The IT questions government and council tenders ask, and how to prepare

Why public buyers ask about IT

Public sector organisations hold sensitive information about citizens and services, and they are accountable for protecting it. When they engage a supplier who will access their systems, handle their data or deliver a service they rely on, they need confidence that the supplier will not become the weak link. Their procurement rules and security frameworks require them to assess this risk, and questionnaires are the main tool.

The level of scrutiny varies with the contract. A small one-off supply of goods may ask very little, while a contract that involves handling personal information or connecting to agency systems can come with a detailed security schedule. Read the tender documents carefully to understand what is being asked and what evidence is expected, and note any mandatory requirements that would rule you out if unmet.

Common security and privacy questions

Expect questions about how you protect accounts, such as multi-factor sign-in and password management; how devices are secured and kept up to date; how email is protected against phishing; how you back up data and test recovery; and who in your business can access the buyer's information. You may be asked whether you have a written information security policy, whether staff receive security training and how you respond to incidents.

Privacy questions often cover how you collect, store, use and dispose of personal information under the Privacy Act 2020, who your privacy officer is, and how you would handle and notify a privacy breach. Some buyers will ask where data is stored and whether it leaves New Zealand, particularly for cloud services, so know where your key systems hold data.

Continuity, insurance and subcontractors

Buyers want to know that you can keep delivering if something goes wrong. Expect questions about business continuity and disaster recovery plans, how long it would take to restore service after an outage, and whether those plans have been tested. A short written continuity plan with a record of the last test is much stronger evidence than a statement that one exists.

Insurance questions may ask for public liability, professional indemnity and cyber cover, sometimes with minimum amounts. Check the requirements against your policies early, because changing cover can take time. Buyers may also ask about any subcontractors or service providers who will access their information, including your IT provider, and what security commitments they have made.

Evidence that makes answers credible

A confident answer is good; a confident answer with evidence is better. Useful evidence includes written policies, a list of security controls, a recent independent security review or health check, records of staff training, backup test reports and an incident response plan. If you hold a recognised certification, mention it, but do not claim one you do not have.

Larger contracts may refer to formal frameworks, such as government security requirements or recognised international standards. A small business is rarely expected to hold full certification, but it should be able to show how its practices align with the relevant principles. Where you cannot meet a requirement yet, say so honestly and describe your plan, because an inaccurate answer discovered later can end a contract.

Preparing before the tender arrives

If public sector work is part of your strategy, prepare a tender pack in advance. Include a short information security policy, a privacy policy and process for handling breaches, a continuity plan, a summary of your IT controls, insurance certificates and a description of how your IT provider supports you. Update it yearly, and keep a library of answers to common questions that can be adapted for each tender.

Close the obvious gaps first. Multi-factor sign-in on every account, managed and encrypted devices, tested backups, email filtering and basic staff training are frequently asked about and relatively quick to put in place. They also reduce real risk, which is the point of the questions in the first place. If you are unsure where you stand, an independent review against the common questions gives you a list of gaps and the order to tackle them.

After you win the contract

Winning the tender means delivering on what you said. Make sure the controls you described stay in place, keep evidence current and be ready for an audit or follow-up questionnaire during the contract. Some agencies require you to report security incidents promptly, so know your obligations and who in the business is responsible for meeting them.

Treat each tender as a chance to improve. Questions you struggled to answer point to gaps worth closing, and each improvement makes the next tender easier and your business more resilient whether or not you win. Keep notes of the questions asked in each tender and how you answered them, because public buyers tend to ask similar things, and a well-maintained answer library can cut the time spent on the next response considerably. Debriefs from unsuccessful bids are also worth requesting, since buyers will often tell you which areas scored poorly.