Key data
| Regulation | Resolution 307/38331/2026, of June 25, CESTIC — Permanent Procurement Board |
|---|---|
| Publication | August 1, 2026 |
| Effective date | August 2, 2026 |
| Affected parties | Technology companies bidding on ICT contracts with the Ministry of Defense |
| Category | Public Sector — ICT Procurement |
| Legal basis | Law 9/2017, on Public Sector Contracts |
| Applicable security policy | DEF/807/2024 (files with classified information) |
Technology companies competing for contracts with the Ministry of Defense have had a formal and permanent contact point since August 2, 2026: the CESTIC Permanent Procurement Board. The Resolution 307/38331/2026, published in the BOE on August 1, 2026, formalizes this body that the Law 9/2017 on Public Sector Contracts already required to be established. It is not a change in prices or specifications: it is a change in who decides and how they decide.
For any company already bidding or wanting to enter the Defense ICT procurement market, knowing the composition and operating rules of this board is as important as knowing the award criteria.
What does this regulation establish?
The resolution formally establishes the Permanent Procurement Board of the General Subdirectorate of ICT Procurement of CESTIC (Center for Systems and Information and Communications Technologies), an organization dependent on the Ministry of Defense. Its function is to evaluate offers and propose the award of ICT contracts processed by this center.
Board composition:
| Role | Profile / Requirement |
|---|---|
| President | Position from the General Subdirectorate of ICT Procurement of CESTIC |
| Legal member | Representative with legal profile — mandatory presence to hold sessions |
| Audit member | Audit representative — mandatory presence to hold sessions |
| Members (x2) | Two additional members |
| Secretary | Mandatory presence to hold sessions |
Operating rules:
- The board is composed of 6 members: president, four members and secretary.
- For a session to be valid, absolute majority of its members is required.
- Mandatory attendance at every session: the president, the secretary, the legal member and the audit member.
- Remote meetings are permitted, provided that the identity of participants and real-time interactivity are guaranteed.
- Files containing classified information shall be processed in accordance with the security policy DEF/807/2024.
Economic and operational impact
This resolution does not directly modify prices, fees or budgets of Defense ICT contracts. Its impact is procedural and strategic: it determines who evaluates the offers and under what validity guarantees.
For bidding companies, the most relevant operational effects are:
- Greater predictability: Being a permanent board, evaluation criteria and decision-maker profiles are stable between bids. This reduces uncertainty about who evaluates the offers.
- Remote sessions: The board can meet remotely, which can speed up the resolution timelines for bids. Fewer delays due to in-person availability requirements.
- Strict quorum: The mandatory presence of the legal member and audit member reinforces legal control and economic control in each award. Companies can expect greater rigor in document review.
- Classified files: If a company bids on contracts involving classified information, the procedure is governed by the DEF/807/2024 policy, with additional security requirements.
Who does it affect?
- Technology companies (hardware, software, telecommunications, cybersecurity, systems integration) that bid or want to bid on contracts with CESTIC of the Ministry of Defense.
- ICT consulting firms with service contracts in the Defense sector.
- Companies participating in JVs (Joint Ventures) for Defense ICT bids.
- Providers of communications solutions and technology infrastructure for the Army, Navy or Air Force.
- Advisors and public procurement departments of technology sector companies with presence in the defense market.
Practical example
A cybersecurity company submits an offer for a CESTIC network monitoring services contract. Once the deadline for submitting offers has closed, the Permanent Procurement Board convenes a session to evaluate the proposals.
For that session to be valid, at least four of the six members (absolute majority) must be present, and among them mandatory the president, the secretary, the legal member and the audit member. If the audit member cannot attend in person, the board can meet remotely as long as their identity and real-time participation are guaranteed.
If the contract includes access to classified information systems, the company must demonstrate compliance with the requirements of the DEF/807/2024 policy before the board can submit the award proposal.
What should companies do now?
- Identify if CESTIC is a current or potential client. Review your public contract portfolio and your bidding pipeline. If CESTIC appears as the contracting authority, this board is who will evaluate your next offers.
- Update your security clearance file. If you bid on contracts that may involve classified information, verify that your company meets the requirements of the DEF/807/2024 policy before submitting an offer.
- Review the administrative documentation of the bid. With a permanent board and strict quorum, formal errors in documentation have less room for correction. Make sure your legal and economic documentation is up to date.
- Prepare for participation in remote sessions. If you are called to public acts for opening offers or boards, keep in mind that they can be held in remote format. Check that you have the necessary technical means.
- Follow CESTIC publications on the Public Sector Procurement Platform. The establishment of this board may be accompanied by new ICT bids. Set up alerts for the CESTIC contracting authority.
Frequently asked questions
What is CESTIC and what contracts does it manage?
CESTIC (Center for Systems and Information and Communications Technologies) is the organization of the Ministry of Defense responsible for the department's technology purchases: hardware, software, telecommunications, cybersecurity and ICT infrastructure for the Armed Forces. Its General Subdirectorate of ICT Procurement processes and awards these contracts, and it is precisely this subdirectorate that now has a formalized Permanent Procurement Board.
When does the CESTIC Permanent Procurement Board come into effect?
The CESTIC Permanent Procurement Board comes into effect on August 2, 2026, one day after its publication in the BOE (August 1, 2026), according to Resolution 307/38331/2026 of June 25.
How many members does the board have and who must always be present?
The board is composed of 6 members: a president, four members and a secretary. For a session to be valid, absolute majority (at least 4 members) is required and the presence of the president, the secretary, the legal member and the audit member is mandatory. The absence of any of these four invalidates the session.
What happens if the contract involves classified information?
Files containing classified information are processed in accordance with the security policy DEF/807/2024. Bidding companies must demonstrate compliance with the requirements of this policy before the board can submit the award proposal. If your company does not have appropriate security clearance, it will not be able to participate in this type of contract.
Can the board meet by videoconference or remotely?
Yes. The resolution expressly allows remote meetings, provided that the identity of all participants and real-time interactivity are guaranteed. This can speed up the evaluation and award timelines for CESTIC ICT contracts.
Official source
Consult complete regulation in official source
Notice: This article is for informational purposes only and does not constitute legal advice. For specific decisions, consult a qualified professional. Source: https://www.boe.es/diario_boe/txt.php?id=BOE-A-2026-16812