Government Web Development for Public Bodies and State-Owned Companies

Q: Does the website supplier need certified information security?

In Spain, the National Security Framework (ENS), Royal Decree 311/2022, sets the security measures for systems that serve the administration and also applies to the companies that provide services to it: tenders require it. The MEDIUM and HIGH categories require certification by an accredited body. Kiwop has been certified in the ENS medium category since September 2026, and in ISO/IEC 27001, the security standard recognised across Europe.

We build, migrate and maintain websites and platforms for public organisations: accessible to the EN 301 549 standard behind the EU rules on public sector web accessibility, secured under Spain’s National Security Framework (ENS) and ISO/IEC 27001, both of which we are certified in, built on open source, and without losing a single URL when it is time to upgrade. Fifteen barcelona.cat websites and the website of the Generalitat de Catalunya’s public energy company back it up.

Discuss My Project See What We Do

15 barcelona.cat websites built and migrated to Drupal 10
ENS Medium category, certified in 2026
RELI Registered as a bidder in Catalonia since 2019

01 · Requirements What the business needs
02 · Architecture Documented decisions
03 · Code Reviewed and tested
04 · Deployment Automated and reversible
05 · Performance Core Web Vitals in the green
06 · Evolution Your team asks, we deliver
Every metric sets the next iteration

Scroll

Definition

What Is Government Web Development?

It is the design, development and maintenance of websites, portals and platforms for public administrations, agencies and state-owned companies, with the requirements the law places on them and that a private website does not have: mandatory accessibility, security that can be evidenced, transparency, several official languages and procurement through public tenders.

Across the EU, public sector websites and apps must meet accessibility requirements based on the harmonised standard EN 301 549, which formally references WCAG 2.1 level AA. In Spain these rules are set out in Royal Decree 1112/2018, and the security of systems that serve the administration is governed by the National Security Framework (ENS), Royal Decree 311/2022, which also applies to the companies that provide services to it.

Summary

Executive Summary

What a public body expects from whoever builds its website, and how we deliver it.

A public website cannot afford what a private one sometimes gets away with: a screen reader that cannot get through it, a migration that breaks links that have sat in bulletins and search engines for years, or a supplier who is the only one who knows how to publish. That is why the bar is not only technical. It means tested accessibility, security that can be evidenced in a tender, open source the organisation can take to another supplier, and communications teams who publish on their own.

We have done it at scale. For four years we built and maintained fifteen websites for the Barcelona Institute of Culture within barcelona.cat (festivals, museums and participation bodies) and migrated them from Drupal 7, 8 and 9 to Drupal 10, keeping content and URLs. And we built the Laravel website of L’Energètica, the Generalitat de Catalunya’s public energy company, with a transparency portal, public-sector job listings and an ethics channel in four languages, under a contract awarded in December 2023.

We work with the same controls public administrations require: since September 2026 we have been certified in Spain’s National Security Framework (medium category), ISO/IEC 27001 and ISO/IEC 42001, and we have been listed in Catalonia’s official register of tenderers since 2019. We bid for public contracts and write the technical proposal with the people who draft the specifications in mind.

15 barcelona.cat websites
D7→D10 Migration with content and URLs
3 Certifications: ENS, ISO 27001 and ISO 42001

What's included

What a Public Website Has to Meet

The requirements we check on every project, from the tender specifications to maintenance.

WCAG 2.2 AA accessibility, which covers the WCAG 2.1 AA that EN 301 549 points to, checked by hand with a keyboard and a screen reader
Accessibility statement in line with EN 301 549, published and kept up to date with every change to the site
Security in line with the ENS: personal access, activity logs, backups, patches and vulnerability management
Open source: Drupal, Laravel or the stack the organisation sets, with the code and data in its hands
Several official languages per site, with translation workflows the communications team controls
Transparency, public-sector jobs and ethics channel, with roles that separate what each department publishes
Migrations without losing URLs: inventory, redirects and verified content before the old version is switched off
Traceable deployments: configuration in git and a pipeline, nothing changed by hand in production
Editorial autonomy: content manual and training so day-to-day work does not depend on the supplier

Key points

What We Do for Public Bodies

Six kinds of project we see in administrations, consortia and state-owned companies.

01
Institutional and Public Venue Websites

Websites for city councils, agencies, museums, festivals and public services, with content types designed for the people who publish every day. Inside the organisation’s corporate platform when there is one, as we did with the barcelona.cat profiles and themes, not against it.
02
Estates of Many Websites

When an organisation runs dozens of sites, the challenge is making sure none falls behind on versions. The same deployment recipe, the same component base and the same accessibility and security bar for all of them. We explain it in Drupal development.
03
Version and Platform Migrations

From Drupal 7, 8 or 9 to Drupal 10, or from an unsupported CMS to a supported one. An inventory of what exists, migration of content and URLs, redirects and checks before the switch. That is what we did with the fifteen ICUB websites.
04
Accessibility and Accessibility Statements

WCAG 2.2 AA audit, fixes in the code (no overlays) and an accessibility statement in line with EN 301 549. If this is all you need, see web accessibility.
05
Custom Platforms for State-Owned Companies

When a CMS is not enough: admin panels with roles per department, public-sector recruitment with applications and documents, an ethics channel with full history, and data coming from the organisation’s own systems. Like the L’Energètica website in Laravel.
06
Maintenance and Ongoing Security

Patches, backups, monitoring and enhancements, with a visible record of every intervention. We cover it in website maintenance and, if the organisation needs to run its own security management system, in Nexo SGSI.

Why

Public Procurement: We Bid for Public Contracts

What technical specifications ask for and what we bring to the proposal.

Most public projects come through a tender. We have been listed in the Register of Tendering Companies of Catalonia (RELI) since November 2019 and have an active registration in SAM.gov, the US federal procurement system. Public website tenders tend to ask for the same things: technical capability backed by comparable projects, a team with defined profiles, an accessibility plan, certified information security (in Spain, the ENS is a standard requirement) and a transition plan for taking over and handing back the service. We write the technical proposal answering those criteria point by point, with real projects behind it, not a template. If your organisation is drafting the specifications, we can also tell you what is reasonable to ask for.

technical-proposal.yaml

# What we evidence in a proposal

security:

ens: medium category, certified

iso_27001: certified

accessibility:

target: WCAG 2.2 AA (EN 301 549)

registers:

- RELI (Catalonia), since 2019

- SAM.gov (United States)

transition:

code, data and access belong to the client

Medium ENS
Since 2019 RELI
WCAG 2.2 AA Accessibility

How we work

How We Work

From the tender or the first meeting to a website the organisation runs on its own.

01
Inventory

A census of what exists before touching anything: websites, versions, modules, content, URLs, integrations, access and who publishes what. Without an inventory, a public migration loses links.
02
Architecture and Accessibility by Design

Content types, roles per department, languages and templates designed to meet WCAG 2.2 AA from the first component, not patched at the end.
03
Development and Migration

Configuration versioned in git, deployments through a pipeline, content migrated with its URLs and redirects for whatever changes. Every delivery is checked with a keyboard and a screen reader.
04
Go-Live

The old version keeps running until the switch. We check content, links and forms before and after, with a rollback ready.
05
Training and Autonomy

Content manual and editor training, so the communications team can publish without depending on us. And maintenance, if the organisation wants it.

Who it is for

Is It for You?

It fits when the website is a public service and has to comply with the law, not just work.

Who it's for

City councils, regional bodies and public agencies with websites to migrate or rebuild.
State-owned companies and consortia that need transparency, public-sector jobs and an ethics channel on their website.
Organisations with many sites (venues, festivals, museums) left on unsupported versions.
Departments preparing a website tender who want a supplier with certified security and comparable public projects.
Public sector bodies that must meet the accessibility requirements of EN 301 549 and do not know where they stand.

Who it's not for

Contracts that only look for the lowest price for a template: our proposal rests on real accessibility and migrations that lose nothing.
Projects that require the HIGH category of Spain’s National Security Framework: today we are certified in the MEDIUM category.
Organisations that only want a one-off accessibility audit: our web accessibility service is a better fit.

Deliverables

What We Deliver

What stays in the organisation’s hands at the end.

Included

Website or platform in production, with code and configuration in the organisation’s repository
WCAG 2.2 AA accessibility report and accessibility statement in line with EN 301 549
Map of migrated URLs and redirects for those that change
Deployment pipeline and technical documentation
Content manual and editor training
Transition plan so another supplier can take over if the organisation decides to

Not included

Hosting, third-party licences and domain certificates (quoted separately or provided by the organisation)

The proof

Public Projects That Back It Up

For four years we built and maintained fifteen websites for the Barcelona Institute of Culture on barcelona.cat: the city’s festivals, its museums and its participation bodies, in Catalan, Spanish and English. We migrated the estate from Drupal 7, 8 and 9 to Drupal 10 keeping content and URLs, republished 22 virtual exhibitions of the Municipal Archive and trained the communications teams to publish on their own. For L’Energètica, the Generalitat de Catalunya’s public renewable energy company, we built a custom Laravel website between 2024 and 2025, with a transparency portal under Catalan Law 19/2014, public-sector recruitment, an ethics channel and four languages; since 2026 another provider has hosted it and it is still online with our code, which is exactly what a public body should be able to do. On accessibility, the Fundació Ampans portal meets WCAG 2.1 AA.

15 barcelona.cat websites built and migrated
22 Virtual exhibitions republished in Drupal 10
4 Languages on the L’Energètica website
2009 Building websites since

For the CTO

Summary for the Technical Lead

How we build it under the hood.

In Drupal we work with configuration exported to git and pipeline deployments (GitLab CI in the ICUB case, with DDEV local environments), so a structural change is reviewed and deployed, never edited by hand in production. The same recipe serves fifteen websites. Version migrations start with an inventory of modules, themes and URLs, and content is migrated with its paths; anything that changes gets its redirect.

Accessibility is tested on every delivery with axe-core and by hand with a keyboard and a screen reader, because automated tools only detect part of the barriers. Security follows the controls we are certified for under the ENS: personal key-based access for each engineer, credentials in an encrypted vault, verified backups, patches driven by security advisories and a log of every intervention. For high-volume multilingual websites, translation can be AI-assisted while preserving HTML and links, as at L’Energètica, with the original always left untouched.

Technologies

Drupal 10
Laravel
PHP 8.3
MySQL
PostgreSQL
Redis
Twig
GitLab CI/CD
DDEV
axe-core

Versioned configuration and pipeline deployments
Migrations with a prior inventory, preserved URLs and redirects
Accessibility tested on every delivery, automated and manual
Personal access, encrypted credentials and an intervention log
Code and data owned by the organisation, no supplier lock-in

Risks and how we cover them

The Risks We Avoid

What we find when an inherited public website lands on our desk.

01
A migration that breaks links from bulletins, search engines and other websites

Mitigation
A URL inventory before we start, content migrated with its paths and a redirect for everything that changes, checked before the old version is switched off.
02
Websites stuck on an unsupported version

Mitigation
A single deployment recipe and an update schedule for the whole estate, so no site falls behind.
03
Accessibility that passes on launch day and erodes with use

Mitigation
Accessible components by default, checks on every delivery and editor training on what depends on them: alternative text, headings and documents.
04
Being tied to a supplier who is the only one who knows how to publish

Mitigation
Open source, code and data owned by the organisation, documentation and a transition plan. L’Energètica changed provider in 2026 and its website still works.

Technologies

Technologies and Standards

What we use to build and test public websites.

Drupal 10
Laravel
PHP
Symfony
MySQL
PostgreSQL
Redis
GitLab CI/CD
WCAG 2.2
EN 301 549
WAI-ARIA
axe-core
ENS
ISO/IEC 27001

FAQ

Government Web Development FAQs

What communications and IT leads ask us.

What accessibility rules apply to public sector websites in the EU?

EU rules on public sector web accessibility require websites and apps of public bodies to meet the harmonised standard EN 301 549, which formally references WCAG 2.1 level AA; in Spain they are set out in Royal Decree 1112/2018. We audit and build against WCAG 2.2 AA, which covers those criteria and adds the new ones from version 2.2.

Does the website supplier need certified information security?

In Spain, the National Security Framework (ENS), Royal Decree 311/2022, sets the security measures for systems that serve the administration and also applies to the companies that provide services to it: tenders require it. The MEDIUM and HIGH categories require certification by an accredited body. Kiwop has been certified in the ENS medium category since September 2026, and in ISO/IEC 27001, the security standard recognised across Europe.

Do you bid for public tenders?

Yes. We have been listed in the Register of Tendering Companies of Catalonia (RELI) since 7 November 2019 and have an active registration in SAM.gov (United States). We write the technical proposal with comparable public projects, certified security and an accessibility and transition plan.

Why Drupal for a public website?

Because it is open source, mature in institutional settings, handles several languages, roles and publishing workflows well, and has a community that publishes its security advisories. It is not the only option: when the project needs its own logic (public-sector recruitment, ethics channel, data from other systems) we use Laravel, as at L’Energètica.

How do you migrate a public website without losing URLs or rankings?

We start with an inventory of every URL and piece of content. We migrate content keeping its paths, redirect everything that changes and check it before switching off the old version. That is how we migrated the fifteen ICUB websites from Drupal 7, 8 and 9 to Drupal 10.

What about Drupal 7 if our organisation still runs it?

Drupal 7 no longer has community support, so every new vulnerability is left without an official patch. The sensible move is to plan the migration to Drupal 10 with a prior inventory, as a project with its own budget, rather than waiting for an incident.

Do the code and data belong to the organisation?

Yes. We work with open source and leave the code, configuration and data in the organisation’s hands, with documentation and a transition plan. If it ever decides to change supplier, it can: since 2026 the L’Energètica website has been hosted by another provider and is still online with our code.

Can you work within a city council’s corporate platform?

Yes, and it is the norm in large city councils. On barcelona.cat we worked within Barcelona City Council’s Drupal platform, on top of its corporate profiles and themes, building the content types and views each venue needed.

How much does a website for a public body cost?

It depends on the number of sites, the migration, the integrations and what the tender specifications set. We do not publish a rate: after reviewing the inventory or the specifications we give a fixed quote by phase. If the project goes to tender, the amount is set by the contract notice itself.

Do you work with public bodies outside Spain?

Our public-sector projects so far are in Spain, and we are ready to work for public bodies elsewhere. We work in English, Spanish, Catalan, French, German, Dutch and Portuguese, use the European accessibility standard EN 301 549 as our reference and ISO/IEC 27001 as a security framework recognised beyond Spain, and we have an active registration in SAM.gov for US federal contracts.

Next step