Searches for procurement guidelines in Australia usually lead to one of two things. The first is the Commonwealth Procurement Rules, which Commonwealth entities must follow when they buy. The second is the internal policy a private organisation writes for itself. This guide explains what the Commonwealth rules require, which parts are worth borrowing, and sets out a practical set of guidelines for buying enterprise technology, including cybersecurity and AI.
CYBORIUM is an independent technology procurement service. The selected provider pays CYBORIUM a capped fee. The client contracts directly with that provider, and CYBORIUM does not sell, deliver, operate or invoice the technology.
The Commonwealth Procurement Rules in brief
The Commonwealth Procurement Rules are issued by the Minister for Finance and apply to Commonwealth entities covered by the Public Governance, Performance and Accountability Act 2013. Their central requirement is value for money. That means considering the financial and non-financial costs and benefits of each option over the whole life of the arrangement, not just the lowest price. The rules also expect encouragement of competition, efficient and ethical use of resources, accountability and transparency, and records that show how a decision was reached. States and territories have their own frameworks.
Private organisations are not bound by these rules, but the principles travel well. A decision that shows value for money over the full contract life, fair treatment of suppliers and a clear record is easier to defend to a board or an auditor. The Australian National Audit Office publishes insights on where audited procurements fall short, and the common themes are weak planning, poor documentation of evaluation and weak contract management.
Eight guidelines for enterprise technology procurement
1. Define the problem before the product
Write down the business outcome, the users, the constraints and what happens if nothing is bought. Many procurements go wrong because a product was chosen before the problem was agreed.
2. Prioritise requirements
Separate mandatory requirements from preferences. A method such as MoSCoW prioritisation stops a long feature list from hiding the few requirements that decide success.
3. Scan the market properly
Look beyond the incumbent and the vendors already known to the team. Record which options were considered and why some were excluded.
4. Put risk and due diligence into the approach to market
Ask for security, privacy, financial viability, subcontractor, data location and exit information in the request itself, so it is scored alongside capability and price. Regulated entities should align this with APRA CPS 230 and CPS 234 obligations.
5. Agree the evaluation method before responses arrive
Set criteria, weightings and the scoring scale in advance. Score written evidence first, then use demonstrations to confirm claims. Record conflicts of interest for everyone on the panel.
6. Model the whole-of-life cost
Compare cost over the expected contract term, including implementation, integration, internal effort, growth, price escalation and exit. Test pricing at more than one volume. CYBORIUM's technology cost calculator models that same whole-of-life comparison across five years, showing the total by year and by cost line next to the quoted price.
7. Settle the terms that matter before selection closes
Service levels, incident notification, data handling, liability, renewal pricing and exit assistance are easier to negotiate while more than one provider is still in contention.
8. Manage the contract after signature
Assign an owner, set review dates, track obligations and start renewal planning well before the notice period. Value is often lost after selection, when nobody checks whether the provider delivers what was promised.
A checklist for policy use
- The business need and success measures are documented and approved.
- Requirements are prioritised, with mandatory requirements clearly identified.
- The market scan, shortlist and exclusions are recorded.
- Security, privacy, supplier risk and exit questions are part of the approach to market.
- Evaluation criteria, weightings and panel conflicts are recorded before responses are opened.
- Whole-of-life cost is modelled under at least two volume scenarios.
- Key contract terms are negotiated before the preferred provider is confirmed.
- A contract owner, review schedule and renewal date are assigned.
- The decision record explains why the selected option offers the best value.
Applying the guidelines to cybersecurity and AI
For cybersecurity purchases, add evidence of how the product or service performs against scenarios relevant to the organisation, and settle incident notification and evidence access in the contract. Our cybersecurity vendor evaluation framework covers this in detail.
For AI purchases, add questions about how customer data is used, whether it trains shared models, how outputs are tested and how material model changes are notified. See the enterprise AI vendor selection criteria.
How CYBORIUM helps
CYBORIUM applies these guidelines to cybersecurity, AI and enterprise IT purchases: defining requirements, running the market approach, evaluating evidence, modelling cost and supporting negotiation. The organisation keeps the decision and contracts directly with the selected provider. For governance detail, read procurement governance for enterprise technology.
Updated 15 September 2026. This guide is general information about procurement practice. It does not provide legal advice, and Commonwealth entities should rely on the current Commonwealth Procurement Rules and Department of Finance guidance.
Standards and further reading
A playbook is only as good as the standards it can point at when someone asks why a decision was made.
- Commonwealth Procurement Rules. The obligations Commonwealth entities buy under, and the clearest published statement of what value for money requires.
- ISO 31000:2018. Risk management vocabulary that lets a procurement decision be expressed in terms a board already accepts.
- ANAO procurement and contract management insights. Where audited procurements actually go wrong, which is a better guide to controls than a theoretical framework.
Related from CYBORIUM
Also relevant: strategic sourcing for procurement leaders.
Which procurement rules apply to your organisation?
Commonwealth entities follow the Commonwealth Procurement Rules. Other organisations are not bound by them but can borrow the structure: value for money, ethical conduct and a record of the decision.
What counts as value for money?
Not the lowest price alone. The Commonwealth rules weigh cost over the life of the purchase, quality, risk and fitness for purpose.
If this is on your list this year, a short conversation can save weeks. Contact CYBORIUM or request a free market briefing.
Last updated:
