security and preparedness in procurement

Security and preparedness in procurement means that a contracting authority can set requirements that make society less vulnerable, for example on information security, ownership and security of supply in a crisis. In Norway, this has been stated explicitly in Section 5d of the Public Procurement Act since 1 July 2026. The rule gives the authority an option, not a duty.

How does security and preparedness in procurement work?

Section 5d of Norway's Public Procurement Act states that the contracting authority may set requirements or criteria at every stage of a procurement process to safeguard security and preparedness. The authority should consider such requirements where relevant. Security and preparedness has also been added to the Act's purpose clause (Section 1). The aim is to raise awareness among contracting authorities, not to introduce new duties. The rule is part of the Act's new chapter on societal considerations.

The authority can use the rule in several ways:

• Qualification requirements: for example requirements on the supplier's information security.
• Technical specifications: for example on confidentiality, operational reliability or where data is stored.
• Award criteria: where good preparedness can earn points.
• Contract performance conditions: for example a duty to report changes in the supply chain or ownership, emergency stocks or delivery guarantees in a crisis.
• Design of the competition: for example lots or parallel framework agreements, so the authority does not depend on a single supplier.

The authority can also ask who owns the supplier. Exclusion on grounds of ownership may follow from the Norwegian sanctions rules (regulation on restrictive measures).

There is a limit. EU and EEA law still applies, so security and preparedness cannot be used to shield Norwegian suppliers from European competition. Requirements must respect non-discrimination and proportionality, and follow the fundamental principles in Section 4 of the Act. Defence and security procurement is not covered by § 5d. In the EU, such contracts follow Directive 2009/81/EC; in Norway they follow chapter 9 of the Security Act and the regulation on defence and security procurement.

An example: An IT company bids to operate a clinical system for a Norwegian hospital. The tender asks for an overview of owners and subcontractors, ISO 27001 documentation and a description of how operations continue during a major power outage. The company has all of this ready and uses it as a competitive advantage.

Why does security and preparedness matter for suppliers?

Expect more questions about ownership, subcontractors, data storage and security of supply, especially in health, energy, ICT and utilities. Have the documentation ready before the tender arrives: certifications such as ISO 27001, a contingency plan and an overview of your supply chain. That way you avoid searching at the last minute.

The rule is also linked to the climate requirements. Under § 5b, the authority can make exceptions from climate requirements when they come at the expense of essential interests in health, security or preparedness. Read more in our blog post on new Norwegian procurement rules from 1 July 2026. Tools like Cobrief help you see which security requirements a tender sets before you start on the bid.

Frequently asked questions

Must the contracting authority set security and preparedness requirements?

No. Section 5d is a "may" rule. The authority should consider such requirements where relevant, but has no duty to set them.

Does the rule apply to all procurements?

It applies to procurements covered by the Norwegian Public Procurement Act, which means from the minimum value threshold of NOK 500,000. Defence and security procurement has its own rules.

Can I be excluded because my company has foreign owners?

Not simply because the owners are foreign. Requirements must be objective and proportionate. Exclusion on grounds of ownership can still happen when sanctions rules require it.

In short: security and preparedness is now a visible part of Norway's Public Procurement Act. For suppliers, it means good documentation on security and delivery capability becomes a bigger part of the bid.