German public tenders for backup storage are shaped by three things: procurement law that decides the procedure, standard contract terms that most public buyers use for IT, and security references that turn up in almost every specification. A municipality, a university hospital or a federal agency buying a backup target has to describe what it needs in a product-neutral way and award on published criteria. Backup storage offers differ in ways that are easy to miss on paper, so the wording of the specification largely decides the outcome.
This post outlines the rules and thresholds, the contract framework and the security references, and then looks at how to write backup storage requirements that can be evaluated. It is a general overview and not legal advice.
Which rules apply
Above the European thresholds, procurement follows part four of the Act against Restraints of Competition (GWB) and the Procurement Ordinance (VgV). Below them, federal authorities apply the UVgO, and the federal states apply it in their own versions or through state procurement laws. From 1 January 2026 the thresholds for supplies and services are 140,000 euros for the supreme and higher federal authorities and 216,000 euros for all other contracting authorities, including states and municipalities.
| Element | What applies | Relevance to a backup storage purchase |
|---|---|---|
| Above threshold | GWB part four and VgV, Europe-wide publication | Larger platforms and multi-year contracts including support |
| Below threshold | UVgO or state rules | Most single-site backup targets for smaller bodies |
| Contract terms | EVB-IT standard terms | Purchase, maintenance and system contracts for IT |
| Security baseline | BSI IT-Grundschutz | Backup concept, system hardening, documentation |
| Sector rules | Critical infrastructure and NIS2 obligations where applicable | Evidence of backup management and recovery |
The value compared with the threshold is the estimated total over the contract term, including hardware, licences, support and planned capacity extensions.
EVB-IT: the contract framework
Public buyers in Germany usually contract for IT on the basis of the EVB-IT, supplementary contract terms for the procurement of IT services that were drawn up by the public sector in coordination with industry. Budget rules point public bodies to them, and they take effect when they are agreed in the contract. There are several types. A hardware purchase is typically placed under EVB-IT Kauf, and a solution that the supplier delivers as an integrated, working system under the EVB-IT system contract, with separate types for services and maintenance.
The choice matters for backup storage. Under a purchase contract the supplier owes delivery of a product. Under a system contract it owes a functioning whole, including integration with the backup software and an acceptance test. A buyer who expects the supplier to prove a successful backup and restore before acceptance needs the contract type and the specification to say so.
Security references in the specification
The reference that appears most often is BSI IT-Grundschutz, the federal security methodology. Its module on the backup concept treats backup as a documented concept covering scope, frequency, storage location, restore authority and restore testing. Federal authorities work to it as a baseline, and many states, municipalities and public companies do the same. Operators of critical infrastructure and organizations covered by the NIS2 implementation law, in force since 6 December 2025, have their own duties to demonstrate backup management.
A specification that only says the solution must conform to IT-Grundschutz gives bidders nothing to answer and evaluators nothing to score. It works better to translate the reference into behavior: the storage has its own administrative accounts independent of the directory service, protected backups cannot be deleted before the retention period ends, and administrative actions are logged in a form that can be exported. Backup audit evidence shows which records later audits will ask for.
Product-neutral requirements that still discriminate
German procurement law requires specifications to be product-neutral. Naming a manufacturer or a proprietary feature is allowed only in narrow cases. The answer is to specify open interfaces and measurable properties. For a backup target that means an S3-compatible interface with the Object Lock functions the backup software uses, as opposed to a vendor's own protocol. Platform-neutral backup storage explains why that also protects the buyer when the backup software or the hypervisor changes during the contract.
Capacity is the second trap. Offers quote raw capacity, usable capacity or effective capacity after assumed data reduction, and the three can differ by a wide margin. The specification should ask for usable capacity after protection overhead and require bidders to state any reduction ratio separately, as set out in comparing usable backup capacity. Immutability is the third: a retention lock that an administrator can lift is not equivalent to one that nobody can, a distinction covered in Object Lock governance versus compliance mode.
Award criteria and proof
The contract goes to the most economically advantageous tender, which does not have to mean the lowest price. Buyers can weight cost over the contract term alongside quality criteria such as restore performance, expandability without replacement and the security properties above. Each criterion needs a method of proof: a manufacturer's declaration, a reference installation, a measured value from a test setup or a demonstration during evaluation. Criteria without a stated proof tend to be scored on the confidence of the bidder's prose.
Where ARTESCA fits
ARTESCA is object storage software used as a backup target. It is deployed in the customer's own data center as a software appliance on industry-standard x86 servers or as a pre-configured hardware appliance in all-flash or hybrid configurations. It provides an S3 interface with S3 Object Lock, and in compliance mode no account, including ARTESCA administrators, can remove a lock before it expires. Those are properties that can be written as neutral requirements and verified in a test.
The repository has its own administrative accounts, separate from the backup server and the production directory. ARTESCA grows within the same deployment from roughly 50 TB to 8.5 PB, which supports a criterion on expansion without replacement, and it is used as a target for Veeam and other backup software.
Before publication
A useful final check is to read the draft specification as a bidder with a weaker product would. Wherever a requirement can be met with a yes and no evidence, add the proof that is expected. Wherever a requirement names a standard without saying which behavior is meant, replace it with the behavior. The tender that results is easier to answer, easier to score and harder to challenge.