Do suppliers need Cyber Essentials or equivalent certification?

The council's procurement pages advise following applicable security requirements in each tender; a specific mandatory certification such as Cyber Essentials is not specified on the cited procurement page and will be stated in individual tenders if required.

Who enforces cybersecurity clauses in a council contract?

The council's Commercial/Procurement team together with the contract manager enforce contract terms; incident reporting and enforcement routes are set out in the contract and on procurement pages.

How do I report a suspected data breach in a council contract?

Report immediately to the council contract manager and to the council's information governance or data-protection contact as specified in the contract; the procurement pages signpost contacts for contractual matters.

Cardiff Cybersecurity Procurement Rules & Supplier Duties

Technology and Data Wales 4 Minutes Read · published February 12, 2026

Cardiff, Wales requires suppliers to meet procurement and information-security expectations when contracting with the council. This guide summarises the council's procurement standards as published on its official procurement pages, explains supplier duties and typical contractual remedies, and shows practical steps for compliance, incident reporting and appeals. Where the council's published pages do not state specific penalties or forms, this article notes "not specified on the cited page" and points to the enforcing office and how to contact them. Suppliers and procurement officers should follow both Cardiff Council rules and applicable national security guidance when preparing bids or delivering services.

Standards & Supplier Duties

Cardiff's procurement framework requires suppliers to deliver goods and services in accordance with contract terms, with particular attention to data protection, confidentiality and secure handling of information. The council directs suppliers to its procurement pages for governing procedures and contact details for the Commercial/Procurement team; see the council procurement pages for full procedural text and officer contacts.Cardiff Council procurement pages^[1]

Suppliers must follow contract clauses and information-security obligations set out in each procurement contract.

Penalties & Enforcement

The council enforces contract compliance primarily through contractual remedies and administrative action rather than by fixed municipal fines on cybersecurity matters. Specific monetary fines, if any, or daily penalty rates for cybersecurity breaches are not specified on the cited procurement page; contractual consequences and remedies are governed by the contract terms and Cardiff Council procurement rules.^[1]

Monetary penalties: not specified on the cited page; may be set by contract or by civil claim.
Escalation: first breach typically triggers rectification notices; repeat or continuing breaches can lead to termination or damages — specific escalation steps not specified on the cited page.
Non-monetary sanctions: contract termination, suspension of supply, requirement to remediate, audit rights, and withholding of payments where allowed by contract.
Enforcer and complaints: the Council's Commercial/Procurement team and the contract manager enforce procurement clauses; contact details and procedures appear on the council procurement pages.^[1]
Appeals and review: contractual disputes are resolved per the contract dispute clause or via statutory appeals in the courts; time limits for appeals or notices are governed by the contract — specific statutory time limits are not specified on the cited page.
Defences and discretion: suppliers may rely on "reasonable excuse", force majeure or approved variances where permitted by the contract; specific allowed defences are defined in each contract.

If you suspect a breach, notify the council contract manager and follow the contract's incident-reporting steps immediately.

Applications & Forms

The council publishes procurement notices, tender documents and supplier registration information via its procurement pages and advertised tenders; specific mandatory forms and submission portals depend on the tender (IT security questionnaires, supplier declarations or data-processing agreements may be required). The procurement pages list how to access tender documents and supplier registration; where a named form is required, its title and submission route are provided within the tender documents rather than on a single static page.^[1]

Supplier registration and tender submission: see the tender pack for each opportunity (forms vary by contract).
Deadlines: set per tender advertisement; missed deadlines normally mean rejection of the tender.
Fees: tenders and standard procurements typically do not require a fee to submit; any fees will be stated in the tender documents.

Tender documents are the authoritative source for required forms, fees and deadlines for each procurement.

Common Violations and Typical Remedies

Failure to protect personal data: remedial action, audit, and possible contract suspension.
Unauthorised subcontracting or disclosure: contractual breach notices and potential termination.
Failure to report security incidents: requirement to remediate under contract and escalate to council information governance.

FAQ

Do suppliers need Cyber Essentials or equivalent certification?: The council's procurement pages advise following applicable security requirements in each tender; a specific mandatory certification such as Cyber Essentials is not specified on the cited procurement page and will be stated in individual tenders if required.^[1]
Who enforces cybersecurity clauses in a council contract?: The council's Commercial/Procurement team together with the contract manager enforce contract terms; incident reporting and enforcement routes are set out in the contract and on procurement pages.^[1]
How do I report a suspected data breach in a council contract?: Report immediately to the council contract manager and to the council's information governance or data-protection contact as specified in the contract; the procurement pages signpost contacts for contractual matters.^[1]

How-To

Review the tender documents for specific cybersecurity and data-protection obligations and required forms.
Complete any security questionnaires, provide requested certifications, and include clear subcontractor arrangements.
Implement incident-detection and reporting procedures aligned with the contract and notify the council immediately if an incident occurs.
Keep records of compliance steps and remediation actions to evidence reasonable steps taken if a dispute arises.

Maintaining evidence of patched systems, access logs and incident reports helps if a contractual breach is alleged.

Key Takeaways

Check each tender's documents for specific cybersecurity requirements and required forms.
Contractual remedies are the council's primary enforcement tool; specific fines for cybersecurity are not listed on the procurement page.
Contact the council Commercial/Procurement team and the contract manager for enforcement, reporting and clarification.

Help and Support / Resources

[1] Cardiff Council procurement pages