Government & Enterprise Procurement Playbook: Panels, Clearances & Local Content in ANZ

Australian and New Zealand governments are among the most digitally ambitious in the Asia-Pacific, running sustained programmes to modernise legacy systems, adopt cloud infrastructure, and deploy AI-enabled services. For a foreign technology vendor, government contracts offer long contract durations, predictable payment cycles, and — once won — powerful references that open enterprise doors across the region.

The Australian Commonwealth alone spends tens of billions of dollars annually on goods and services, with ICT and digital transformation representing a significant and growing share. The Commonwealth Procurement Rules (CPRs) govern how federal agencies buy, and understanding them is the single most important step for any foreign vendor seeking to participate.

New Zealand runs a parallel but distinct system, anchored by the NZ Government Procurement Rules (5th edition, December 2025) and the mandatory Government Electronic Tenders Service (GETS). Together, the two markets offer complementary entry points — and a vendor who qualifies for one will often find the other within reach.

In Australia, the federal government (Commonwealth) is governed by the CPRs, which are issued by the Finance Minister and are binding on non-corporate Commonwealth entities (NCEs) — the bulk of federal departments and agencies. Corporate Commonwealth entities (CCEs) are subject to lighter-touch obligations. State and territory governments run separate procurement frameworks and are outside the CPR regime, though many adopt similar principles.

The CPRs create two procurement pathways: open approaches to market (public tenders published on AusTender) and selective approaches through standing offers — pre-qualified panels from which agencies can draw down without running a full tender each time. For ICT and digital services, the key standing offers sit on BuyICT.gov.au, the Digital Transformation Agency's whole-of-government procurement portal. Getting onto a BuyICT panel is effectively the licence to compete for most federal ICT work.

In New Zealand, all agencies above the threshold must publish opportunities on GETS. The NZ Government Marketplace (marketplace.govt.nz) serves a similar panel function, with pre-approved supplier channels across SaaS, consulting, managed services and more.

The Commonwealth Procurement Rules (updated 17 November 2025) contain two divisions. Division 1 applies to all procurements; Division 2 imposes additional obligations — including mandatory open tendering — once the procurement crosses the relevant threshold.

The thresholds from 17 November 2025 are:

• NCEs (non-corporate Commonwealth entities): AUD $125,000 for goods and services (raised from $80,000 on 17 November 2025).
• Prescribed CCEs (corporate Commonwealth entities): AUD $400,000.
• Construction services: AUD $7.5 million for both NCEs and CCEs.

All contracts valued at or above AUD $10,000 must be reported on AusTender within 42 days of contract execution. This reporting obligation means the full pipeline of awarded contracts is publicly searchable — a useful market intelligence tool for new entrants analysing agency spending patterns before bidding.

Contracts using the Commonwealth Contracting Suite (CCS) are mandatory for NCEs on contracts under AUD $200,000, setting standardised terms that vendors must accept. Above AUD $1 million (or $7.5 million for construction), NCEs must explicitly consider the economic benefit to the Australian economy as part of the value-for-money assessment.

This is a critical question. The CPRs define an Australian business as an entity incorporated in Australia with 50% or more Australian ownership. A foreign company that has established an Australian subsidiary and holds majority Australian ownership at entity level qualifies. However, the practical effect for most foreign tech entrants is that without a local incorporated entity, they will not satisfy the SME-only gatekeeping rules that apply to most DTA panel procurements below $125,000 (see Section 3).

For procurements with an expected value between AUD $10,000 and below the relevant threshold, NCEs must invite only Australian businesses to submit. This is a significant barrier for unincorporated foreign vendors. The strategic implication is clear: establish an Australian entity early — ideally before pursuing any Commonwealth contract opportunity — so the business qualifies for the full range of panel and standing-offer pathways.

BuyICT.gov.au is the Digital Transformation Agency's whole-of-government ICT procurement portal, hosting six digital and ICT marketplaces covering hardware, software, cloud services, and digital services. For most foreign tech vendors, the most relevant entry point is the Digital Marketplace Panel 2 (DMP2), launched in October 2024.

DMP2 currently operates two modules:

• Module 1: ICT labour hire.
• Module 2: ICT professional and consulting services, including AI engineering.

The DTA has designed DMP2 with a modular architecture to allow future additions — hardware, software, and cloud categories are anticipated. Sellers on the original Digital Marketplace Panel transitioned to DMP2 by 31 January 2025. New seller applications and additional categories re-opened in late November 2025, meaning the panel is actively accepting applicants.

Once listed on DMP2, vendors can receive direct-approach requests from agencies for procurements below the $125,000 threshold without a further competitive tender. Above $125,000, agencies may still approach DMP2 sellers but must run a competitive process among panel members. Being on the panel dramatically reduces the friction for agencies to engage — most Commonwealth ICT buyers will not engage an off-panel vendor unless the specific capability cannot be sourced from the panel.

The Software Marketplace on BuyICT also includes an ERP category (mandated for NCEs, added July 2024) covering financial management, HR, payroll, and workforce management systems — relevant to SaaS vendors in those domains.

The CPRs define an SME as an Australian or New Zealand business with fewer than 200 full-time equivalent employees (including associated entities). This definition is notably broader than the EU definition (250 employees) and includes the NZ-based businesses — a deliberate Trans-Tasman alignment.

The government's SME commitment for NCEs is:

• At least 25% of contracts by value from SMEs (for contracts up to AUD $1 billion).
• A target of 40% by value from SMEs for contracts up to AUD $20 million.

Critically, for procurements from any DTA-managed standing offer (including DMP2) with an expected value below AUD $125,000, NCEs must invite only SMEs on the relevant panel. This creates an effective SME-only gate — a foreign vendor that has incorporated in Australia, employs fewer than 200 FTEs, and secured panel membership is therefore structurally preferred for the majority of federal ICT discretionary spend.

The practical implication: a lean, newly established Australian subsidiary of a foreign company will almost certainly qualify as an SME and should actively market itself as such in agency outreach. Agencies have genuine budget incentive to award SME-eligible contracts to qualifying panel members rather than run costly open tenders.

Security clearances in Australia are administered by the Australian Government Security Vetting Agency (AGSVA). There are four clearance levels, each with a revalidation period and an FY2025–26 KPI processing target:

• Baseline: revalidation every 15 years; KPI 20 business days.
• Negative Vetting 1 (NV1): revalidation every 10 years; KPI 70 business days.
• Negative Vetting 2 (NV2): revalidation every 7 years; KPI 100 business days.
• Positive Vetting (PV): revalidation every 7 years; KPI 180 business days.

Australian citizenship is a baseline eligibility condition for all clearance levels. Non-citizens require a Citizenship Eligibility Waiver (SVA013 form) and an exceptional business case approved by the entity's Accountable Authority. This is the single most significant workforce planning constraint for foreign-owned vendors: key personnel who are not Australian citizens will face additional process steps and may not be eligible for higher-level clearances without a waiver.

Five Eyes country clearances (UK, US, Canada, NZ) may be recognised and transferred via AGSVA with an approved waiver, per AGSVA's non-citizen factsheet. Vendors with personnel already holding equivalent UK or US clearances should explore the reciprocal pathway before investing in fresh applications — it can dramatically shorten the timeline for Defence, Intelligence, and Home Affairs engagements.

Foreign-owned cloud and hosting providers face a two-layer compliance requirement before they can host Australian government data above OFFICIAL.

Hosting Certification Framework (HCF) — Administered by the Department of Home Affairs, the HCF has three tiers:

• Strategic: highest assurance; only available to providers that allow the government to specify ownership and control conditions.
• Assured: safeguards against ownership/control change via financial penalties; the practical tier for most foreign-owned cloud providers seeking to host government data.
• Uncertified: minimal protections; generally restricted to low-sensitivity workloads.

All sensitive government data, whole-of-government systems, and systems at PROTECTED classification must be hosted by HCF-certified providers. Requirements apply to new contracts and extensions from 30 June 2022. Extensions for providers awaiting certification are capped at one year (with one further one-year extension option). The Hosting Certification portal is the primary source for certification status and application guidance.

IRAP (Infosec Registered Assessors Program) — Administered by the Australian Signals Directorate (ASD), IRAP is the mechanism by which cloud and tech vendors demonstrate security compliance against the Information Security Manual (ISM) and the Protective Security Policy Framework (PSPF). An IRAP assessment produces a Security Assessment Report (SAR) — it is not a government certification or accreditation, but is required by agencies before authorising a platform for OFFICIAL: Sensitive or PROTECTED data. Each agency conducts its own authorisation decision based on the SAR; IRAP is therefore a necessary but not sufficient step. Plan for IRAP assessment costs and lead times — assessors are independent and in high demand.

The Indigenous Procurement Policy (IPP) is a procurement-connected policy under the CPRs, administered by the National Indigenous Australians Agency (NIAA). It creates a Mandatory Set Aside (MSA) — a gatekeeping rule that must be satisfied before agencies can proceed with other procurement approaches.

The MSA applies to:

• All procurements delivered in remote Australia, regardless of value.
• All other procurements wholly delivered in Australia with a value between AUD $80,000 and $200,000 (GST inclusive).

In practice, an NCE wishing to approach an SME on a DTA panel (e.g. DMP2) for a contract in the $80,000–$125,000 range must first check whether the IPP MSA applies and, if so, whether an eligible Indigenous business on the panel can deliver the work before approaching non-Indigenous SMEs.

From 1 July 2026, the eligibility threshold for an Indigenous business changes to 51% ownership and control (from 50%). For FY2025–26, the Commonwealth-wide target is 3% of the number and value of eligible contracts awarded to Indigenous businesses. Foreign vendors that partner with or subcontract to an eligible Indigenous business may assist agencies in meeting this target — a practical partnership angle worth exploring proactively during bid development.

For procurements above AUD $1 million (or AUD $7.5 million for construction), the CPRs require NCEs to consider the economic benefit to the Australian economy as part of the value-for-money assessment. This is not a formal weighting or scoring criterion mandated at a specific percentage — it is a qualitative consideration — but agencies increasingly address it through explicit questions in approach-to-market documents.

Foreign vendors should prepare a credible Australia Economic Benefit Statement for any bid above the $1 million threshold. This typically covers: local headcount and payroll, Australian subcontractors and supply chain partners, planned local investment (offices, R&D), and skills transfer or training commitments. Even a modest but genuine local footprint — a Sydney or Melbourne office, locally hired support staff, a local systems integrator as a teaming partner — materially strengthens the economic benefit narrative.

The 5th edition of the NZ Government Procurement Rules, which came into effect on 1 December 2025, applies to procurements worth more than NZD $100,000 for goods, services, and refurbishment contracts, and NZD $9 million for new construction works. Below these thresholds, agencies are expected to award to capable NZ businesses where they have capacity, per MBIE's procurement framework.

A significant new requirement in the 5th edition is Rule 8: for procurements above the relevant threshold, agencies must include economic benefit to New Zealand with a minimum 10% weighting in evaluation criteria. This is a formalised, scored weighting — more prescriptive than Australia's equivalent "consider" obligation. Foreign vendors should build a New Zealand economic benefit narrative (local employment, skills, supply chain) into every above-threshold proposal as a discrete scored section.

Importantly, NZ procurement rules contain no domestic preference or discrimination against foreign suppliers for above-threshold tenders. Once you meet the 10% economic benefit weighting requirement with a credible local story, foreign vendors compete on equal footing with local suppliers, per MBIE's announcement of the 5th edition.

GETS (Government Electronic Tenders Service) is NZ's free, mandatory tender publication platform. All government agencies are required to publish contract opportunities above the procurement threshold on GETS. It is the primary discovery mechanism for foreign suppliers and should be monitored regularly once a vendor has committed to the NZ market. There is no registration fee, and foreign-based suppliers can access and respond to GETS opportunities directly.

For a pre-approved panel pathway analogous to BuyICT, the NZ Government Marketplace (operated by the Department of Internal Affairs) is open to all businesses — NZ-based or internationally based — that meet channel entry criteria. Current channels include:

• Software as a Service (SaaS)
• Consultancy and Professional Services
• Managed Services
• Infrastructure, Telecommunications, Managed Security Services, and Digital Identity (recently opened)

An administration fee of 1.75% of contract value applies for Consultancy, Enterprise Software, and Managed Services channels (no fee for Public Cloud Services), per DIA's Marketplace guidance. Unlike Australia's DMP2, the NZ Marketplace does not impose a residency or incorporation requirement as a gatekeeping condition — a foreign company can apply directly. This makes it a faster first market-entry foothold than the Australian federal panel system, where local incorporation is practically essential.

NZ's All-of-Government (AoG) ICT contracts, managed by the Department of Internal Affairs (DIA), are pre-negotiated whole-of-government agreements that agencies can access without running their own tender. Current AoG agreements include frameworks for Amazon Web Services, Catalyst Cloud, Datacom Cloud, Google Cloud, Microsoft Cloud/Software/Services (MCSSA), Oracle Software, SAP Cloud, and TechnologyOne Cloud.

Accessing an AoG contract as a supplier requires: signing an NDA with DIA, completing a Secondary Procurement Process, entering an MoU with DIA, and executing a Participating Agreement with the agency. An administration fee of 1.75% applies across Common Capabilities ICT services. The IaaS AoG contract expires 24 October 2026 — DIA is expected to run a refresh process, presenting a window for new vendors to enter the AoG ecosystem. Monitoring NZ Government contracts for the upcoming IaaS retender is a high-value strategic action for cloud infrastructure vendors.

Work through the following steps before investing in bid preparation. Attempting to respond to government tenders without completing these foundations is a common and costly mistake for foreign entrants.

Corporate & Legal Structure

• ☐ Incorporate an Australian Pty Ltd or New Zealand limited company — required to qualify as an "Australian business" under the CPRs and to access most panel pathways.
• ☐ Register for GST (Australia: ATO; NZ: Inland Revenue) and obtain an ACN/ABN (AU) or NZBN/IRD number (NZ).
• ☐ Confirm ownership structure: if the local entity is 50%+ foreign-owned, it does not qualify as an "Australian business" under the CPRs — consider restructuring or a local JV if the AU government market is a primary target.

Panel & Marketplace Registration

• ☐ Apply for Digital Marketplace Panel 2 (DMP2) via BuyICT.gov.au — Module 1 (labour hire) or Module 2 (ICT professional services / AI engineering) depending on your offering.
• ☐ Review BuyICT Software Marketplace ERP category if your product covers financial management, HR, or payroll.
• ☐ Register on NZ Government Marketplace in your relevant channel (SaaS, Consultancy, Managed Security, etc.).
• ☐ Set up a GETS monitor/alert at gets.govt.nz for relevant NZ agency opportunities.
• ☐ Set up AusTender saved search notifications for relevant commodity codes.

Security & Compliance

• ☐ Identify which personnel will require AGSVA security clearances; check citizenship status and initiate Citizenship Eligibility Waiver (SVA013) for non-citizens where applicable.
• ☐ Engage an ASD-endorsed IRAP assessor to scope an IRAP assessment if your platform will process OFFICIAL: Sensitive or PROTECTED data.
• ☐ If you are a cloud/hosting provider, review Hosting Certification Framework (HCF) Assured tier requirements and begin the certification process — required for any PROTECTED-level government hosting contract.
• ☐ Review the ISM and PSPF requirements relevant to your product category.

Local Content & Partnerships

• ☐ Prepare an Australia Economic Benefit Statement for bids above AUD $1 million covering local headcount, subcontractors, planned investment, and skills transfer.
• ☐ Prepare an equivalent NZ Economic Benefit section (minimum 10% evaluation weighting required under Rule 8 for above-threshold NZ bids).
• ☐ Identify a potential Indigenous business partner or subcontractor to support IPP compliance for contracts in the AUD $80,000–$200,000 range.
• ☐ Identify a local systems integrator, reseller, or teaming partner — many agencies prefer or require local prime contractors, with foreign vendors in a subcontractor or product-vendor role.

NZ AoG Strategy

• ☐ Review the current AoG contracts list and note the IaaS AoG contract expiry (24 October 2026) — monitor DIA for the retender process.
• ☐ If targeting the AoG pathway, initiate contact with DIA to understand NDA and MoU requirements ahead of a formal application.

Not legally — there is no statute that prohibits a foreign company from contracting with a Commonwealth entity. However, the practical effect of the CPRs is significant: for procurements between AUD $10,000 and the relevant threshold, NCEs must invite only Australian businesses to submit. For DTA panel procurements below $125,000, only SME panel members can be approached. Both rules are only available to entities that meet the "Australian business" definition (incorporated in Australia, 50%+ Australian ownership).

For large above-threshold tenders published openly on AusTender, a foreign company can bid — but will face the economic benefit scrutiny and will not benefit from the SME preference. Most foreign vendors find that local incorporation is the most commercially rational first step.

The Digital Transformation Agency periodically opens DMP2 applications — most recently in late November 2025, per the DTA's announcement. Application processing times vary by module and application volume. Budget at least 4–8 weeks for the panel application and any remediation of application deficiencies. There is no fee to apply for DMP2 panel membership. Monitor the DTA website for opening and closing dates — the panel is not permanently open, and missing an application window means waiting for the next round.

They serve different but complementary purposes:

• IRAP (administered by ASD) assesses the security posture of your platform or system against the ISM and PSPF. It is required before an agency will authorise your platform to process government data at OFFICIAL: Sensitive or PROTECTED. IRAP applies to any tech vendor whose product processes or stores government data.
• HCF (administered by Home Affairs via hostingcertification.gov.au) certifies the hosting infrastructure provider — data centres, cloud platforms. It is required if your business is the hosting provider for government systems at PROTECTED classification.

A SaaS vendor hosted on a certified cloud provider (e.g. one already holding HCF Assured certification) typically needs IRAP but not HCF. A cloud infrastructure or managed hosting provider needs both. If in doubt, engage a specialist government security advisory firm to map your product against both frameworks before investing in assessments.

Yes — this is a key difference between the Australian and NZ markets. The NZ Government Marketplace is open to businesses that meet channel entry criteria regardless of whether they are NZ-incorporated. GETS can also be accessed and responded to by foreign suppliers. There is no domestic preference policy for above-threshold NZ government tenders.

However, the 10% economic benefit weighting under NZ Procurement Rule 8 means a vendor with no NZ presence will score poorly on that criterion. Establishing even a modest NZ footprint — a registered office, one local employee, an NZ-based implementation partner — meaningfully improves competitive position in above-threshold bids.

Yes. The IPP is a mandatory procurement-connected policy binding on NCEs, not on vendors. However, when an NCE is running a procurement in the AUD $80,000–$200,000 range (or in remote Australia at any value), it must check whether the IPP Mandatory Set Aside applies before it can approach other suppliers — including you. In practice, this means your bid may be displaced if an eligible Indigenous business on the panel can deliver the work.

The proactive response is to identify suitable Indigenous business partners and build them into your delivery model where genuine subcontracting opportunities exist. This also supports the agency's 3% IPP target for FY2025–26. From 1 July 2026, Indigenous business eligibility requires 51% ownership and control (changed from 50%), so verify current supplier eligibility with the NIAA when forming partnerships.

There are structural Trans-Tasman links. The CPR definition of SME explicitly includes New Zealand businesses (fewer than 200 FTEs), meaning a NZ-incorporated entity with no Australian subsidiary can still qualify as an SME for Australian panel purposes — though it must still be on the relevant panel. The CPRs reflect the Australia-New Zealand Government Procurement Agreement, which provides NZ suppliers non-discriminatory access to covered Australian procurements.

In practice, vendors who have already been through IRAP assessment for Australian agencies can leverage the documentation and security posture evidence when responding to NZ agency security questionnaires — NZ agencies increasingly reference the ISM and equivalent frameworks. And a proven track record of delivery for Australian government agencies is a strong reference signal for NZ procurement evaluators, given the shared administrative culture and inter-agency benchmarking across the Tasman.