May an ISO 27001 information security certificate be required in service procurement?

Decision number:

2026/UH.I-1513

Decision date:

26 June 2026

Public Procurement Board decision No 2026/UH.I-1513 establishes that an ISO 27001 Information Security Management System certificate may not be required as a qualification criterion at the bidding stage in service procurement, including call centre services in which personal and corporate data are processed.