Does the tender actually require ISO 27001?
Read the wording carefully. Tender documents use security requirements in three different ways:
- Mandatory: "The supplier must hold current ISO/IEC 27001 certification." Without it, the bid is non-compliant.
- Scored: certification earns points in the evaluation, but you can still bid without it.
- Equivalent accepted: "ISO 27001 or equivalent," which may allow Essential Eight maturity, SOC 2 or a documented ISMS with evidence.
If the requirement is unclear, ask through the tender's official clarification process. Buyers would rather answer a question than disqualify a good supplier.
What if we're not certified by the closing date?
You have options. Some buyers accept evidence that certification is underway: a signed engagement with a consultant, a completed gap assessment, a Statement of Applicability or a scheduled Stage 1 audit date. Others will accept certification as a condition of contract award rather than of bidding. Ask. The Australian Government's business.gov.au also publishes guidance on meeting tender requirements through equivalent processes.
Which certification do government buyers ask for?
| Requirement | What it is | Commonly seen in |
|---|---|---|
| ISO 27001 | Certified information security management system | Federal, state and local tenders; enterprise supply chains |
| Essential Eight | ASD's eight mitigation strategies, assessed by maturity level | Government agencies and their suppliers |
| SOC 2 | CPA attestation against Trust Services Criteria | SaaS suppliers, US-linked buyers |
| ISO 9001 | Quality management (not security) | Construction, engineering, services |
How long does ISO 27001 take for a small business?
With focused support, a small-to-medium business can typically be audit-ready in about eight weeks: a gap assessment in week one, policies in week two, an evidence sprint over weeks three to seven and an internal audit in week eight. The certification body's Stage 1 and Stage 2 audits follow. See our ISO 27001 timeline guide.
What drives the cost?
Your size and scope set the starting point. A good advisor then looks at the total cost of ownership with you, including certification body fees (paid separately), any platform and your team’s time, and helps your budget go further. See how much ISO 27001 costs in Australia.
Your next step
Send us the tender's security requirements. In a free 30-minute consultation we'll tell you what they actually require, whether you can bid now, and the fastest credible path to certification. Book a time.