Skip to content
CISA lists exploited flaws in the Linux kernel and VMware ESX
Black Shard

Loading

    Government

    For the public sector, and everyone who supplies it.

    Councils, agencies and their suppliers get asked the same hard questions. We get you ready to answer them with evidence.

    Talk to usGovernment buyers

    Government

    The obligations in play.

    Government security expectations, without an enterprise security team.

    • ASD Essential Eight

      The baseline mitigation strategies Australian government bodies are assessed against, and increasingly expect their suppliers to address.

    • ASD Information Security Manual

      The control framework for systems handling government information.

    • Privacy regimes

      Councils sit under state information-privacy statutes; suppliers handle personal information under the Privacy Act 1988 and the APPs.

    • Procurement security requirements

      Tenders carry their own mandated controls, insurances and evidence obligations, set contract by contract.

    Threat picture

    What the sector is facing.

    What we do

    What you carry, and what we do about it.

    • Essential Eight maturity is the default yardstick: agencies are assessed against it, and suppliers are increasingly asked for it.

      An Essential Eight assessment rates all eight strategies against the ASD maturity model, with an uplift plan and an evidence trail for each mitigation.

      Essential Eight assessment

    • Tender security questionnaires demand specific answers with evidence, and a blank row can cost the bid.

      A posture assessment maps where you stand against recognised controls, and a vCISO gives you a named security lead to stand behind the answers.

      vCISO and posture assessment

    • Government buyers expect an incident response path that has been rehearsed.

      A review of your logging and alerting coverage, an incident response playbook your team can run, and a tabletop exercise to pressure-test it.

      Detection and response advisory

    • Legacy systems predate the expectations now applied to them, and they still run the service.

      We penetration-test the systems you run and hand back a ranked fix list. Where a system cannot be defended, we design and build its replacement secure by design.

      Penetration testing and secure builds

    Services

    The services that apply.

    All services

    Government buyers

    Supplier arrangements for Australian government buyers.

    Government buyers

    • Queensland councils

      Local Buy LB308

      Prequalified supplier to Queensland councils under Local Buy arrangement LB308, ICT Solutions, Products, Services and New Technologies.

      Prequalified for ICT solutions, products, services and new technologies.

      Appointed 23 Oct 2026

      How Queensland councils engage us

    • NSW Government

      NSW ICT Services Scheme

      Prequalified supplier under the NSW Government ICT Services Scheme (SCM0020).

      Prequalified for government ICT work, engaged through buy.nsw.

      Registered 14 Oct 2026

      How NSW agencies engage us

    • Victorian Government

      Victorian Fair Jobs Code

      Holder of Victorian Fair Jobs Code pre-assessment certificate FJC-261023-11119, required for Victorian Government threshold and high-value procurement.

      The pre-assessment a threshold or high-value government tender asks for.

      23 Oct 2026 to 22 Oct 2028

      How Victorian agencies engage us

    • Our own estate

      Essential Eight Maturity Level 3, assessed September 2026.

    • Local Buy LB308 for Queensland councils, the NSW ICT Services Scheme SCM0020 and a Victorian Fair Jobs Code certificate.

    • We bid into federal and state agencies.

    • 24/7 incident line: 1800 370 270.

    Questions, answered.

    Can a council or agency engage Black Shard without an open tender?

    Yes. Queensland councils can request a quote under Local Buy LB308, NSW agencies can engage us under the ICT Services Scheme (SCM0020), and Victorian Government buyers engage us under our Fair Jobs Code certificate.

    Which Essential Eight level should a government supplier target?

    The level being asked for. Maturity Level 1 across all eight strategies is the baseline supplier questionnaires commonly have in mind, and contracts touching government supply chains increasingly specify Level 2. An Essential Eight assessment rates all eight strategies, with an uplift plan and an evidence trail for each mitigation.

    Can you help us answer a tender security questionnaire?

    Yes. A posture assessment maps where you stand against recognised controls, and a vCISO gives you a named security lead to stand behind the answers.

    Industries

    Other sectors we work in.

    All industries

    Ready for the questions procurement asks.

    Talk to usGovernment buyers