Share data: Always begin by reviewing your obligations against privacy policies and the Privacy Act (1988). If external data can be used, make your service interoperable and leverage governments’ open datasets. Support safe, ethical data sharing practices by using the government’s DATA Scheme(Opens in a new tab/window).
Request information once: Assess the data your agency already collects and whether it can be reused to deliver your service. Where it can be reused, eliminate unnecessary data entry requests and fulfil a ‘tell us once’ approach.
Publish open APIs: Thoroughly document your service’s APIs. Where appropriate, open them for other services and third-parties to build upon existing government offerings. Align with the API Design Standard(Opens in a new tab/window) to support cross-jurisdictional data sharing, maintain a consistent, reusable vocabulary and support wider API literacy.
Plan for scale and flexibility: Ensure your service can cater for growth and changing preferences without impacting performance, functionality or stability. Embed adaptability into your design patterns from the outset to allow malleability as future changes may require.
Utilise a Digital ID: Where appropriate, endeavour to integrate the Australia Government Digital ID System, accredited by the Trusted Digital Identity Framework (TDIF)(Opens in a new tab/window), to allow users to access your service with a single set of credentials.
OffIdentifying one or more sellers in the cyber security sector that meet at least some of the indicative criteria is premature for the following key reasons:
For context to this case study, the below provides a non-exhaustive overview of categories that demonstrate how vast the cyber security ecosystem is, noting that each category can be further broken down to specific sub-categories. Note, entities may provide or resell specific hardware or software, services and solutions, or a combination of these:
Expanding on this, for example, the network security category can be further broken down to:
5.67 There is no singular seller in the cyber security market which will sufficiently meet the proposed principles of an SSA framework. The case study identifies that ongoing work is required to monitor the market to identify any emerging need to establish SSAs in the cyber security sector. An assessment of product, solution and service usage and criticality in the government context is key to understanding this.
5.68 Complemented by engagement with ASD, the review identified, however, there is potential value in establishing capability specific cyber security panels (like that of other panels on BuyICT).
5.69 The Commonwealth utilises three key tiers of rules:
5.70 The key opportunities to amend the rules that were identified within this report are:
5.71 For context, there are a range of commercial realities the Digital Transformation Agency (DTA), buyers and sellers face when negotiating these arrangements. The below outlines a few of these from each of their perspectives, however, this is not an exhaustive list:
5.72 In approaching the negotiations, it is acknowledged that the Australian Government SSA negotiators are cognisant of these realities. Within this context, what the DTA prioritises in the negotiations becomes critically important.
5.73 A range of key themes emerged, throughout the review, regarding the priorities in negotiating an SSA. These themes were:
5.142 A successful strategic partnership requires mutual commitment and proactive engagement from both the seller and the buyer. While the SSAs must demonstrate ongoing alignment with the elements outlined within the Fostering strategic partnerships section of this report, buyers also play a critical role in fostering collaboration. This includes maintaining open and transparent communication, ensuring timely decision-making, and actively participating in shared initiatives such as innovation forums and continuous improvement programs.
5.143 Buyers must also honour their commitments, engage constructively in contract management, and adapt procurement strategies to evolving needs, reinforcing trust and long-term alignment. By demonstrating reciprocity in the partnership, buyers not only secure optimal outcomes but also encourage sellers to invest in sustained value creation beyond the initial contractual terms.
5.144 Effective utilisation of contractual arrangements depends on ensuring stakeholders have access to clear, relevant, and practical information.
5.145 The key mechanisms identified as available to the Digital Transformation Agency (DTA) to enable this to occur were:
5.146 The information required by buyers and how this is accessed in respect of the SSAs is outlined in the table below:
Information required | Seller website | BuyICT website | BuyICT following log in | By request of DTA |
|---|---|---|---|---|
General information on the products and services | X | Nil | Nil | Nil |
Products and services covered by the SSA | Nil | X | X | Nil |
Standard templates | Nil | Nil | X | Nil |
DTA marketplaces and panels the seller is on | Nil | X | Nil | Nil |
Advantages under the contract | Nil | X | Nil | Nil |
Price / rate card / discounts | Nil | Nil | X As agreed with seller | X |
Copy of the contract and terms & conditions | Nil | X As redacted | Nil | X |
5.147 The DTA can also play a key role in fostering a probity-safe environment where Commonwealth agencies can engage directly with SSA technical representatives to explore opportunities and challenges. By facilitating structured discussions, the DTA can ensure buyers can collaborate effectively while maintaining transparency and compliance. These interactions allow buyers to better understand seller offerings, get visibility of how other buyers are addressing any common issues, and understand the potential applicability to their specific problems.
5.148 Further to the Increased administrative burden section within this report, the review heard buyers can find it challenging to know what their obligations are in respect of entering into contracts under the SSA head agreement or specific clauses therein. Greater transparency about the relevant roles and responsibilities in this regard will support the realisation of value from the SSAs.
5.149 These forums could also address challenges identified by survey respondents who stated that there is a need for:
5.150 The DTA should drive better realisation of the value of the SSAs through uplifting buyer understanding about the SSAs, by:
5.151 Effective reporting is central to maximising the value of established contractual arrangements, ensuring transparency, accountability, and informed decision-making. In pragmatic consideration of ‘what gets reported gets managed’, tracking metrics related to contract spend, product and service utilisation, and broader procurement trends are key. Ongoing reporting on contract expenditures and usage patterns allows agencies to assess whether agreements remain fit for purpose, identify areas for optimisation, and ensure that negotiated benefits - such as volume discounts or strategic flexibility - are being fully leveraged.
5.152 The DTA actively undertake a range of surveys to obtain periodic feedback on the use of the SSAs, including surveys ahead of the renewal of the SSAs to inform contact negotiations. These insights are used to inform continuous improvement.
5.153 The review identified the following in respect of current reporting capability:
5.154 Improving reporting will also make future negotiation better informed and consistent, with further discussion in the Get timely, accurate data section of this report. By maintaining a structured reporting framework, government entities can proactively manage seller relationships, align procurement with operational needs, and drive continuous improvement.
5.155 In respect of performance reporting of the sellers, the review noted that this is managed mostly at the agency level, with limited overall reporting undertaken by the DTA in respect of the SSAs. In turn, this limits the DTA’s ability to address emerging issues, drive the right outcomes, and monitor the realisation of value from the SSAs.
5.156 Monitoring the aggregate performance of the sellers against the published framework, supported by ongoing feedback from buyers, will provide insight that can assist in ensuring the SSAs remain fit-for-purpose and continue to contribute to achieving value for money.
5.157 Potential key performance indicators or key result areas which could be implemented are depicted in the following graphic:
For a digital project to contribute to agency effectiveness and service delivery, the business purpose that the transformation project facilitates needs to be clearly articulated and supported. Delivery confidence can be higher where there is a transformative vision that people rally around.
The Data and Digital Government Strategy sets the vision for the Australian Government’s use of data and digital technologies to 2030.
The purpose and vision for a transformation should be supported by a strong business case, with clear outcomes and scope that is aligned with the needs of the business area.
Financial and non-financial benefits and disbenefits should be defined and actively monitored, and project scope should be aligned with achieving benefits and minimising impact.
A clear and unambiguous purpose that is inspiring, consistent across stakeholder groups and meets stakeholder needs.
OffA purpose that broadly represents stakeholder needs and interests.
OffA purpose has been developed, but with limited consultation or commitment from the business area it will impact.
OffA purpose that doesn’t accurately or consistently represent business needs.
OffA technology-centric purpose or misalignment on the purpose.
OffA clear and unambiguous purpose that is inspiring, consistent across stakeholder groups and meets stakeholder needs.
A purpose that broadly represents stakeholder needs and interests.
A purpose has been developed, but with limited consultation or commitment from the business area it will impact.
A purpose that doesn’t accurately or consistently represent business needs.
A technology-centric purpose or misalignment on the purpose.
Business case shows robust consideration of options, clear rationale for the project, detailed and realistic estimates for cost and time, and measurable success criteria.
OffBusiness case shows consideration of options, rationale for the project, estimates for cost and time, and measurable success criteria.
OffBusiness case shows limited consideration of options, rationale for the project, estimates for cost and time, and success criteria.
OffBusiness case largely makes an argument for one option, without fair consideration of alternatives.
OffTo successfully meet this criterion, agencies will need to:
Limited or no business case.
OffBusiness case shows robust consideration of options, clear rationale for the project, detailed and realistic estimates for cost and time, and measurable success criteria.
Business case shows consideration of options, rationale for the project, estimates for cost and time, and measurable success criteria.
Business case shows limited consideration of options, rationale for the project, estimates for cost and time, and success criteria.
Business case largely makes an argument for one option, without fair consideration of alternatives.
Limited or no business case.