Research · TED, the EU's procurement portal · observed 12 September 2026

ISO 27001 in EU public tenders, 2026

Name: ISO 27001, SOC 2, NIS2 and ISO 9001 mentions in EU public procurement notices, by month and by buyer country
Creator: StandardOS
License: https://creativecommons.org/licenses/by/4.0/

The number: 3,405 procurement notices published on TED in the 365 days to 12 September 2026 name ISO 27001. 104 name SOC 2. 32.7 times as many.
Where: Germany 1,539, Poland 835, Greece 213; the top fifteen buyer countries are charted below, all 32 are in the CSV.
What counts: A notice that contains the string anywhere, in any field, counted once: a mention, not a requirement. The same rule for every term, so the ratio holds even where the count does not.
Re-run it: One POST per term to api.ted.europa.eu/v3/notices/search with the query below; no key, no account. The by-country and by-month series were observed on 12 September 2026 and 14 September 2026.

By month: notices naming ISO 27001

Twelve complete months, 3,406 notices, and the month in progress drawn lighter. Hover a column for the month's total and share.

By buyer country: the top fifteen

Notices naming ISO 27001 in the 365 days to 12 September 2026, by the buyer's country. Hover a bar for the share of the country's notices.

The table

Notices per month naming each term, with every notice published in the month
Month	All notices	ISO 27001	SOC 2	NIS2	ISO 9001
Sept 25	73,110	244	6	36	1,408
Oct 25	84,104	294	5	50	1,592
Nov 25	69,253	268	8	41	1,383
Dec 25	78,161	312	7	42	1,523
Jan 26	71,738	258	9	58	1,147
Feb 26	69,570	248	9	49	1,298
Mar 26	81,132	287	8	78	1,546
Apr 26	77,691	301	9	59	1,445
May 26	70,596	300	6	51	1,365
Jun 26	78,480	343	19	53	1,458
Jul 26	84,237	309	12	40	1,511
Aug 26	66,281	242	4	38	1,437
Sept 26in progress	33,077	113	4	15	615

TED's public API

Method

The query: (FT~"ISO 27001" OR FT~"ISO/IEC 27001" OR FT~"ISO27001") AND publication-date>=<365 days before the observation>POST to api.ted.europa.eu/v3/notices/search with fields: ["publication-number"], limit: 1; the answer's totalNoticeCount is the figure. By month, the date clause is the month's first and last day; by country, buyer-country=<alpha-3> is added. The scripts are scripts/ted-monthly.mjs and scripts/ted-by-country.mjs in the StandardOS repository.
The spellings: ISO 27001: ISO 27001, ISO/IEC 27001, ISO27001. SOC 2: SOC 2, SOC2. NIS2: NIS2, NIS 2. ISO 9001: ISO 9001, ISO9001. A notice matching any spelling of a term counts once for that term.
What a mention is not: A requirement. The string may sit in a selection criterion, a technical specification, a bidder's own description or a boilerplate clause; TED's full-text search does not say which. "Named in N notices" is defensible; "required by N tenders" is not.
Countries: EU-27 plus Norway, Iceland, Liechtenstein, Switzerland and the United Kingdom, by the buyer's country as TED records it, which is who buys and not where the work is done. The United Kingdom has published almost nothing to TED since 2021.
Drift: The rolling 365-day count and the sum of twelve calendar months differ by a few notices because the windows differ by a few days; both are printed with their observation date. The month in progress is partial by construction.

Cite this

StandardOS (2026). ISO 27001 in EU public tenders, 2026: 3,405 notices in the 365 days to 12 September 2026 against 104 for SOC 2, from TED's public API. https://getstandardos.com/research/eu-tenders-iso-27001-2026. CC BY 4.0.

The article behind it

The data is CC BY 4.0: use it, link here. Corrections: contact.

ISO 27001 or SOC 2 in Europe ISO 9001 in EU public tenders, by country The ISO 27001 hub