Tender: Corporate Reporting, Risk and Incident Management System Procurement

All data, including development and test, must remain in Australia and vendor must support extraction and irretrievable destruction; Deed and Requirements include slightly different deletion timeframes (60 days in Deed vs 90 days in Requirements) — check which applies and note the Deed can prevail over Vendor Contract.

Vendor Privacy & Security Deed imposes obligations that prevail over Vendor Contract and removes caps/exclusions for liabilities under the Deed — you may be unable to rely on usual contract liability caps

Mandatory security certifications and ongoing evidence required (ISO 27001, Essential Eight Level 2 evidence, CSA Level 2 STAR, ISO 42001, PCI DSS if financials, ASAE 3402 if financial transactions) — annual evidence may be requested