Mixed procurement is a contract structure that bundles different kinds of deliverables—such as services, works, and supplies—into one award. It is common in large public and enterprise projects where one vendor may provide design, hardware, installation, and ongoing support under a single agreement.
In cyber security, mixed procurement matters because security obligations can become blurred when technical responsibility is split across several components. A contract may cover software, hosting, maintenance, and on-site work, but each part can carry different risks, controls, and reporting duties. Defenders use clear scope, named control owners, and verification clauses to avoid gaps in incident response, patching, access control, or subcontractor oversight. Attackers benefit when no one can tell who is responsible for security, making mixed procurement a governance risk as much as a purchasing model.