Requirements for a public-sector CMS
This section is for procurement officers, project managers and subject experts who write the requirements of a tender for a web content management system. Each page gives requirement wording you can adapt, explains what makes it verifiable, and names the Exponential documentation that answers it, with the status words of the standards pages and the gaps they list. The clause texts that go into the contract itself are in the tender templates.
Pages in this section
| Page | Answers |
|---|---|
| How to write verifiable requirements | How do I phrase a requirement that bidders can prove and evaluators can check? |
| Functional requirements for a public-sector CMS | Which editing, approval, permission, search, form and multisite functions should I ask for? |
| Accessibility requirements | How do I cover the public site, the administration and authoring support for WCAG 2.2 AA, EN 301 549 and Section 508? |
| Security requirements | What do I ask about sign-in, access, headers, logging, updates and disclosure? |
| Privacy and data protection requirements | Which privacy features can software provide, and what stays with us? |
| Language and multilingual requirements | How do I specify official languages, right-to-left scripts and administration languages? |
| Hosting and data location requirements | How do I specify where data lives, backups, recovery and outbound connections? |
| Integration and API requirements | How does the CMS connect to directories, apps, records systems and log platforms? |
| Operations and monitoring requirements | What day-to-day running do I specify, and which tools should a supplier use? |
| Records and audit requirements | How do we prove who published what, and hand records to an archive? |
| Support and maintenance requirements | Who supports an open source CMS, and what can a supplier promise? |
| Open source and licensing requirements | How do I require open source, source delivery and rights to custom work? |
| Exit and portability requirements | How do I keep the freedom to leave a supplier or the product? |
| Mapping requirements to evidence | Where exactly is the evidence for each requirement area, and what is its status? |
| What Exponential can and cannot evidence | Which proofs exist, which do not, and how do I treat each gap? |
Reading order
- Start with How to write verifiable requirements.
- Write the functional requirements, then the quality areas: accessibility, security, privacy, languages.
- Add the service areas: hosting, operations, support, records.
- Finish with licensing and exit, which protect you for the whole life of the contract.
- Before publishing the tender, check every requirement against Mapping requirements to evidence and What Exponential can and cannot evidence, so that no "must" excludes every honest bidder.
Conventions on these pages
- Requirement identifiers (
ACC-01,SEC-03...) are examples; renumber them for your tender. - Values in angle brackets (
<time>,<country>) are yours to fill. This help never suggests figures. - Status words (Complies, Partly complies, Unverified, Does not comply) are copied from the standards pages and must not be upgraded.
Related pages
- Procurement
- Tender templates
- Governments: start here (
government-start-here.md, the landing page of this section) - Standards
- Free documentation: this page is free to copy, translate and improve under the GNU FDL 1.3.
Become an Exponential Partner
Partners share their information, provide funding, contribute back and develop the products with us, and that is how Exponential grows. A partner website and dashboard are planned for mid-2027: please become a partner today to speed up our growth rate and land new features faster.