Security Accreditation AI Adoption and Data Protection Services

This Tender is invited by the Issuer. Overview The Department of Social Services (ACT) is seeking a supplier to provide security accreditation, AI adoption and data protection services for critical systems and applications. Scope The scope includes: Completing Authority to Operate (ATO) requirements Preparing a complete system authorisation package, including a draft authorisation brief developed under the guidance of the DSS Cyber Security team Assessing and validating the security controls, governance arrangements and technical configurations supporting Microsoft 365 and Microsoft Purview Assessing and validating data classification Assessing and validating sensitivity labelling Assessing and validating baseline data loss prevention controls Assessing and validating retention labelling and records management Assessing and validating risk management Assessing and validating audit and reporting Assessing oversharing assessment capability Assessing initial governance and operational support arrangements Assessing how AI-enabled services interact with departmental records, ensuring appropriate guardrails, access controls, monitoring, and risk mitigation measures are established prior to implementation Supporting the establishment of governance and security foundations required for the safe and scalable adoption of Microsoft 365 Copilot, Microsoft 365 Agents and other AI enabled capabilities across the Department Enabling departmental staff to maintain the authorisation framework and system register following completion of the engagement Providing explanatory materials that enable the Department to understand and apply the findings of discovery work Services will be delivered digitally, with stakeholder engagement via virtual workshops or on-site sessions in the ACT as required. Contractor Requirements The supplier must demonstrate alignment to: ASD Information Security Manual (ISM) Protective Security Policy Framework (PSPF) ISO/IEC 27005 (information security risk management) ASD Essential Eight / ASD Essentials