Procuring Exponential in the public sector
This section is for procurement officers, project managers and the specialists who sit on an evaluation panel in a
public body: a ministry, an agency, a council, a school board. It answers the questions a public procurement of a web
content management system raises, from the first requirement to the end of the contract, and it says for each one
what Exponential's own documentation can prove. The facts come from the standards pages in doc/eng-us/standards/, the
installation book in doc/eng-us/install/, the partner and hosting sections of this help, and SECURITY.md.
Note This section describes features and common practice; it is not legal advice. Public procurement is governed by the law and the rules of your organization. Check them with your procurement and legal counsel.
Contents
- What you are buying
- The parts of this section
- Reading order
- What the repository can and cannot evidence
- Related pages
What you are buying
Exponential itself is free software under the GNU General Public License, version 2 or any later version (Licensing questions). There is no license fee to compare. What a public body procures is everything around it:
| You may procure | From whom | Where this help describes it |
|---|---|---|
| Implementation: content model, design, templates, migration | an implementation partner or agency | Implementation partners |
| Hosting and operations | a hosting company, or your own data center | Hosting companies: start here |
| Support with agreed response times | 7x or a partner | Getting support, Support levels and response times |
| Training for editors and administrators | a training partner or your own trainers | Course catalogue |
| Accessibility or security assessments | an independent assessor | Accessibility standards, Security standards |
Because the software is the same whoever supplies the services, a public body can change its supplier without changing its system. That is the strongest argument against lock-in, and the exit-plans part of this section shows how to keep it true in the contract.
The parts of this section
| Part | It answers |
|---|---|
| Requirements | How to write verifiable requirements for a public CMS, and which evidence the repository provides for each |
| Tender templates | Clause text for a tender or request for proposal, with placeholders to adapt |
| Evaluation | Checklists, scoring sheets, demo scripts, a proof-of-concept plan and reference checks |
| Total cost of ownership | A cost model with categories and worked examples whose figures are all labeled example assumptions |
| Exit plans | How to plan the end of a contract: export formats, handover, transition and clauses against lock-in |
| Training | A training plan for a public body, built on the trainer courses of this help |
| Lifecycle | Release policy, supported versions, PHP support and how to plan upgrades in a budget |
Reading order
- Start with Requirements: a tender is only as good as its requirements.
- Turn them into clauses with the Tender templates.
- Prepare the panel with Evaluation before the bids arrive.
- Compare bids on Total cost of ownership, not on the first-year price.
- Write the Exit plan before you sign, not when the contract ends.
- Budget Training and the Lifecycle of the product for the whole term.
The checklists "Before a tender" and "Before signing" in the government checklists section sum up each stage on one page.
What the repository can and cannot evidence
Evaluation panels often ask for documents that a commercial vendor produces. The Exponential project publishes its evidence in the repository instead, and says plainly where something is missing:
| Question | What exists | What does not exist |
|---|---|---|
| Accessibility | Accessibility standards: WCAG 2.2 AA Partly complies for the admin4 and admin4l administration; EN 301 549 and Section 508 Unverified | No VPAT or Accessibility Conformance Report; public site designs not audited; no accessibility statement template |
| Security | Security standards: OWASP Top 10 mapping, three documented hardening passes, tamper-evident audit trail | No OWASP ASVS assessment; no external penetration test report in the repository; no security.txt shipped |
| Privacy | Privacy standards: consent records, erasure on account removal, log masking and retention | No single "export all my data" function; no cookie consent banner |
| Vulnerability handling | SECURITY.md: private reporting, first answer within one business day | No published fix-time commitment; fixes arrive as the next release |
| Release policy | Source control and releases: permanent tags, changelogs | Commits and tags are not signed |
| Service levels | none from the project; partners and hosts publish their own | The project publishes no SLA (SLA options for hosting) |
Ask bidders to supply the missing pieces as part of their offer (for example an accessibility audit of the site they build) rather than expecting them from the open source project.
Related pages
- Government: start here (the landing page of this help section)
- Licensing questions: the GPL and Exponential
- Who is 7x? and Who is the Exponential Foundation?
- Partners: start here
- Free documentation: this page is free to copy, translate and improve under the GNU FDL 1.3.
Become an Exponential Partner
Partners share their information, provide funding, contribute back and develop the products with us, and that is how Exponential grows. A partner website and dashboard are planned for mid-2027: please become a partner today to speed up our growth rate and land new features faster.