French public tenders for backup storage follow the public procurement code, and the way a requirement is written decides which products can answer and how they are compared. A hospital, a town hall or a regional agency cannot simply choose the system its administrators prefer. It has to describe the need in functional terms, pick a procedure that matches the value of the purchase and award on criteria announced in advance. For backup storage, where the difference between offers lies in details such as immutability and usable capacity, the quality of the specification matters more than the procedure.
This post explains the procedures and thresholds that apply, the reference texts that tender documents cite and how to write backup storage requirements that can be evaluated fairly. It is a general overview and not legal advice.
Thresholds and procedures
The Code de la commande publique sets three tiers for supplies and services. Below 60,000 euros excluding tax, a contract can be awarded without advertising or prior competition. From that amount up to the European thresholds, the buyer uses an adapted procedure, known as a MAPA, whose rules it largely defines itself. Above the European thresholds, a formal procedure applies, most often an open or restricted call for tenders. The European thresholds for supplies and services are 140,000 euros for central state authorities and 216,000 euros for local authorities and public health establishments.
| Estimated value, excluding tax | Procedure | What it means for a storage purchase |
|---|---|---|
| Below 60,000 euros | No advertising or competition required | Small sites and capacity extensions; the buyer still has to choose sensibly and avoid splitting purchases |
| 60,000 euros to the European threshold | Adapted procedure (MAPA) | Typical for a first backup target in a mid-sized body |
| Above 140,000 or 216,000 euros | Formal procedure, such as an open call for tenders | Multi-site platforms and multi-year contracts with support |
| Any value, through a central purchasing body | Order from an existing catalogue | The competition has already been run by the purchasing body |
The value to compare with the thresholds is the whole need over the contract period, including hardware, software, support and planned extensions. A five-year view of that total is set out in building a multi-year backup storage budget.
Buying through a central purchasing body
Many French public bodies buy IT equipment through UGAP, the general public purchasing agency. Because UGAP has already run the competition for its catalogue, a buyer that orders through it is exempt from running its own advertising and competition. The route is fast, and it shifts the work: the buyer no longer writes a tender, but it still has to check that the catalogue item meets its technical need. A backup target ordered on capacity alone can turn out to lack the immutability mode or the performance the backup design assumed.
The reference texts tender documents cite
Specifications for backup infrastructure in the French public sector usually refer to a small set of texts. The national cybersecurity agency's guide on the fundamentals of backup is the most common. Its recommendations include three copies with at least one offline, backup systems that authenticate independently of the production directory, and regular restore tests. The general security framework known as RGS binds administrative authorities to analyze risks and accredit their systems. Bodies that host health data on behalf of others add the certification for health data hosts, which lists backup as one of its covered activities. Where a cloud service is involved, state doctrine on sensitive data and the national cloud security qualification come into play.
Citing a guide is not the same as specifying a requirement. A clause that says the solution must comply with the national agency's recommendations cannot be scored. A clause that says the storage must refuse deletion of a protected backup by any account until its retention period ends can be tested during evaluation.
Writing requirements that can be compared
Public procurement rules require technical specifications to be written in terms of performance or function, without naming a brand except where unavoidable and then with the words "or equivalent". For backup storage, four areas benefit from precise wording. Capacity should be stated as usable capacity after protection overhead, with the assumptions about data reduction made explicit, as discussed in comparing usable backup capacity. Immutability should name the mechanism and the mode, because guarantees differ, as what Object Lock actually guarantees explains. Compatibility should name the backup software in use and ask for evidence of validation. And restore performance should be requested as a measured figure for a defined workload.
Award criteria deserve the same care. Price alone favors the offer with the least protection. Criteria that weight total cost over the contract period, restore performance and the security properties above produce a comparison closer to what the body actually needs. Comparing backup storage offers in procurement gives a structure for that comparison.
Sovereignty clauses
French tenders increasingly ask where data is held and who can access it. For a backup target installed in the buyer's own premises, the answer is short, and the remaining questions concern the supplier's remote support access and any telemetry the system sends. Asking for those to be documented, and for remote access to be off by default, turns a general concern into a checkable requirement.
Where ARTESCA fits
ARTESCA is object storage software used as a backup target. It is deployed in the customer's own premises, either as a software appliance on industry-standard x86 servers or as a pre-configured hardware appliance in all-flash or hybrid configurations. Immutability is provided by S3 Object Lock, and in compliance mode no account, including ARTESCA administrators, can remove a lock before it expires, which is a property an evaluation committee can test.
The repository has its own administrative accounts, separate from the backup server and the production directory. ARTESCA grows within the same deployment from roughly 50 TB to 8.5 PB and is used as a target for Veeam and other backup software.
Before the tender is published
The most useful preparation is to write down what a successful restore looks like for the body's most important system, then check that each requirement in the draft specification contributes to it. Clauses that only repeat the title of a guide can be replaced with the behavior the guide is asking for. The result is a tender that suppliers can answer precisely and that the evaluation committee can score without argument.