Question:
Workcover Queensland (WCQ) has requested that all data is held in Australia. Does WCQ also require that all people accessing this data are resident in Australia or can suppliers use offshore resource for back-of-house activities, such as patching or upgrades?

What is WCQ's expected Hypercare period and expected support coverage during transition to BAU operations?

Does WCQ expect the supplier to buy back any existing equipment that is not end-of-life and provide this in the ‘as-a-Service’ construct? If so, can we have an asset list please.

Is WCQ expecting the supplier to manage our own secure access for engineering staff or use WCQ’s existing remote access solution?

Can WCQ please provide a representative sample of Incident, Problem, Change and Service Request ticket data for the past 12 months?

Can WCQ please provide an architectural outline of how the existing Meraki cloud portal is designed to meet the sovereign data requirement?

Is WCQ expecting CMDB integration in ServiceNow, in addition to ITIL processes?

Having reviewed WCQ’s Pricing and Technical requirements, we have identified a significant level of complexity and granularity required. We are intending to respond to all service areas outlined in the RFP, we respectfully request that the submission deadline be extended by two weeks. This additional time will enable us to provide a more robust and complete response.

Answered on 13/Jul/2026 03:36 PM:


Afternoon Tim,

In response to your clarification question WCQ make the following response:



1. Workcover Queensland (WCQ) has requested that all data is held in Australia. Does WCQ also require that all people accessing this data are resident in Australia or can suppliers use offshore resource for back-of-house activities, such as patching or upgrades?



Reply: Storage and processing of WCQ information must be onshore (Australia and its territories). If the supplier wishes to use resources that are offshore for maintenance and patching activities, then the must provide information about how they will ensure that WCQ information remains secure in accordance with the above.





2.What is WCQ's expected Hypercare period and expected support coverage during transition to BAU operations?



Reply: 4 weeks max.



3. Does WCQ expect the supplier to buy back any existing equipment that is not end-of-life and provide this in the ‘as-a-Service’ construct? If so, can we have an asset list please.

Reply:

Thank you for the question.

There is no requirement for the supplier to buy back any existing equipment, nor is there a requirement relating to the end-of-life status of existing assets.

We refer proponents to the Pricing Schedule, Module 1 – Hardware, specifically Column K, which references the useful life of assets.

The service required is a fully managed, end-to-end service, whereby the vendor is responsible for the provision, management, maintenance, and refresh of the hardware as part of the overall managed service offering.

Accordingly, WCQ is not seeking an asset buy-back arrangement and will not be providing an asset list for this purpose.

Vendors should demonstrate their asset lifecycle planning as part of their proposed managed service solution. This should include details of how assets will be procured, deployed, monitored, maintained, refreshed, and ultimately replaced throughout their useful life.

4. Is WCQ expecting the supplier to manage our own secure access for engineering staff or use WCQ’s existing remote access solution?



Reply:

The Supplier needs to provide a solution of how they would do this themselves via their own management and support.



5. Can WCQ please provide a representative sample of Incident, Problem, Change and Service Request ticket data for the past 12 months?



Reply:



This is to be a new greenfield solution and previous stats on incidents and problems is not relevant. However, WCQ is in the process of implementing several new improvements to its applications and services which are hosted externally of the Network. Therefore, it is difficult to predict the number of change requests that will be relevant to the Network through to 2030 and the supplier should provide options for WCQ to consider relating to the number of changes that may be required (i.e. firewall change requests).





6. Can WCQ please provide an architectural outline of how the existing Meraki cloud portal is designed to meet the sovereign data requirement?



Reply: No, the current Meraki solution is not relevant to this offer, other than it has been provided for context on the existing solution. WCQ is seeking a ‘new’ end-to-end solution offering that meets the requirements of this RFP.





7. Is WCQ expecting CMDB integration in ServiceNow, in addition to ITIL processes?



Reply: Partial or full ServiceNow integration would be ideal, but is not mandatory.

8.Having reviewed WCQ’s Pricing and Technical requirements, we have identified a significant level of complexity and granularity required. We are intending to respond to all service areas outlined in the RFP, we respectfully request that the submission deadline be extended by two weeks. This additional time will enable us to provide a more robust and complete response.

Reply: WCQ will advise Further on this questions to all vendors in the coming days.


Kind regards

Scott McNeil

Question:
Hi Scott,

For the Zero Trust access governance and segmentation requirements, is WCQ expecting enterprise NAC capabilities such as posture/compliance validation, Change of Authorization, TACACS+, advanced endpoint profiling, SDA/SGT-based segmentation and broader security ecosystem integration, or is a simplified NAC model based on Entra ID, 802.1X/MAB, certificate-based authentication, VLAN/group policy assignment and Adaptive Policy sufficient?

Answered on 20/Jul/2026 08:58 AM:
(edited on 20/Jul/2026 11:44 AM)


Good morning,

In response to your clarification question, WCQ make the following response:

WCQ is not expecting posture and compliance validation, as this is done by our Microsoft GSA client and we are not expecting this capability for our guest network.

WCQ has no requirement for TACACS+ as this is a vendor specific technology. However, if the supplier needs to use specific vendor technologies to secure their solution offered, then they should put it forward in their proposal.

Advanced endpoint profiling is not a specific requirement. However, suppliers are welcome to propose any additional security functionality that may help protect WCCCQ information assets.

We have provided details of our Entra, 802.1X and certificate-based authentication. (Naas_FR 20.)

Can you please clarify the following:

1. Please clarify what you mean by SDA / SGT based segmentation?

2. Please clarify what you mean by ‘Change of Authorisation’?


Kind regards,

Scott McNeil

Question:
Please provide us ticket volumes in the last 12 months across incidents, service requests, and change requests?

Are you expecting the bidders to do the integration work on your own Microsoft Sentinel?

Can you please provide specific LAN throughput requirements?

Does the NAC deployment require posture checking as part of the policy? If yes, can Workcover confirm that their own end user support team will be responsible for deploying and supporting and required agents?

Can you please expand on the service request management for desk relocations and port patching - does this mean patching/moving data points and cabling from the office floor to the data centre patch panel, and from patch panel to the switch?

Will you be able to provide us a high level floor plan for the HQ to be used for an initial wireless site survey?

Are the netskope NSGs going to be replaced by the UTMs as part of the target state? Will the UTMs then be expected to forward the traffic on to Netskope as part of the new architecture, or will that be done as part of the SDWAN fabric (that is out of scope)?

Are the product and unit definitions in the price book fixed or are we allowed to use our own definitions?

Are there enough redundant power points in all of the racks to accommodate parallel install of new equipment? Please call out where spare power points are not available.

The pricing sheet is asking for configuration of Microsoft Sentinel and Entra ID, however, in Part B that is mentioned as out of scope. Can you please clarify the requirement here - are bidders expected to configure Microsoft Sentinel and Entra ID as part of integration work?


What is the definition of as-a-service and Managed Service? Is WorkCover expecting them to be 2 separate costs?

Is WorkCover expecting the price of the hardware to be upfront, with the software and licensing components delivered as a service in tab 2?

The requirement asks about scaling bandwidth, but network services (carriage) are out of scope as per part B. Can you please clarify this requirement?(SR-NAAS-003 -Attachment 1)

What is the expectation for the NAAS with regards to security incident response given that SOC operations are out of scope?

Answered on 20/Jul/2026 08:55 AM:
(edited on 20/Jul/2026 12:41 PM)


In response to your clarification question WCQ make the following response:

1.Ticket Volumes

Question:

Please provide us ticket volumes in the last 12 months across incidents, service requests, and change requests?

Reply: This is to be a new greenfield solution and previous stats on incidents and problems is not relevant. However, WCQ is in the process of implementing several new improvements to its applications and services which are hosted externally of the Network. Therefore, it is difficult to predict the number of change requests that will be relevant to the Network through to 2030 and the supplier should provide options for WCQ to consider relating to the number of changes that may be required (i.e. firewall change requests).

2.Integration Query

Question:

Are you expecting the bidders to do the integration work on your own Microsoft Sentinel?

Reply: As this is to be a new greenfield solution, we would expect vendors to let us know how and what applications they would integrate to. We would expect vendors to do the work to export logs to Sentinel.


3.LAN throughput requirements

Question:

Can you please provide specific LAN throughput requirements?

Reply: We expect suppliers to use the information provided about our future internet links, client device numbers and cabling to determine a solution that will provide a future proof network with adequate capacity for the life of the contract.

4.Posture Checking for NAC deployment

Question:

Does the NAC deployment require posture checking as part of the policy? If yes, can Workcover confirm that their own end user support team will be responsible for deploying and supporting and required agents?

Reply: This is done by our Microsoft GSA client.

5. Desk Relocations and Port Patching

Question:

Can you please expand on the service request management for desk relocations and port patching - does this mean patching/moving data points and cabling from the office floor to the data centre patch panel, and from patch panel to the switch?

Reply: Changes to physical patching are fairly rare, however we expect the supplier to be responsible for undertaking any patching within cabinets (i.e port to switch, switch to WAP etc). WCQ is responsible for any cabling work from cabinets to end points. Patching requests will be initiated from out of ITSM (ServiceNow) and sent to the provider for action.

6. Floor Plan of WCQ

Question:

Will you be able to provide us a high level floor plan for the HQ to be used for an initial wireless site survey?

Reply: Yes. One can be provided.


7. Netskope NSGs in the Future State

Question:

Are the netskope NSGs going to be replaced by the UTMs as part of the target state? Will the UTMs then be expected to forward the traffic on to Netskope as part of the new architecture, or will that be done as part of the SDWAN fabric (that is out of scope)?

Reply: Suppliers need to note that we are not expecting them to take over management of existing solutions and we seeking a new overall solution (Note this does not mean suppliers cannot offer a same or similar solution using vendors which WCQ already utilises. We are intending to replace these edge routers. The Netskope solution is predominately used to support our Windows 10 client devices and we are currently rolling out Windows 11 devices, which does not use, nor reliant on Netskope. We plan to decommission these devices as part of the new network being deployed.


8. Power point supply to accommodate install of parallel equipment

Question:

Are there enough redundant power points in all of the racks to accommodate parallel install of new equipment? Please call out where spare power points are not available.

Reply: WCQ will ensure that adequate power is provisioned for suppliers needs for their proposed solution. The supplier will need to advise WCQ of power requirements during the design phase if they are successful.

9. Clarification regarding Microsoft Sentinal and Entra ID configuration

Question:

The pricing sheet is asking for configuration of Microsoft Sentinel and Entra ID, however, in Part B that is mentioned as out of scope. Can you please clarify the requirement here - are bidders expected to configure Microsoft Sentinel and Entra ID as part of integration work?

Reply: We expect integration with Microsoft Sentinel and Entra, however WCQ will perform all works on those platforms.

10. Scaling Bandwidth

Question:

The requirement asks about scaling bandwidth, but network services (carriage) are out of scope as per part B. Can you please clarify this requirement?(SR-NAAS-003 -Attachment 1)



Reply: We have two new internet links being installed which are capable of up to 10GB. See document WCQ667_NaaS_PartB_statement of Requirements_Final Pages 13 and 15. We are expecting suppliers to provide a solution that enables us to ramp up our internet link capacity as our business demands it.

11. Security Incident Response Scope Clarification

Question:

What is the expectation for the NAAS with regards to security incident response given that SOC operations are out of scope?

Reply: We expect integration with Microsoft Sentinel, which is managed by the WCQ security Operations Team. However, we expect the supplier to monitor the infrastructure, platforms and services that they provide (i.e. switches, WAPs, UTM firewalls, etc) for any Cyber security related threats and / or incidents 24/7 and respond accordingly to ensure that there is no harm or compromise of WCQ information assets. WCQ will not provide access to our Microsoft Sentinel, the supplier is to have their own SIEM or equivalent.

12. Hardware Costing and Deliverable Costing

Question:

Is WorkCover expecting the price of the hardware to be upfront, with the software and licensing components delivered as a service in tab 2?

Reply:

WorkCover expects respondents to provide separate pricing for the hardware and software/licensing components. Hardware should be priced as an upfront cost, while software and licensing should be priced separately as a service in Tab 2. As these are separable portions of the solution, the pricing should clearly distinguish between the one-off hardware costs and the ongoing software/licensing charges.

13. Managed Service and as-a-Service Definitions

Question:

What is the definition of as-a-service and Managed Service? Is WorkCover expecting them to be 2 separate costs?

Reply:

For the purposes of this procurement, As-a-Service refers to the provision of network capabilities, platforms, software, or licensing delivered on a recurring subscription basis. Managed Services refers to the ongoing operational management, monitoring, support, maintenance, and administration of the network environment.

Where your proposed solution includes both elements, please itemise and price them separately to provide transparency between the technology/service consumption costs and the ongoing service management costs.

Question:
Simplification Strategy – Cloud first or Cloud only? Since there is a scope for an alternative SDN proposal, we would also like to propose the on-prem HW and or virtualization offers hence the above ask.

Answered on 31/Jul/2026 12:47 PM:


Good afternoon,

Thank you for the question. We only want to have WAPs, Switches and UTM devices on premise. There is not opportunity for other equipment or infrastructure so we do expect cloud first. If a supplier proposes additional equipment then they will need to account for and include costs to provision power, UPS, cabling, racking, air-conditioning and any other infrastructure to support that equipment.

Kind regards,

Scott

Question:
HW and Software - 3- or 5-year term?

Answered on 30/Jul/2026 10:05 AM:


Morning Mihail,

Thank you for the question. The term is 5 years, this should be reflected in the pricing schedule to be completed by vendors.

Kind regards

Scott McNeil

Question:
What is the current NAC in place and how many active users, devices including BYoD, Mobiles to be used at same time?

Answered on 31/Jul/2026 12:48 PM:


Good afternoon,

Thank you for the question. Current NAC is Entra ID around 2000+ devices.

Kind regards,

Scott

Question:
We understood that the NAC solution is required for authentication and authorization and not for posture?

Answered on 31/Jul/2026 12:52 PM:


Good afternoon,

Thank you for the question. Entra ID is the NAC and not used for Posture. Posture is completed by Intune and posture is not a requirement.

Kind regards,

Scott

Question:
Could we get the existing devices serial numbers to determine the current license details?

Answered on 31/Jul/2026 12:55 PM:


Good afternoon,

Thank you for the question. All existing devices are compliant with licences.

Kind regards,

Scott

Question:
AD – Cloud first with hybrid or Cloud only with Entra-ID? This detail is required to propose the NAC solution accordingly

Answered on 31/Jul/2026 12:49 PM:


Good afternoon,

Thank you for the queston. We are Entra Native with Entra-ID and not requirement for AD.

Kind regards,

Scott

Question:
AD – Cloud first with hybrid or Cloud only with Entra-ID? This detail is required to propose the NAC solution accordingly

Answered on 31/Jul/2026 12:50 PM:


Good afternoon,

Thank you for the question. We are Entra Native with Entra-ID and not requirement for AD.

Kind regards,

Scott

Question:
The 10G Uplinks to the access switches are multi-mode or single mode?

Answered on 31/Jul/2026 12:51 PM:


Good afternoon,

Thank you for the question. The 10G Uplinks are Multi Mode Fibre.

Kind regards,

Scott

Question:
Do you have sufficient redundant fiber cabling from the core to the access layers? Floorwise? The number of fiber cores requirement depends on the number of stacks.

Answered on 31/Jul/2026 12:45 PM:


Good afternoon,

Thank you for the question. Yes, we have redundant fibre cabling and some spares for each floor. We have 4 pairs per floor.

Kind regards,

Scott

Question:
How many stacks are in the floor – 4 or 5 switches in a single stack?

With this response, we can conclude the number of fiber uplink requirements and it may not be required if we continue with the current switches , Max of 4. but required may be for furture expansion with-in the floor

Answered on 31/Jul/2026 12:53 PM:


Good afternoon,

Thank you for the question. What we have on each floor there is one switch stack per floor and in that stack, there are two fibre cables running to the core.

Kind regards,

Scott

Question:
Please confirm if the current quantity of access ports per floor meets the current and future WorkCover Queensland needs. Will any access ports increase be required at any floor? Alternatively, the number of ports per floor may be reduced, if the organisation adopts wireless-first or wireless-only office strategy

Answered on 04/Aug/2026 02:23 PM:


Good afternoon,

Thank you for your question. The current quantity of access ports meets current requirements. WCQ is looking to reduce ports and keep a LAN and Wireless strategy as stated in requirements.

Kind regards,

Scott

Question:
Please clarify what are the PoE requirements for the access ports per floor. PoE+ (802.3at) option for up to 30 watts per port or may be universal PoE option (802.3bt based) with 60W or 90W?

Answered on 04/Aug/2026 02:24 PM:


Good afternoon,

Thank you for your question. Currently we just use PoE+(802.3at) with our CW9164I access points. If the tendered solution from a supplier suggests we move to WIFI 7 models, then we will need PoE++(802.3bt).

Kind regards,

Scott.

Question:
Please clarify if there are any requirement for Multigigabit Ethernet access ports. And if yes, please list the number and type per floor. For example, the CW9164I WAPs have 2.5G Multigigabit Ethernet ports.

Answered on 04/Aug/2026 02:25 PM:


Good afternoon,

Thank you for your question. We currently have 4 access points per floor, then the 2X uplinks to the core switch.

Kind regards,

Scott

Question:
Please confirm, if the current wireless network provides sufficient coverage across all the floors with seamless roaming.

Answered on 04/Aug/2026 02:25 PM:


Good afternoon,

Thank you for your question. Yes it does.

Kind regards,

Scott

Question:
Please advise, if the cutover the new switching can be performed during weekdays or the preference is a weekend to minimise disruption to WorkCover Queensland.

Answered on 04/Aug/2026 02:26 PM:


Good afternoon,

Thank you for your question. The preference is outside of business hours which is specified in Requirements.

Kind regards,

Scott

Question:
To ensure that we provide a comprehensive, accurate, and high-quality response that fully addresses all requirements, we respectfully request a two-week extension to the tender submission deadline. The additional time will allow our team to complete further analysis, finalize supporting documentation, and submit a more detailed and competitive proposal.

Answered on 04/Aug/2026 02:27 PM:


As advised through the ITO Addendum issued on 13 July 2026, the closing date was extended to 5:00 PM (AEST) on Monday, 24 August 2026. This extension increased the overall tender period to eight (8) weeks.

Following consideration of your request, no further extensions will be granted. Suppliers are requested to submit their responses by the published closing date and time.

Question:
The WLAN estate is already current and Meraki-managed, but the document does not clearly state whether the existing 52 Meraki APs must be reused, transferred into the provider’s managed service, re-licensed, replaced, or commercially novated. Please clarify if you are open for all the options or WorkCover have a preference.

Answered on 04/Aug/2026 02:28 PM:


Good afternoon.

Thank you for your question. Yes, Workcover is open to all options. The current Meraki solution is not relevant to this offer, other than it has been provided for context on the existing solution. WCQ is seeking a ‘new’ end-to-end solution offering that meets the requirements of this RFP.

Kind regards,

Scott

Question:
The document mentions “Integration with Datadog and Sentinel” in the target state, but the formal integration platform section mentions Microsoft Sentinel, Microsoft Entra, ServiceNow, and open API access, while Datadog is not consistently carried into the later requirement sections. Please clarify.

Answered on 04/Aug/2026 02:28 PM:


Good afternoon,

Thank you for your question. As this is to be a new greenfield solution, we would expect vendors to let us know how and what applications they would integrate to. We expect integration with Microsoft Sentinel and Entra, however WCQ will perform all works on those platforms. We would expect vendors to do the work to export logs to Sentinel. Datadog isn’t mandatory.

Kind regards,

Scott

Question:
Please clarify who will own the routing between internal LAN, firewall, ISP routers, Microsoft cloud hub, AWS, Azure, and SSE/ZTNA services?

Answered on 04/Aug/2026 02:29 PM:


Good afternoon,

Thank you for your question. With regards to routing, all intra network routing is handled by WCQ. LAN to firewall, Office to Cloud, Cloud to Cloud, Cloud to Firewall. Firewall to internet is handled by WCQ and ISP, Internet side is ISP.

Kind regards,

Scott

Question:
Please confirm, who currently owns current Meraki AP licences, and can they be transferred, co-termed, or novated to the NaaS provider?

Answered on 04/Aug/2026 02:31 PM:


Good afternoon,

Thank you for your question. WCQ is seeking a ‘new’ end-to-end solution offering that meets the requirements of this RFP. The current Meraki solution is not relevant to this offer, other than it has been provided for context on the existing solution.

Kind regards,

Scott

Question:
The target port reduction table references both Meraki C9300 and Cisco C9300. Please confirm whether the preferred switch operating model is Cisco Catalyst managed traditionally, Catalyst managed via Meraki Dashboard, or another SD-LAN platform.

Answered on 04/Aug/2026 02:31 PM:


Good afternoon,

Thank you for your question. WCQ is seeking a ‘new’ end-to-end solution offering that meets the requirements of this RFP. The current Meraki solution is not relevant to this offer, other than it has been provided for context on the existing solution.

Kind regards,

Scott

Question:
Please clarify where is the default gateway expected to reside: core switch, firewall, SD-WAN/router, or another layer?

Answered on 04/Aug/2026 02:32 PM:


Good afternoon,

Suppliers are requested to tender to us their solution to meet WCQ’s requirements.

Kind regards,

Scott

Question:
Please confirm, if the expected core design is collapsed core, core-distribution-access, or firewall-centric segmentation?

Answered on 04/Aug/2026 02:33 PM:


Good afternoon,

Suppliers are welcome to propose multiple options based on the above or others, as long they meet our requirements.

Kind regards,

Scott

Question:
Current access uplinks are 2 x 10G. Please confirm, if 2 x 10G uplinks are sufficient for the target state, or should 25G/40G/100G uplinks be considered for core aggregation?

Answered on 04/Aug/2026 02:33 PM:


Good afternoon,

Thank you for your question. WCQ is not looking to go further than the 10G Links. These can be considered a minimum. Suppliers are to put forward their own recommendations and solution, to support our future. Based on internets links we specified in requirements.

Kind regards,

Scott

Question:
Please clarify, if guest Wi-Fi is in scope? If yes, please confirm captive portal, sponsor approval, internet-only breakout, logging, retention, branding, and isolation requirements.

Answered on 04/Aug/2026 02:35 PM:


Good afternoon,

Thank you for your question. Guest Wi-fi is called out as in scope in the Requirements. Suppliers are asked to provide their solution to meet requirements.

Kind regards,

Scott

Question:
Please provide required VLAN/VRF/security-zone matrix, including user, server, printer, IoT, AV, guest, management, voice, and wireless segments.

Answered on 04/Aug/2026 02:35 PM:


Good afternoon,

Thank you for your question. We expect the provider to produce a High Level and detailed design for these as part of the project.

Kind regards,

Scott

Question:
Please confirm, if an updated predictive and active wireless survey is required, considering the existing WLAN coverage inconsistencies?

Answered on 04/Aug/2026 02:38 PM:


Good afternoon,

Thank you for your question. Yes, an updated predictive and active wireless survey is required.

Kind regards,

Scott

Question:
Please define required integration method for Microsoft Sentinel, Entra ID, and ServiceNow, including API/Syslog/CEF, authentication, data fields, and ownership of connectors.

Answered on 04/Aug/2026 02:39 PM:


Good afternoon,

Thank you for your question. As this is to be a new greenfield solution, we would expect vendors to let us know how and what applications they would integrate to. We expect integration with Microsoft Sentinel and Entra, however WCQ will perform all works on those platforms. We would expect vendors to do the work to export logs to Sentinel.

Kind regards,

Scott

Question:
Target state mentions Datadog and Sentinel integration, but later sections focus on Sentinel, Entra, and ServiceNow. Please confirm, if Datadog integration is mandatory?

Answered on 04/Aug/2026 02:40 PM:


Good afternoon,

Thank you for your question. As this is to be a new greenfield solution, we would expect vendors to let us know how and what applications they would integrate to. We expect integration with Microsoft Sentinel and Entra. We would expect vendors to do the work to export logs to Sentinel. Datadog isn’t mandatory, but preferrable, but we do expect Log retention. The current local audit logs retention period is 30 days.

Kind regards,

Scott

Question:
The document requires management plane data and telemetry to be hosted and operated within Australia. Please confirm whether this applies to vendor cloud dashboards, logs, backups, support access, analytics, and AI/ML processing.

Answered on 04/Aug/2026 02:40 PM:


Good afternoon,

Thank you for your question. Yes, all logs, backups etc must be based in Australia.

Kind regards,

Scott

Question:
Please define log retention requirements for admin activity, NAC, firewall, wireless, switch events, configuration changes, and security events.

Answered on 04/Aug/2026 02:41 PM:


Good afternoon,

The local audit logs retention period is 30 days.

Kind regards,

Scott

Question:
Please define permitted maintenance windows, blackout periods, emergency change process, and approval workflow.

Answered on 04/Aug/2026 02:41 PM:


Good afternoon,

Thank you for your question. Outside of Business hours which is specified in Requirements. Emergency changes are per our notification process using ServiceNow. WCQ will notify its suppliers in advance any change blackout periods.

Kind regards,

Scott

Question:
Please clarify, what tool/process is expected for version-controlled network changes and pre-deployment compliance validation?

Answered on 04/Aug/2026 02:42 PM:


Good afternoon,

Thank you for your question. A ticket for ServiceNow will be raised and pre-compliance validation is as per standard Service Transition To Operations (STTO) at a Change Advisory Board (CAB).

Kind regards,

Scott

Question:
Hi There,

Can you please provide further information to the following:

The tender documentation appears to indicate that each floor should have 2 x uplink fibre connections to the Level 2 Core Network.

Could you please confirm whether the use of only 2 uplinks per floor is mandatory, or whether respondents may propose more than 2 fibre uplinks from the access switches on each floor back to the Level 2 Core for additional capacity, resiliency, or future growth?

Additionally, could you please advise the number of available fibre cores between Level 2 and each of Levels 6 through 18?

Understanding the available fibre infrastructure will assist in determining the optimal uplink design.

Thank you.

Answered on 05/Aug/2026 09:05 AM:


Good morning,

Thank you for your question. Two independent physical uplinks per floor are not mandatory. While a single uplink configuration is acceptable, it must utilize two aggregated fibre links connecting directly to the core switch. Tender respondents are permitted to propose alternative high-availability solutions that meet or exceed this performance. We have one switch stack per floor and two aggregated fibre links running to the core switch. We have spare fibre cabling for each floor that runs back to the Level 2 comms room. We have 4 pairs per floor.

Kind regards,

Scott

Question:
Hi, can you please clarify the below points:

1) The pricing Schedule mentions in the instructions "1.2 The contract term is 12 months, followed by 2 x 12 months. Suppliers are to complete pricing for each of the annual periods (i.e. year 1, 2 and 3)” Could you please clarify this given the pricing schedule requires 5 year pricing, and the ITO document states that “The initial period of the Contract will be three (3) years from Contract execution, with an option for WCQ to extend the term for up to two (2), one (1) year extension options.”

2) The Statement of Requirements document mentions “Alignment with WCQ's applicable security, regulatory, and governance obligations throughout the contract term,” could you please provide additional information around these obligations.

Appreciate your response.

Answered on 11/Aug/2026 11:14 AM:


Thank you for your query.

Question 1 : Pricing and Contract Term

For clarity, the Contract term is five (5) years in total, comprising:

an initial term of three (3) years from Contract execution; and

two (2) optional one (1) year extension periods, exercisable at WCQ's sole discretion.

Suppliers are required to complete pricing for the full five-year period provided within the Pricing Schedule, including Years 1 to 5 where applicable. This aligns with the Contract term described in the ITO documentation.

Question 2 : Security, Regulatory and Governance Obligations

The requirement for alignment with WCQ's applicable security, regulatory, and governance obligations is intended to ensure the proposed solution and ongoing service delivery operate in accordance with relevant Queensland Government and WCQ obligations, policies and standards.

This includes, but is not limited to:

Compliance with applicable Queensland Government ICT, security and architecture policies and standards.

Support for WCQ's security monitoring and incident response capabilities, including integration with Microsoft Sentinel.

Federation with WCQ's identity management controls through Microsoft Entra ID, including support for multi-factor authentication and conditional access policies.

Maintenance of comprehensive audit logging, operational documentation, security controls, and governance reporting throughout the Contract term.

Provision of information and artefacts reasonably required to support audit, assurance, compliance and regulatory review activities.

Tenderers should describe how their proposed solution and operating model will support these obligations throughout the Contract term.

Question:
We are seeking to confirm the intended Contract term, as it appears to be stated differently in three places within the tender:

Part A (Invitation and Conditions), clause 1.10(b), states an initial term of three (3) years from Contract execution, with options for WCQ to extend for up to two (2) further one (1) year periods.

Part D, Attachment 2 (Pricing Schedule), Instructions item 1.2, states the term is 12 months followed by 2 x 12 months, with pricing to be provided for years 1, 2 and 3.

The Managed Service worksheet (Separable Portion 5) within Attachment 2 provides price columns for years 1 to 5.

To ensure our Offer and pricing are accurate, conforming and represent best value, could WCQ please confirm:

a) the initial committed Contract term;

b) the number and length of any extension options, and whether these are exercised at WCQ's sole discretion; and

c) the number of annual pricing periods suppliers should complete in Attachment 2 (for example years 1 to 3, or years 1 to 5).

In addition, as the network hardware is supplier-funded and lifecycle-managed under the as-a-service model, could WCQ please confirm its preferred position on the treatment of that hardware at the end of the committed term if the Contract is not extended (for example continuation on as-a-service pricing, an agreed residual or buy-out value, or removal and make-good). This allows us to structure hardware and lifecycle pricing fairly and competitively over the correct term.

Answered on 09/Jul/2026 12:34 PM:
(edited on 06/Aug/2026 12:26 PM)


Thank you for your query.

For clarity, Part A (Invitation and Conditions) and Part D (Attachment 2 – Pricing Schedule) of the ITO reflect the same Contract term requirements.

The Contract term is five (5) years in total, comprising:

1. an initial term of three (3) years from Contract execution; and

2. two (2) optional extension periods of twelve (12) months each, exercisable at WCQ’s sole discretion.



Accordingly, suppliers should complete pricing for the full five-year period where provided within the Pricing Schedule. In particular, the Managed Service worksheet under Separable Portion 5 requires pricing for Years 1 to 5 to align with the maximum potential Contract term.

In relation to the treatment of network hardware at the end of the Contract term, this is a commercial matter for each vendor to address as part of its proposed solution and pricing. Vendors should refer to the Hardware tab within the Pricing Schedule, including Column K, which specifically seeks this information.

WCQ is not prescribing a preferred commercial model for end-of-term hardware treatment. Vendors should present their proposed approach and associated costs as part of their Offer. This may include, for example:

• continuation of services under an as-a-service arrangement;

• an agreed residual or buy-out value;

• removal and make-good obligations; or

• another commercially viable solution.

Any such approach proposed by a vendor will form part of its Offer and will be evaluated accordingly.

We trust this clarifies the Contract term requirements and pricing expectations.


Kind regards

Scott McNeil

Question:
Good morning,


Part B - Statement of Requirements, page 15, Figure 6 - Future State port count: Does the calculations include ports that are needed for the 52 (?) APs



Is the current Cisco Meraki Management platform hosted on the AWS Cisco Platform or is it hosted on a private platform?



Do you use Cisco ISE for Splash Page for the guest wifi?



Are the current Netskope NSG3000s out of scope for the WCQ667

Are the current Netskope NSG3000s providing any NAC, Micro-segmentation, policy enforcement, or perimeter security at the moment

Are there other devices required between the core switches and the Netskope NSG3000s to provide these security features



Can we participate in any RFP that has the WAN, SD-WAN, SAS-E services

Having the opportunity to provide an end-to-end security solution may drastically change the design of the NaaS service such as the Unified Observability and Analytics - cross domain visibility of the WLAN/LAN/WAN



Part B - Statement of Requirements, Section 1.2 Objectives: "Ensure Compliance with Govt ICT & Security Obligations" …. - where can these be found

Answered on 17/Jul/2026 01:29 PM:
(edited on 06/Aug/2026 12:33 PM)


1. Future State Port Count

Question:

Part B - Statement of Requirements, page 15, Figure 6 - Future State port count: Does the

calculations include ports that are needed for the 52 (?) APs

Reply: This is the current state, we expect suppliers to determine how many ports are required for

the solution. For example, the supplier needs to determine how many Wireless Access Points are

needed and therefore ensure that there are adequate switches etc. We do expect some capacity to

be available for future expansion and suppliers should respond accordingly on how capacity

would be addressed.

2. Meraki Management Platform Hosting

Question:

Is the current Cisco Meraki Management platform hosted on the AWS Cisco Platform or is it hosted

on a private platform?

Reply: Suppliers need to note that we are not expecting them to take over management of

existing solutions and we seeking a new overall solution (Note this does not mean suppliers

cannot offer a same or similar solution using vendors which WCQ already utilises. The following

information is only being provided as it is current state. Cisco Meraki management is hosted

entirely in the cloud across a globally distributed, redundant

infrastructure. dashboard.meraki.com: The primary global instance used for North America, South

America, and most of Asia-Pacific.

3. Guest Wi-Fi Splash Page

Question:

Do you use Cisco ISE for Splash Page for the guest wifi?

Reply: Suppliers need to note that we are not expecting them to take over management of

existing solutions and we seeking a new overall solution (Note this does not mean suppliers

cannot offer a same or similar solution using vendors which WCQ already utilises. Yes, we currently

use the cisco ISE solution.

4. Netskope NSG3000 Scope

Question:

Are the current Netskope NSG3000s out of scope for the WCQ667

Reply: Suppliers need to note that we are not expecting them to take over management of

existing solutions and we seeking a new overall solution (Note this does not mean suppliers

cannot offer a same or similar solution using vendors which WCQ already utilises. We are

intending to replace these edge routers. The Netskope solution is predominately used to support

our Windows 10 client devices and we are currently rolling out Windows 11 devices, which does

not use, nor reliant on Netskope. We plan to decommission these devices as part of the new

network being deployed.

5. Netskope NSG3000 Current Security Functions

Question:

Are the current Netskope NSG3000s providing any NAC, Micro-segmentation, policy enforcement,

or perimeter security at the moment

Reply: Suppliers need to note that we are not expecting them to take over management of

existing solutions and we seeking a new overall solution (Note this does not mean suppliers

cannot offer a same or similar solution using vendors which WCQ already utilises. NSG3000

provides Micro-segmentation, policy enforcement, perimeter security, SD-WAN connection to both

AWS and Azure. They also provide HA within edge router cluster and usage of 2 Internet links

simultaneously in Active/Active state. We expect suppliers to propose a new solution to provide

NAC, Micro-segmentation, policy enforcement, perimeter security and address all of the criteria as

per the RFP.

6. Additional Security Infrastructure

Question:

Are there other devices required between the core switches and the Netskope NSG3000s to

provide these security features

Reply: Suppliers need to note that we are not expecting them to take over management of

existing solutions and we seeking a new overall solution (Note this does not mean suppliers

cannot offer a same or similar solution using vendors which WCQ already utilises). No additional

devices are currently required between existing NSG3000 and Core switches as these are to be

decommissioned as part of the new NaaS solution. Suppliers need to propose an overall solution

for the Network

Question:
In the Total Cost sheet, we understand that the quoted price includes both the one-time charges and the managed services cost for the full 5-year term. Please kindly confirm.

Answered on 11/Aug/2026 11:15 AM:


Thank you for your query.

Yes, WCQ confirms that the Total Cost worksheet is intended to capture the overall cost of the proposed solution for the full five (5) year Contract term, including both:

one-time charges; and

managed service charges and any other recurring service costs as outlined within the ITO and Pricing Schedule.

Suppliers should ensure that the Total Cost accurately reflects all costs associated with the proposed solution over the maximum potential Contract term.

Question:
In Price Sheet 1: Hardware, our understanding is that this sheet captures the one-time hardware charges payable by the customer. Please kindly confirm.

Answered on 11/Aug/2026 11:16 AM:


Thank you for your query.

Price Sheet 1 – Hardware is intended to capture the hardware components associated with the supplier's proposed solution.

WCQ is seeking a new end-to-end Network as a Service solution that meets the requirements of this RFP. Information relating to the existing network environment has been provided for context only. Suppliers should therefore propose and price the hardware required to support their proposed solution and service offering in accordance with the requirements outlined in the RFP.

Suppliers should complete the Hardware pricing sheet based on the hardware components included within their proposed solution, together with any associated costs required to deliver the proposed service.

Question:
For Price Sheets 2, 4, and 5 (As-a-Service, Telecommunication Services, and Managed Services), we understand that these represent the recurring managed service charges applicable from Year 1 through Year 5. Please kindly confirm.

Answered on 11/Aug/2026 11:17 AM:


Thank you for your query.

Yes, WCQ confirms that Price Sheets 2, 4 and 5 (As-a-Service, Telecommunication Services and Managed Services) are intended to capture the recurring service charges associated with the supplier's proposed solution over the full five (5) year Contract term.

Suppliers should complete these pricing sheets based on the recurring costs applicable to their proposed end-to-end Network as a Service solution for each annual period (Years 1 to 5), in accordance with the requirements of the RFP. WCQ is seeking a new end-to-end solution and suppliers should therefore price their proposed service offering and associated recurring charges accordingly

Question:
As per our understanding, Hardware is one time upfront cost , Tab 2 - as a service is opex model cost , Tab 3- Systems Integration is installation and configuration of switches, Tab 5- Managed services is operational management, hope this is correct. Tab 4- Telecommunication Services- please help us understand the difference between Tab 4 and other Tabs. Thank you.

Answered on 11/Aug/2026 11:18 AM:


Thank you for your query.

WCQ confirms that suppliers should complete each pricing sheet based on the components, services and costs applicable to their proposed end-to-end Network as a Service solution.

In general terms:

Price Sheet 1 – Hardware is intended to capture the hardware components required to deliver the proposed solution.

Price Sheet 2 – as-a-Service is intended to capture applicable as-a-service components, including recurring platform, software, licensing or subscription-based costs.

Price Sheet 3 – Systems Integration is intended to capture implementation, integration, installation, configuration and related deliverable-based costs required to establish the proposed solution.

Price Sheet 5 – Managed Services is intended to capture the ongoing operational management, support, monitoring and service management costs associated with the proposed solution.

Price Sheet 4 – Telecommunication Services is intended to capture any telecommunication service-related components applicable to the supplier’s proposed solution, priced on a recurring monthly basis where relevant. This may include service-based network infrastructure, network security and access control services, cloud management or monitoring services, where these are provided as part of the supplier’s telecommunications service offering.

Suppliers should complete the relevant pricing sheets in accordance with their proposed solution and ensure that costs are clearly allocated to the most appropriate pricing sheet and are not duplicated across multiple sheets. WCQ is seeking a new end-to-end solution that meets the requirements of the RFP, and suppliers should price all components and services necessary to deliver that proposed solution.

Question:
Could you please clarify the difference between Sheet 6: ICT Professional Services and Sheet 7: Rate Card? Specifically, please explain the purpose and intended use of each sheet.

Answered on 11/Aug/2026 11:20 AM:


Thank you for your query.

Sheet 6 - ICT Professional Services is intended to capture the pricing for professional services that form part of the proposed solution scope, including activities such as discovery, solution design, installation, configuration, migration, testing, project management, documentation, hypercare, and other implementation-related services required to deliver the proposed solution. Suppliers should provide the estimated effort and associated pricing for these activities.

Sheet 7 - Rate Card is intended to capture the supplier's professional service rates by role or resource type for the professional services as described in Sheet 6.

Question:
Please clarify the payment terms and provide details on the frequency of payments (e.g., one-time, monthly or annually) for each of the pricing sheets.

Answered on 11/Aug/2026 11:23 AM:


Thank you for your query.

The Pricing Schedule has been structured to enable WCQ to evaluate the full cost of the proposed solution and does not prescribe payment terms or invoicing arrangements.

Suppliers should complete the pricing sheets as follows:

Sheet 1 – Hardware: Hardware-related costs associated with the proposed solution.

Sheet 2 – As-a-Service: Recurring service, platform, software, licensing, or subscription-based costs for each year of the Contract term.

Sheet 3 – Systems Integration: Implementation, integration, installation, configuration and related project deliverables required to establish the proposed solution.

Sheet 4 – Telecommunication Services: Recurring telecommunications service charges entered as monthly rates and calculated across each contract year.

Sheet 5 – Managed Services: Ongoing managed service and operational support costs, entered as monthly charges and annualised within the pricing schedule.

Sheet 6 – ICT Professional Services: Professional services effort and pricing associated with delivering the proposed solution.

Sheet 7 – Rate Card: Standard professional services rates for potential future work outside the proposed scope.

Question:
Our understanding is the documents named " WCQ667_NaaS_Part_C_QITC_Comprehensive_Contract-Final" and " WCQ667_NaaS_Part_D_Attachment_3_Contract_Departures_Final"are for reference & supposed to be responded once we’re shortlisted/ awarded?” and hence no need to submit it as part of RFP response which is due by 24th Aug? Please confirm.

Answered on 11/Aug/2026 11:27 AM:


Thank you for your query.

No, WCQ does not confirm this interpretation.

Suppliers should refer to the ITO documentation to determine all response requirements. Where a Contract Departures Schedule has been provided, suppliers are expected to identify and submit any proposed departures, qualifications, or amendments to the contract documentation as part of their Offer. This enables WCQ to assess contractual positions during the evaluation process.

The QITC Comprehensive Contract has been provided to inform suppliers of the contractual framework proposed by WCQ, while the Contract Departures Schedule provides the mechanism for suppliers to identify any requested departures from that framework.

Suppliers should ensure their Offer includes all information and completed schedules required under the ITO.

Question:
Hi,

Instructions within the Attachment 2 Pricing Schedule clearly state that vendors must enter information in every yellow cells and are not permitted to make any amendments to suit their offer, with any changes being deemed non-conforming. Our interpretation is also that the elements of the solution are to be assessed as ‘separable portions” (eg hardware is separable to managed services, and to system integration, etc). Clarity in respect of the following points would be appreciated:

Is WCQ potentially awarding separable portions of the end-to-end service offering to different parties?

We are unsure how to meaningfully represent an end-to-end Network As a Service offering within the price template proposed (eg hardware is requested in the format of a one-time charge at a component level). Does WCQ intend to meaningful evaluate submissions which are presented only in a non-conforming price response (conditional upon that alternative pricing structure being able to demonstrate transparency and pricing assurance in a manner which enables a clear understanding of the pricing)?

Answered on 13/Aug/2026 06:20 PM:


Thank you for your query.

WCQ has established pricing requirements to ensure a consistent basis for evaluating and comparing all Offers. Offerers are required to provide pricing information in the format requested as part of their submission.

The separable portions have been included to provide transparency regarding the individual components of a proposed solution and to support evaluation of the various service elements that comprise an Offer. Offerers may submit pricing for the separable portions relevant to their proposed solution and business model.

WCQ acknowledges that some Network as a Service offerings may be delivered using alternative commercial or bundled pricing models. This includes circumstances where elements such as hardware are commercially incorporated within a broader recurring service rather than presented as standalone charges. In these circumstances, Offerers should provide the requested pricing information and may also submit supporting pricing information, assumptions, explanatory material, or supporting documentation to assist WCQ in understanding their proposed commercial model.

Where supporting pricing information is provided, Offerers should ensure that it clearly identifies and explains the components of the proposed service, including, where applicable, hardware, telecommunications services, licensing, implementation and transition activities, managed services, professional services, and any other relevant pricing elements. The information provided should be sufficiently detailed, transparent, and capable of supporting a fair evaluation and comparison of submissions.

WCQ's objective is to obtain a clear understanding of the proposed solution and its associated costs. Accordingly, Offerers remain responsible for ensuring that their pricing submission is complete, transparent, and capable of evaluation against the requirements of the ITO.

Question:
Hi, how many devices does WorkCover have? (Number of active endpoint population including wired, wireless, IoT, AV, printers, guest devices and growth). This is required due to some of the licencing structures of the products we are using.

Answered on 13/Aug/2026 03:17 PM:


WorkCover has a total of approximately 2750 active endpoints. There is no confirmed material change expected to this approximation at present.

Question:
We require some clarification when it comes to the target state solution so that we can spec the NGFW correctly. On page 15 of the WCQ Network as a Service document the target state NaaS architecture design shows 2x 10Gbps uplink to the ISP's. On page 16 Under Internet Connectivity (out of scope) states that the internet connection will be 2x 5Gbps.

Question1: Should we spec the NGFW's (Next Generation Firewall) based on 5 Gbps or 10 Gbps throughput?

Question 2: What services from the NGFW are expected for example Threat Prevention, HTTP/TLS Inspection Performance ..., because each service acitivated reduces the throughput.

We want to make sure that we spec it based on your requirements and not under or over spec the solution.

Thank you for your help

Answered on 18/Aug/2026 12:01 PM:


Thank you for your query.

Question 1:

Should we spec the NGFW's (Next Generation Firewall) based on 5 Gbps or 10 Gbps throughput?

Reply: Currently the internet links are running 2 X 5GBs, this is the current set up. Suppliers could scale up these depending on their solution and how they can meet WCQ’s future needs.


Question 2:

What services from the NGFW are expected for example Threat Prevention, HTTP/TLS Inspection Performance ..., because each service activated reduces the throughput.

Reply: Requirements have been provided and suppliers will need to state their solution accordingly.

Question:
Good afternoon, we have a question in regard to User Requirements table in (Addendum)_WCQ667_NaaS_Attachement_1_Requirements_Final.xlxs

It is not clear what we should provide Under tab/column E, F, H (User Requirements).

Could you please provide an example in case we need to provide some input? Thank you

Answered on 19/Aug/2026 12:27 PM:


These columns are for internal use, and are not needed to be completed by suppliers. These columns can be ignored.

Question:
Please confirm, if you prefer any spare devices (switches and WAPs) to be store onsite?

Answered on 13/Aug/2026 03:18 PM:
(edited on 19/Aug/2026 11:48 AM)


Prefer 1 spare Wirelss Access Point and 1 spare switch to be kept onsite.

How many meeting rooms per floor and what network connectivity is required in each?

A: There 3 and sometime 4, these all have fibre connections already.

How many seats/desks per floor are there, based on 1 wired connection per desk.

A: 36 desks per floor. None one floor, and a two of the floors are smaller.

If you could please provide your closest estimate so we can ensure there is enough switch ports per floor.

A: There are 3 and sometimes 4, these all have fibre connections already.