Government and public sector
Compliance for agencies, councils and government businesses
Checkpoint runs inside your own Microsoft 365 tenant, so your records never leave your environment. The documents your procurement and security teams will ask for are on this page.
Frameworks
The standards government buyers ask for
IS18 (QGEA)
Queensland Government agencies and their ICT suppliers
Read more →ISM, DISP and IRAP
Commonwealth agencies, Defence and Defence industry
Read more →Essential Eight
Every level of government, and suppliers asked to show a maturity level
Read more →RFFR
Employment services providers contracted by DEWR
Read more →ISO 27001, ISO 27701 and ISO 42001
Agencies, councils and government businesses certifying security, privacy or AI governance
Read more →Privacy Act (APPs)
Commonwealth agencies and the organisations covered by the Australian Privacy Principles
Read more →How to buy
Buying through your normal process
Queensland Government
Compliance365 is a supplier under the Queensland Government ICT Services Standing Offer Arrangement, on QITC terms. Agencies can engage us through that arrangement.
Purchase order and invoice
Licences and consulting can be invoiced against your purchase order instead of paid by card. Annual licences are invoiced in advance, consulting days monthly for time used.
Written quote first
Every engagement starts with a written quote: licences, any consulting days and timing. Nothing is invoiced before you accept it. Larger estates start from $14,999 a year per framework.
Prices on the pricing page are published in full, AUD ex GST.
Procurement documents
Ready before you ask
Download these for your vendor assessment. If your template asks something they don't cover, send it to us and we'll answer it.
Security questionnaire answers
Ready answers for a vendor assessment: data location, every connection out of your tenant, access, encryption, audit, AI and exit.
Open →The same answers as a spreadsheet
An Excel file to attach to your own assessment or supplier risk record.
Open →Security and architecture
How data flows, every Microsoft Graph permission and when it is requested, and our vulnerability disclosure policy.
Open →Accessibility statement
What is in place, known limitations and how to report a barrier.
Open →Common questions
What security and procurement teams ask
Where is our data held?
In your own Microsoft 365 tenant. Checkpoint's registers are SharePoint lists and its documents and evidence sit in a SharePoint library on a site you choose, so data stays wherever your tenant stores SharePoint content. Compliance365 does not operate a database of client records.
Who can sign in, and how?
Your own staff, with their Microsoft Entra ID accounts. Your Conditional Access policies and MFA apply. Checkpoint never sees or stores a password, and an external auditor can be given read-only access that expires on a date you set.
What permissions does it need?
Delegated Microsoft Graph permissions only, requested in stages as features are first used, so Checkpoint acts with the signed-in user's own access. The full list, and when each is requested, is published.
Is there an audit trail?
Yes. Every material change is appended to an audit log list in your own tenant, recording who, what and when. Every register, the audit log and the Statement of Applicability can be exported at any time.
What happens if we stop?
Your records stay where they have always been, in your SharePoint. Nothing you hold depends on a Compliance365 service being available.
Is it accessible?
Checkpoint is designed to WCAG 2.2 level AA. Our accessibility statement sets out what is in place and the known limitations.
Talk to us about your agency
A 30-minute call to understand your framework, your timeline and how you buy. We follow up with a written quote.
