ISO 27001 for government suppliers: is it worth it?
What ISO/IEC 27001 certification involves, why public buyers ask for it, how long and how much it typically takes for a small IT firm, and alternatives if you're not ready.
2 min read
Security, privacy and compliance
The certifications, security checks and privacy rules public buyers ask IT suppliers for, and what they cost.
Guides
Cyber Essentials for government suppliers in the UK
What the UK's Cyber Essentials and Cyber Essentials Plus schemes require, when central government contracts need them, and how small IT firms get certified.
2 min read
FedRAMP explained for small cloud and SaaS firms
What FedRAMP is, the impact levels and paths to authorization, what it means for small SaaS vendors wanting to sell to US federal agencies, and alternatives such as partnering.
2 min read
Security screening for IT suppliers to the Government of Canada
How the federal Contract Security Program works, the difference between organization and personnel screening, reliability status and secret clearances, and how small firms get sponsored.
2 min read
IRAP and the Essential Eight for selling IT to Australian government
What IRAP assessments and the ASD Essential Eight mean for IT and cloud suppliers to Australian government agencies, and how small firms can prepare.
2 min read
Data residency and sovereignty in public sector IT contracts
What data residency and data sovereignty rules mean for IT suppliers to government, how requirements differ by country and province, and how to answer them in a bid.
2 min read
Privacy impact assessments: what IT suppliers need to know
What a privacy impact assessment is, when public bodies need one for a new IT system, what the supplier is asked to provide, and how to make it go smoothly.
2 min read
GDPR for IT suppliers to European and UK public bodies
What the GDPR and UK GDPR mean for IT firms processing personal data for public sector buyers, the processor obligations, data processing agreements and international transfers.
2 min read
Open source in government procurement
How public buyers treat open-source software, policies that favour opening code built with public money, and how small firms can use open source to win and deliver public work.
2 min read
Checklists
Security questionnaire checklist for IT suppliers
The questions public buyers usually ask in vendor security questionnaires, and a checklist of documents and answers to prepare so you can respond in hours rather than weeks.
2 min read
Comparisons
SOC 2 vs ISO 27001: which do public buyers want?
The difference between a SOC 2 report and ISO 27001 certification, which public sector buyers prefer in which countries, and how to choose the right one for your firm.
2 min read