Development of a Cybersecurity Checklist Model Applicable to Public ICT Procurement

Abstract

Public procurement of Information and Communication Technology (ICT) plays a central role in the administrative modernization and in the implementation of digital policies in the Brazilian State. The growing dependence on complex technological services and the high financial volume involved make this field particularly sensitive to failures in planning, control, and performance evaluation. This study analyzed recurrent weaknesses in public ICT procurement, especially regarding the definition of metrics, the measurement of results, and the verification of technical compliance, with the objective of developing an information security checklist as a guiding and decision- support instrument for public ICT procurement involving cybersecurity-related aspects. To this end, rulings of the Federal Court of Accounts (TCU) were analyzed, and interviews were conducted with specialists in ICT governance and oversight, whose findings were compared with the guidelines set forth in Law No. 14,133/2021, in Normative Instruction No. 94/2022/MGI, in national and international frameworks, and in the TCU Public Procurement Governance Framework. The results revealed gaps in planning and contractual control processes, allowing the consolidation of the findings into a structured model based on technical and operational verification criteria in checklist format. It is concluded that the proposed instrument provides systematic support to public managers in the effective incorporation of cybersecurity controls into ICT procurement, contributing to the strengthening of regulatory compliance, transparency, and governance maturity in the public sector.