is lower but its volume is the second largest in Europe. If your customers are public bodies in either country, this is the certificate their procurement asks about by name, and a supplier without it is answering a question rather than ticking a box.
Share is Greece, then Germany, Hungary and Poland. Greece names ISO 27001 in one notice in fifty, more than twice any other country's rate. Germany follows at just under one in a hundred, then Hungary and Poland. For a smaller market, share is the more useful figure: it says how likely a given tender is to raise the question, whatever the market's size.
France, Spain and Italy are the surprise, and it is probably a naming effect rather than an absence of security requirements. France published 93,000 notices and named ISO 27001 in 45. Spain, 73,000 and 58. Italy, 38,000 and 47. All three have national schemes that public buyers can reference instead: France has SecNumCloud and the ANSSI qualifications, Spain has the Esquema Nacional de Seguridad, Italy has ACN's cloud qualification. A French tender that requires SecNumCloud is asking for security assurance without ever writing "ISO 27001", and this count cannot see it. So the honest reading is not "French public buyers do not care about security" but "French public buyers name their own scheme", and a vendor selling there should expect the national one to come up first.
What NIS2 adds
NIS2 mentions follow a different geography. Poland leads with 149, then Germany 89, Belgium 68, Czechia 56 and the Netherlands 41. Czechia names NIS2 twice as often as it names ISO 27001, and Belgium nearly as often, which fits the timing: Belgium transposed the directive among the first, in 2024, Czechia's new cybersecurity act followed in 2025, and procurement language follows national law. Where a country's NIS2 count is climbing and its ISO 27001 count is flat, the practical question for a supplier is whether one management system answers both, which is what the NIS2 mapping is for.
SOC 2 is close to absent everywhere. Germany's 48 is the most any country manages, and twenty-four of the thirty-two countries have zero or one. Nothing in European public procurement expects a SOC 2 report.
What the numbers are and are not
They are counts of notices in which the string appears anywhere, for any reason. A buyer describing its own certification counts the same as a buyer requiring a supplier's. The comparison between countries holds, because the method is the same for each, but the absolute number overstates how many tenders make the certificate a condition.
"Buyer country" is where the contracting authority sits, not where the work is done. A German ministry buying software from a Dutch vendor is a German notice.
TED carries tenders above the EU thresholds. Below-threshold buying stays on national portals, and for smaller countries that is most of it. The shares above describe the above-threshold slice only.
The window is 365 days ending on the day of observation, and the snapshot is dated. Re-run it next month and every number moves a little.
What it means if you are deciding whether to certify
If the buyers you want are public bodies in Germany, Poland, Greece, Belgium or Hungary, the question is settled by the market: they name ISO 27001 by the hundred, and the cost of getting there is fixed by ISO/IEC 27006 and known in advance. If they are in France, Spain or Italy, ask which national scheme the tender references, and expect ISO 27001 to be the useful foundation for it rather than the thing named. If they are private companies anywhere, this count does not describe them, and their security questionnaires do: answering those from the management system is where the certificate pays back between audits.
The same count for ISO 9001, with the notices that name both standards, is the companion piece.
Run it yourself
The endpoint is api.ted.europa.eu/v3/notices/search. It takes an expert query string and needs no credentials. For Germany:
(FT~"ISO 27001" OR FT~"ISO/IEC 27001" OR FT~"ISO27001")
AND buyer-country=DEU
AND publication-date>=20250903
Read totalNoticeCount from the response, then drop the first clause for the denominator. The country codes are ISO 3166-1 alpha-3. Our script, scripts/ted-by-country.mjs, does exactly this for 32 countries and is in the open; if your numbers differ from ours, yours are the more recent ones.