Cybersecurity and Public Procurement in Colombia: Requirements You Must Meet

A mid-sized technology company in Cali had spent years selling to private clients without much fuss about security requirements. When it entered its first bid with a public entity, it found a list of requirements in the bidding document it had never needed before: a current ISO 27001 certification, evidence of a business continuity plan, and a signed declaration of Law 1581 compliance. It had to withdraw from that specific bid — not for lack of technical capability, but for lack of documented preparation.

It's a story that repeats constantly. Public procurement in Colombia has been layering in increasingly specific cybersecurity requirements, and businesses that don't anticipate them get eliminated before their technical or financial proposal is even evaluated.

The underlying reason sits in the same place that explains much of the regulatory tightening of recent years: CONPES 3995, the national digital trust and security policy, explicitly identified the need to strengthen cyber risk management in strategic sectors — and the public sector, which handles information for millions of citizens and operates critical infrastructure, is one of the central focuses of that strategy. A technology vendor with weak controls isn't just a risk to itself; it becomes an entry point into the public entity that hired it.

There's no single format — each entity and contract type sets its own requirements — but these appear over and over:

Current certifications, mainly ISO 27001, though larger technology contracts may also require complementary certifications depending on the type of service.

Evidence of Law 1581 compliance, especially in contracts where the vendor will access or process citizens' personal data.

Documented business continuity plans, particularly when the contracted service is critical to the entity's operations.

Liability insurance covering cyber incidents, increasingly common in higher-value contracts.

Security incident history, in some cases used as part of the risk evaluation criteria for the bidder.

Incident response capability, sometimes required as a specific technical annex within the proposal.

Most businesses that lose out for this reason aren't lacking capability — they start preparing once the bid document is already published, and by then it's too late. Certifications like ISO 27001 realistically take six to twelve months. No public entity is going to extend a bidding timeline so a bidder can finish getting certified.

The right way to approach this is to treat it as a strategic growth investment, not a reactive task tied to a specific opportunity. If contracting with public entities is part of your medium-term business strategy, preparation needs to start before the first concrete opportunity even appears.

Businesses that prepare seriously to meet public procurement requirements end up, almost as a side effect, with a considerably more mature cybersecurity posture than those that never go through this exercise. The requirements the state demands aren't arbitrary — they largely reflect what any business should have in place regardless of whether it's pursuing public contracts or not.