Selling to Australian government is less about the pitch and more about the evidence behind it. Procurement officers and their security teams are trained to discount adjectives and ask for proof, so the supplier who says “we take security seriously” loses to the one who says “here is our self-assessed maturity level, dated, with evidence”. This article is what we have learned preparing for that world, and it is the standard we hold ourselves to in our government work.
Start with the frameworks they use
Government buyers do not invent their questions. They come from a small set of published frameworks, and knowing them lets you answer in their language:
- The Protective Security Policy Framework (PSPF) governs how Commonwealth entities protect people, information, and assets.
- The Essential Eight and the Information Security Manual (ISM), both from the ACSC, set the technical baseline. Expect to be asked where you sit against the Essential Eight, by maturity level.
- Hosting requirements, including the Hosting Certification Framework, shape where data and infrastructure may live.
- State frameworks, such as the NSW Cyber Security Policy, apply for state work and often mirror the same ideas.
You do not need to be an expert in all of them. You need to know which apply to the work in front of you, and answer honestly against them.
What they actually check
Behind the paperwork, buyers are looking for a short list of concrete things:
- Data residency and hosting: is the data held in Australia, and who can access it. Onshore delivery with no offshoring is a genuine differentiator, and it must be true.
- Security posture with evidence: a dated Essential Eight self-assessment and a defensible uplift plan, not a claim of certification.
- Personnel and clearances: who does the work, and whether they hold the security clearance the engagement requires.
- Insurance, references, and financial standing: the ordinary commercial hygiene that de-risks a supplier.
The honesty that wins work
The strongest position for a small supplier is precise honesty, because assessors have seen every inflated claim. Two rules serve well:
- Name the maturity level, the date, and the method. “Aligned to the Essential Eight, self-assessed at maturity level one this quarter, evidence available” reads as competence. “Fully Essential Eight compliant” reads as risk, as we covered in the Essential Eight post.
- Claim only current, verifiable credentials. List the certifications and clearances you actually hold now, and never the ones that have lapsed. A short, true list beats a long, stale one.
Where a small supplier has the edge
Size is not only a disadvantage. Small, onshore suppliers can offer things large panels struggle to: a named person doing the work rather than a rotating team, direct accountability, and no offshore data handling to explain away. For the right scope, that is exactly what a risk-conscious buyer wants.
Being ready before the tender
Registration and readiness take time, so they belong before the opportunity, not during it. The practical groundwork includes profiles on the relevant procurement channels, a current capability statement, and your security evidence assembled and ready to send. We are working through that registration process now, deliberately, rather than claiming a status we have not yet earned.
What to do this quarter
- Map the two or three frameworks that apply to the government work you want, and learn to speak to them.
- Complete a dated Essential Eight self-assessment with an uplift plan, and keep the evidence ready to share.
- Write a one-page capability statement that lists only current, verifiable credentials, clearances, and onshore delivery.
Winning government work is a long game built on evidence and honesty rather than adjectives. If you are a small supplier weighing it up, or an agency looking for an onshore partner who will not overclaim, read about our government work or get in touch.