Question:
Is ISO 27001 certification a strict mandatory requirement for this tender, or will an equivalent certification such as SOC 2 Type 2 also be accepted as evidence of information security controls?

Answered on 20/Nov/2025 03:26 PM:


ISO 27001 certification is not a strict mandatory requirement for this tender. Our objective is to gain assurance that the supplier has a robust information security management approach across the organisation that has been independently validated by a reputable third party.



Alternative certifications, such as SOC 2 Type 2 or similar, will be considered where they provide a generally equivalent level of assurance. The certification should broadly address areas aligned with ISO 27001 and its Annex A controls, including, but not limited to:

• Risk management and governance

• Incident management

• Third-party risk management

• Software patching and vulnerability management

• Secure access and identity management

If the supplier holds a certification or otherwise demonstrates comparable coverage and maturity in these areas, please provide details as part of your submission.

Question:
Good afternoon,

Can you please confirm the closing date for accepting submissions. In the Invitation to Offer document we note the closing date to be 12/12/2025, however, in the VendorPanel portal it is noted as 19/12/2025.

Answered on 24/Nov/2025 09:14 AM:


I confirm that the closing Date is the 12/12/2025.

Question:
Good morning,

Can I please confirm the address for service for the out of hours security operations. Are you only looking to service TAFE in Toowoomba?

Thanks

Answered on 24/Nov/2025 02:37 PM:


All TAFE Queensland campuses and locations are in scope. The out-of-hours security centre operations service covers TAFE Queensland’s threat detection and response to the entirety of TAFE Queensland’s information technology environment, including:

o Cloud-based services

o Data centres

o Information technology and information security events and incidents across all campuses

Examples include unexpected activity on regional servers, network infrastructure, or end-user computing devices.

There is no expectation of out-of-hours physical security presence at any specific premises, such as security guards. For clarity, physical security services are out of scope for this initiative.

General information about TAFE Queensland campus locations can be found at Campus Locations & Course Information | TAFE Queensland.

Question:
Hi, can volumetrics please be supplied? TY

Answered on 25/Nov/2025 11:56 AM:


TAFE Queensland Cyber has approximately 17,500 end user devices and 350 servers all of which have various logging forwarded to our SIEM. Total log and event volumes can be discussed with the successful supplier during the contract finalisation phase.

Question:
Also is this closing on 12th or 19th December 2025 as I can see conflicting information?

Answered on 24/Nov/2025 02:40 PM:


I confirm the closing date is the 12 December 2025

Question:
Hi,

Can you please confirm the current SIEM daily ingestion and total endpoints in scope for TQC0013783

Answered on 25/Nov/2025 11:57 AM:


TAFE Queensland Cyber has approximately 17,500 end user devices and 350 servers all of which have various logging forwarded to our SIEM. Total log and event volumes can be discussed with the successful supplier during the contract finalisation phase.

Question:
Can you please confirm is

3.1.7 ISO 27001 Compliance

The supplier must maintain active ISO 27001 certification and comply with ASD’s Essential Eight Maturity Model to a Maturity Level three rating.

Is ESD E8 maturity Level Three Mandatory?

Answered on 02/Dec/2025 03:49 PM:


TAFE Queensland strongly values robust information security practices. While ISO 27001 certification and adherence to ASD’s Essential Eight Maturity Model at Maturity Level Three are not strictly mandatory, they represent the level of assurance we aim to achieve for this initiative.

- ISO 27001 Certification: Ongoing, externally validated certification in the effective operation of an Information Security Management System is highly desirable as it provides additional assurance of a supplier’s capability.

- Essential Eight Maturity Level Three: This reflects the level of control implementation we expect from a supplier delivering the requested services.

Suppliers who do not currently maintain ISO 27001 certification or have not fully implemented Essential Eight at Maturity Level Three are invited to apply. In such cases, we ask that you provide clear evidence of strong organisational information security management practices and demonstrate alignment with the principles and controls represented by these standards.

Examples of acceptable alternative evidence may include customer facing copies of documents such as:

- Documented Information Security Management System (ISMS) policies and procedures

- Results of recent internal or external security audits

- Penetration testing reports or vulnerability management processes

- Statements outlining alignment with ASD Essential Eight controls and maturity objectives

- Certifications or attestations for related frameworks

In summary, while specific certifications may not be in place, we expect suppliers to provide evidence of equivalent practices. A higher degree of assurance is achieved when working with externally certified organisations, but strong, demonstrable security practices will also be considered as part of the evaluation.

Question:
Hello TAFE Queensland, could you please answer the following questions?

1. SIEM & Monitoring Scope

Is Sentinel configured for MSSP / Lighthouse multi-tenant access?

Please confirm which additional tools (Umbrella, Canary, ThreatLocker, 1Password, Meraki, Elastic) are in scope for OOH monitoring, if any.

Can TQ provide the full list of log sources currently ingested into Sentinel?

What percentage of TQ’s key systems are already onboarded into Sentinel, and which sources are planned but not yet onboarded?

Are AWS, GCP or other SaaS environments part of the monitoring scope?

2. Defender & Endpoint Coverage

Which Defender components are deployed (MDE, MDI, MDO, MDCA, Defender for Cloud, etc.)?

What is the current endpoint/server coverage percentage for MDE?

Are there legacy or unsupported platforms where Defender cannot be deployed?

3. Volumes, Rules & Use-Cases

What are the typical monthly alert volumes from Sentinel/Defender?

What are the average monthly incident numbers for S1–S4 during OOH periods?

How many analytics rules/use-cases are active, and how many are considered high-fidelity vs under-tuning?

Which use-cases are highest priority for OOH attention (e.g. ransomware, ATO, exfiltration)?

4. SOPs, Severity & SLAs

Can TQ provide its formal severity definitions for S1–S4?

What are the response and resolution SLAs for each severity (BH vs OOH)?

How often are SOPs and the ISIRP updated, and how will changes be communicated?

Are all playbooks complete, or will some require joint development?

5. Escalation & Communication

What are the OOH escalation paths, contacts, and expected timeframes?

Are there different escalation paths for cyber vs service outages, or for student-impacting incidents?

Does TQ use incident bridges/war rooms for major incidents, and how should the supplier join them?

What communication channels are preferred for real-time OOH contact (SMS, phone, Teams, email)?

Are there collaboration/Teams tenant restrictions?

6. Access, Identity & Security Controls

Will SOC operators use Entra ID, PIM, break-glass roles, JIT access, or VDI/jump hosts?

Are there IP allow-lists or specific remote access controls?

Which Azure region(s) host Sentinel and TQ workloads?

Are any offshore services currently approved under exemptions?

Are additional personnel checks required (e.g. police, WWCC, baseline vetting) beyond citizenship/PR?

7. Reporting, KPIs & Threat Intelligence

What monthly/quarterly reports, dashboards or KPIs does TQ require?

Which KPIs should be tracked (MTTD, MTTR, false positives, tuning outcomes)?

Should the supplier bring their own threat intelligence feeds?

8. Rule Governance, Tuning & Improvement

What is the approval workflow for new analytics rules (CAB, pipeline, fast-track)?

What is the preferred frequency for rule reviews (e.g. quarterly)?

Does TQ maintain a continuous improvement register, and can the supplier contribute?

9. ITSM & Ticketing

Should the supplier work directly inside TQ’s ServiceNow instance, or integrate via API/email?

10. Transition & Scope Boundaries

Will there be a parallel run with the internal SOC before full OOH handover?

Are there upcoming SIEM/Defender/network projects that may impact SOC operations?

Are any campuses, business units, or third-party managed systems explicitly out of scope or limited in visibility

Answered on 02/Dec/2025 08:29 AM:


The answers to the above question are in the attached file Addendum 1.

Question:
Good afternoon, can you please confirm if we are to complete the Security Supplier Questionnaire and submit as part of our tender response? or acknowledge agreement to complete it if appointed the successful supplier.

Answered on 05/Dec/2025 11:58 AM:


Yes, the Criteria for Suppliers Questionnaire must be completed and submitted with your tender response. It helps us assess your security controls and identify any associated risks, which is a key part of our decision-making process.

Although the document is marked OFFICIAL: Sensitive and treated accordingly, please tailor your responses to reflect your security posture without sharing information that could compromise your organisation. We’re looking for an overview of your practices, not exhaustive internal details.

Question:
I understand you’re looking for after-hours SOC coverage.

From our side, if we proposed a full 24/7 SOC model as the first layer of support — where we’re actively triaging alerts around the clock — would that still be something you’d consider?

The reason I ask is because going after-hours-only usually creates gaps, delays and extra handovers.

Answered on 02/Dec/2025 08:17 AM:


A full 24/7 SOC model would be considered. During business hours, TQCS will maintain active monitoring and incident response, and the supplier can work alongside our cyber team in the incident queue to ensure seamless collaboration. Outside of business hours, the supplier will have full responsibility for monitoring and response, so their primary focus should be on ensuring complete after-hours coverage.

Question:
If you are currently using defender and MS Sentinel.

Could I get more understanding of the monitoring environment.

1 How many Identities?

2 How many endpoints (desktop/laptops)?

3 How many servers?

4 How many sites?

5 How data do you ingest for MS Sentinel?

Answered on 05/Dec/2025 12:01 PM:


1. ~1.8M Identities in total

2.~17.5K devices sending logs in to the SIEM

3. ~350 servers sending logs in to the SIEM across environments

4. TAFE Queensland delivers training across more than 60 sites statewide. Physical travel is not required, as all devices log events centrally. Any tasks that may require on-site access can be submitted as service requests.



5. Avg Events Per Second over the past 90 days ~5700

Question:
Hello, we note that Tafe QLD requires ASD E8 Maturity Level 3 from suppliers, is this mandatory to respond?

Answered on 05/Dec/2025 11:00 AM:


TAFE Queensland strongly values robust information security practices. While ISO 27001 certification and adherence to ASD’s Essential Eight Maturity Model at Maturity Level Three are not strictly mandatory, they represent the level of assurance we aim to achieve for this initiative.

- ISO 27001 Certification: Ongoing, externally validated certification in the effective operation of an Information Security Management System is highly desirable as it provides additional assurance of a supplier’s capability.

- Essential Eight Maturity Level Three: This reflects the level of control implementation we expect from a supplier delivering the requested services.

Suppliers who do not currently maintain ISO 27001 certification or have not fully implemented Essential Eight at Maturity Level Three are invited to apply. In such cases, we ask that you provide clear evidence of strong organisational information security management practices and demonstrate alignment with the principles and controls represented by these standards.

Examples of acceptable alternative evidence may include customer facing copies of documents such as:

- Documented Information Security Management System (ISMS) policies and procedures

- Results of recent internal or external security audits

- Penetration testing reports or vulnerability management processes

- Statements outlining alignment with ASD Essential Eight controls and maturity objectives

- Certifications or attestations for related frameworks

In summary, while specific certifications may not be in place, we expect suppliers to provide evidence of equivalent practices. A higher degree of assurance is achieved when working with externally certified organisations, but strong, demonstrable security practices will also be considered as part of the evaluation.

Question:
Hello TAFE Queensland Procurement Team, we would appreciate answers to the following questions to ensure our proposal is accurate. Thank you in advance for any further clarity you can provide.

1. Scope & SLAs

a. Can TQ share historic alert volumes and EPS (last 3 to 6 months) from Sentinel and Defender to size roster and response capacity?

b. What are the target MTTA/MTTR per severity level (Info, Low, Medium, High), and are service credits linked to OOH SLA breaches?

c. Are you able to confirm formal S1/S2 criteria and expected OOH actions (e.g., bridge leadership, containment authority)?

2. Technology & Access

a. Can TQ provide a list of current log sources and retention periods for Sentinel and Defender?

b. For non-core tools (Cisco Umbrella, ThreatLocker, Canary, 1Password, Elastic, Meraki), are OOH actions advisory only, or can MSP execute changes under emergency change control?

3. Process & Governance

a. Which ticketing and communication platforms (ServiceNow, Jira, Teams, phone bridge) are used for incidents and handovers? What is the required handover format and timing?

b. What qualifies as an after-hours emergency change, who approves, and what evidence artefacts are required post-change for QITC compliance?

4. Compliance & Sovereignty

a. What evidence format and cadence does TQ expect for Essential Eight ML3 and ISO?27001 compliance?

5. Current Process

a. How has the Out of Hours support being managed until now?

b. What is the volume and kind of incidents observed during Out of Hours in the last 3 – 6 months?

Answered on 04/Dec/2025 12:34 PM:


Scope and SLAs:

Q. Can TQ share historic alert volumes and EPS (last 3 to 6 months) from Sentinel and Defender to size roster and response capacity?

A. The OOH times to be covered by the supplier typically generate around 300 - 350 alerts over a month. EPS avg over 90 days is ~5700



Q. What are the target MTTA/MTTR per severity level (Info, Low, Medium, High), and are service credits linked to OOH SLA breaches?

A. Target MTTA/MTTR values will be agreed during contract finalisation. TQ expects suppliers to propose achievable SLAs for OOH operations. Service credits are not defined at this stage but may form part of contractual negotiations.



Q. Are you able to confirm formal S1/S2 criteria and expected OOH actions (e.g., bridge leadership, containment authority)?

A. Incident severity is determined using an Impact vs Scope matrix. This is defined as part of TQ's Information Security Incident Response Plan details and may be shared with select suppliers under NDA. Where an S1/S2 event is suspect, immediate escalation to Director, Cyber Security and Manager, Cyber Security Operations is required. The supplier will have authority to perform containment and eradication actions across all level is incident severity with specific guard rails to be defined. These guard rails may include limitations of these activities for specific accounts and servers / domain controllers.



Technology & Access:

Q. Can TQ provide a list of current log sources and retention periods for Sentinel and Defender?

A. Logs shipped into Sentinel are retained for 180 days. A total of 67 unique tables logged events in to Sentinel over the past 30 days. These tables include device event information, network activity, identity information, office details and more. 7 Data collection rules are configured in Azure. More specific information may be shared with select suppliers under NDA.



Q. For non-core tools (Cisco Umbrella, ThreatLocker, Canary, 1Password, Elastic, Meraki), are OOH actions advisory only, or can MSP execute changes under emergency change control?

A. The additional tools noted above are not directly in scope for OOH monitoring however some of these tools are sending logs in to the SIEM and have custom alerts configured. Additionally, in a small number of instances accessing these platforms can provide further information or context when triaging an alert. As a result, any familiarity with these tools would be considered beneficial. The supplier is not authorised to make changes directly in these platforms without explicit approval.



Process & Governance:

Q. Which ticketing and communication platforms (ServiceNow, Jira, Teams, phone bridge) are used for incidents and handovers? What is the required handover format and timing?

A. ServiceNow is used for internal incident management. OOH suppliers will operate primarily in Sentinel and provide structured handover reports via agreed templates. Timing will be confirmed during onboarding.



Q. What qualifies as an after-hours emergency change, who approves, and what evidence artefacts are required post-change for QITC compliance?

A. When an emergency change is required to be implemented to address an information security incident as per the Information Security Incident Response Plan at least two senior TAFE Queensland Cyber Security Team staff members must authorise the change to be implemented in accordance with the TAFE Queensland Academic and Other Delegations. As a result, where an emergency change is identified as required, this will require immediate escalation to both Director, Cyber Security and Manager, Cyber Security Operations.



Compliance & Sovereignty:

Q. What evidence format and cadence does TQ expect for Essential Eight ML3 and ISO 27001 compliance?

A. Suppliers should provide formal certification artefacts for ISO?27001 and documented alignment for Essential Eight ML3. Reporting cadence will be agreed.



Current Process:

Q. How has the Out of Hours support been managed until now?

A. OOH support is managed internally by TQ’s Cyber Security team and augmented by OOH automation. The new model seeks to expand and extend coverage.



Q. What is the volume and kind of incidents observed during Out of Hours in the last 3–6 months?

A. This has been addressed when responding to Scope and SLAs question 1.

Question:
To assist with providing an accurate proposal can TAFE QLD provide clarification on the following:

1. What is the user count of TAFE QLD.

2. What is the size of the existing SOC team.

3. What is the current alert count each day and in particular

3.what is the alert count outside of office hour.

Answered on 05/Dec/2025 12:03 PM:


1. ~1.8M Identities in total

2. 4 people

3. Avg Events Per Second over the past 90 days ~5700

4. Typically monthly alert volume for the OOH periods to be covered are around 300 - 350 alerts per month

Question:
We note the requirement for an Australian-based SOC team, with all staff being Australian citizens or permanent residents. Before finalising our response, could you please confirm whether TAFE Queensland would consider a follow-the-sun operational model where monitoring is performed across Brisbane, Sydney and London, while all data remains region-locked within Australia and all incident response activities are led, coordinated and escalated locally by Australian-based personnel?

Additionally, could you please clarify whether staff working in Australia on valid long-term work visas (all holding current Australian police clearances) would meet the intent of this requirement?

Answered on 04/Dec/2025 02:53 PM:


TAFE Queensland’s preference remains for an Australian based SOC team staffed by Australian citizens or permanent residents. Variations may be considered if the supplier demonstrates strong alignment with our security, sovereignty, and operational needs. Regarding a follow-the-sun model, data sovereignty and local control are critical, any arrangement involving offshore personnel would need to ensure compliance with Government security and privacy obligations.

Question:
Hi Queensland Tafe,

I understand you are not looking to supply any internal environment details such as endpoints, users, identities etc. How do you want a supplier to provide pricing? its hard to provide a monthly cost without scope.

Can you provide suggestions on what you want to see in the first stages? e.g. asset cost?

Answered on 04/Dec/2025 02:52 PM:


Q. I understand you are not looking to supply any internal environment details such as endpoints, users, identities etc. How do you want a supplier to provide pricing? its hard to provide a monthly cost without scope. Can you provide suggestions on what you want to see in the first stages? e.g. asset cost?

A. Typically monthly alert volume for the OOH periods to be covered are around 300 - 350 alerts per month. Avg Events Per Second over the past 90 days ~5700. There are approximately 17.5K end user compute devices sending logs in to the SIEM. There are approximately 350 servers sending logs in to the SIEM across environments.