External software quality assurance in government IT

When and how to outsource?

27.05.2026

Engineering, Future eGovernment, Industries, Software Test

2026 will not be a year of quiet modernization for IT managers in German government agencies. The Deutschland Stack from the IT Planning Council requires government agencies to adopt DevSecOps, the NIS 2 Implementation Act makes security testing a regulatory requirement, and the Accessibility Enhancement Act (BFSG) has threatened fines of up to 100,000 euros for violations of accessibility standards since mid-2025.

Anyone who develops or procures software for the public sector bears more responsibility for quality today than ever before. At the same time, according to a McKinsey study, Germany already faces a shortage of 39,000 IT professionals in the public sector.

Quality assurance becomes mandatory – and a matter of resources

The requirements for software quality in German government IT have skyrocketed over the past year. Section 30 of the new BSIG requires government agencies to conduct security tests, penetration tests, and static and dynamic code analysis (SAST/DAST for short). The BFSG makes accessibility testing a mandatory component of every acceptance process. And the Deutschland-Stack establishes Continuous Integration and Continuous Delivery (CI/CD) with automated testing processes as an architectural standard for the entire public administration.

At the same time, this combination of testing depth and breadth can hardly be covered by internal teams alone. Only 3 percent of IT professionals subject to social insurance contributions work in the public sector. The salary range of the Collective Bargaining Agreement for the Public Sector (TVöD) is structurally at a disadvantage compared to private-sector offers, which pay significantly more for experienced test specialists. As a result, open QA positions remain unfilled for months in many German government agencies.

What is at stake if quality assurance remains inadequate

Inadequate quality assurance is not an operational risk in regulated environments that can be ignored.

Accessibility deficiencies, which are not detected during acceptance testing, can lead to BFSG fines after the system goes live.
Security vulnerabilities, that enter production without being tested, open attack vectors in an environment that the BSI Situation Report 2025 assesses as increasingly critical for municipalities and state administrations.
Releases that fail after acceptance due to unplanned rework extend project timelines and undermine acceptance of digital administrative services.

IT managers are aware of these risks. The real problem is often a different one: they need solid arguments to justify externally contracted quality assurance both internally and to the contracting authority.

Justifying external QA, properly bundling scopes of work

External quality assurance is a strategically sound response to a structural problem. In the medium term, the public sector in Germany will not win the competition for specialized QA professionals against the private sector, and this very argument can be substantiated both economically and under public procurement law. It also protects IT managers from the accusation of initiating external contracts without sufficient factual basis.

The key is to correctly bundle the scope of services in the tender. A combination of three components has proven effective:

Test management: Test concept, test planning, oversight of test execution, and coordination with business units and contracting authorities
Test automation: CI/CD-integrated regression tests, security checks according to OWASP, accessibility tests according to WCAG 2.2 (Web Content Accessibility Guidelines), as well as load and performance tests
Acceptance support: Audit-proof test documentation, seamless traceability, and acceptance reports that stand up to procurement and audit requirements

Bundling these three service components into a single lot reduces interface issues and establishes clear responsibilities across the entire QA chain. Just as important as the scope of services is choosing the right service provider. A testing service provider with government experience understands the specifics of the public procurement framework: EVB-IT-compliant contract templates, documentation aligned with BSI IT-Grundschutz, and the specific acceptance processes of specialized authorities. Generic providers often deliver solid test results but incomplete supporting documentation. This is a critical weak point in procurement and audit scenarios.

sepp.med has been active in the public sector for a long time and supports government IT projects with functional tests, security audits, load and performance tests, as well as accessibility tests. Contact us if you wish to award external QA services or optimize an existing tender.

External software quality assurance in government IT

Quality assurance becomes mandatory – and a matter of resources

Quality assurance becomes mandatory – and a matter of resources

What is at stake if quality assurance remains inadequate

Justifying external QA, properly bundling scopes of work

FAQ

Sources

Get in touch with us!