Winning larger work increasingly means proving things rather than asserting them. A tender asks for evidence of your security arrangements, a big client's procurement team wants documentation before they will onboard you, or an auditor asks to see how something is actually configured.
Where we manage your systems, most of that evidence exists already. Here is what we can put in front of them.
What we can provide
- A written description of your environment and its controls. A plain-language document covering how accounts and access are managed, what multi-factor authentication is enforced and where, how devices are protected, how updates are applied, how data is backed up and where it is held, and how we handle incidents. This is the document that answers most of a tender's security section on its own.
- Configuration evidence. Screenshots or exported settings from the systems themselves, showing that a control is on rather than intended. Auditors ask for this when a written statement is not enough.
- Reports on device and patch status. Which devices are managed, which are protected, and how current their updates are, as at a stated date.
- Backup and restore evidence. Backup schedules, retention, where copies are held, and records of restore testing. The restore testing is the part reviewers actually want.
- User access lists. Who has an account, who holds administrative access, and confirmation that leavers have been removed. Useful for the access review questions that appear in nearly every audit.
- A record of the onboarding and offboarding process. How access is granted when someone starts and removed when they leave, which is a very common control question.
- Incident handling arrangements. How issues are reported, how they are triaged, and how they are escalated, along with our support hours and response targets.
- Our own details as your supplier. Auditors often ask about the businesses you rely on, and we will provide what they need about us, including our entity details, Eden Enterprises Pty Ltd ATF IT Help Trust, ABN 72 312 152 267.
- Where your data lives. Which services hold it and in which country, which matters for tenders with data sovereignty requirements.
- Letters of support. A short signed statement confirming particular arrangements, addressed to the party asking, where that is what the process requires.
What we cannot provide
Being clear about this early saves everyone time.
We are not an accredited assessor or a certification body, so we cannot issue a certification or a formal audit opinion. If a tender requires an assessment by an independent accredited assessor, that must come from such an assessor. We can prepare you for it and support you through it, which usually makes it shorter and cheaper.
We also will not describe controls that are not in place, restate legal or contractual terms on your behalf, or provide evidence about another supplier's internal operations. For services such as Microsoft, the provider publishes its own certifications and audit reports, and pointing the reviewer at those is the correct answer.
How to make this easy
- Send us the actual document, not a summary of it. The wording of the questions determines what evidence is appropriate, and requirements phrased slightly differently need different answers.
- Tell us the deadline honestly. Gathering configuration evidence and access reviews takes time, and rushing it produces the kind of vague answer that generates three rounds of follow-up questions.
- Tell us who is reading it. A procurement officer, a technical assessor and an insurer want the same facts at very different levels of detail.
- Ask early, before you commit to a response date if you can. An hour of conversation before the tender is written often changes what you promise.
Keep the pack
Once you have been through this once, keep everything in one place with the date on it. Most businesses that chase larger contracts get asked the same questions repeatedly, and a maintained evidence pack turns each subsequent request into an update rather than a project. Refreshing it once or twice a year is enough for most, and it is far less work than rebuilding it each time under deadline.
It is also genuinely useful internally. The pack is the clearest picture most owners ever get of how their own business runs.
Talk to us
Email admin@yougrowit.com.au with the tender or audit request attached and the date it is due. We will tell you what we can evidence, what will need to come from you, and whether anything in the request points to work worth doing before you respond.
This kind of work is scoped and quoted rather than priced from a list, because it depends on what is being asked for and how much already exists. We will give you the quote in writing before we start.