A WA agency sends over a contract renewal, and this time there is a page of new clauses: report any cyber security incident within 24 hours, keep your security certifications current for the life of the contract, hand back or securely destroy our data at the end. Or a tender asks how mature your information security is and whether anyone independent has checked. Either way, the reason is usually the same document.
The Western Australian Government Cyber Security Policy sets the baseline cyber security practices for WA Government entities. It is published by the Office of Digital Government (DGov) in the Department of the Premier and Cabinet. The current edition is the 2024 policy, which replaced the 2021 one, and as of October 2026 it is still the edition on wa.gov.au. It is written for agencies, not suppliers, but a good share of it lands on suppliers through procurement.
This is a plain English overview. Read the policy itself before you rely on any one clause.
Who it applies to
The policy applies to the WA public sector as defined in the Public Sector Management Act 1994, plus a list of other bodies. That list includes the WA Police Force, the public universities, all Government Trading Enterprises and health service providers under the Health Services Act 2016. Local governments are not bound by it, but are encouraged to follow it.
A Premier's Circular (2025/13, issued July 2025) backs it up. It tells every entity in scope to implement the policy, connect to DGov's whole-of-government Security Operations Centre and report to DGov every year on how implementation is going.
Who the Cyber Security Unit is
The WA Cyber Security Unit sits in DGov. It was set up in 2018, is led by the state's Chief Information Security Officer and is based at Dumas House in West Perth. Under the policy it supports agencies to improve their security, coordinates the response when an incident affects more than one agency, works with the ACSC and other governments, and sets the baseline for cyber security risk in government procurement. Its listed initiatives include the whole-of-government Security Operations Centre and penetration testing for agencies.
What agencies must do
The policy is organised under six headings: govern, identify, protect, detect, respond and recover. The parts a supplier will feel most:
- Essential Eight to maturity level one, at minimum. Each entity must implement the ACSC's Essential Eight to maturity level one, as the ACSC defined it in November 2022, and continue to level two where appropriate. We explain the levels in Essential Eight maturity levels.
- The "Further Five". Unless their risk assessment says otherwise, entities must also implement five more strategies from the ACSC's Strategies to Mitigate Cyber Security Incidents: server application hardening, blocking spoofed emails, network segmentation, continuous incident detection and response, and personnel management.
- Continuous monitoring. Each entity needs a SIEM with continuous incident detection and response, feeding incident information to DGov's Security Operations Centre.
- Tight incident timeframes. The incident response plan must have the entity triage an incident and develop a response within 4 hours, report confirmed incidents to DGov within 24 hours of detection, and report relevant incidents to the ACSC through ReportCyber within 24 hours. The plan must be tested every year.
- No ransom payments by default. The WA Government does not support paying ransoms, and only the Security and Emergency Committee of Cabinet can approve one.
- An annual report. Entities complete an Annual Implementation Report for DGov, approved by their accountable authority (the director general or CEO).
What it means for suppliers
Section 3.4, information secure procurement, is the part written with you in mind. It applies to new procurements, and to existing contracts when an extension option lets the terms be renegotiated.
Before buying, an agency must assess the risk to its information and do due diligence on the supplier's information security maturity. Where appropriate, that includes whether you have been independently assessed or certified against an industry standard. The policy gives IRAP, the ISO 27000 series and SOC 2 as examples. For high-risk procurements involving managed service providers or cloud providers, it says to prefer offerings with an IRAP assessment or similar industry certification. Agencies must also check that suppliers and their subcontractors carry insurance that fits the risk, including cyber cover, and consider the WA Data Offshoring Position if your service stores or handles their data overseas.
Then come the contract clauses. Agencies must include information security clauses wherever government information is involved, and the policy says those clauses should cover:
- Reporting any cyber security incident to the agency within 24 hours of detection.
- Keeping relevant security certifications for the whole contract.
- Keeping the agency's information adequately secured throughout.
- Securely disposing of the agency's information, or returning it, when the contract ends.
- Penalties or early termination if you fail to meet the security requirements.
Read clause 1 carefully. The policy borrows NIST's definition of an incident, which includes events that only potentially put systems or information at risk. If your own detection is slow, you can't report inside 24 hours, so that clause is really a question about your monitoring.
Is it working inside government?
The Auditor General's December 2025 report on state government information systems found real improvement, but information and cyber security controls remain the weak spot. Of 359 findings reported to 53 entities, over 80% fell in the information and cyber security categories, and two thirds were unresolved from earlier years. Fewer than a quarter of the entities assessed met the benchmark for access management and endpoint security.
Expect pressure on agencies to keep rising, and expect more of it to reach their suppliers' contracts.
How to get ready
- Get to Essential Eight maturity level one yourself. Agencies are held to it, and due diligence questionnaires tend to ask the same questions. Assess each strategy honestly and keep the evidence.
- Decide what you can show an assessor. If you already hold, or are working towards, a certification, have the certificate and its scope ready. If you have none, know what you would say instead.
- Test your 24 hour clock. Pick a plausible incident, such as a compromised staff mailbox, and time how long it takes to detect it, confirm it and get a written report to a client. That gap is your real risk.
- Know where client data lives. List the cloud services and subcontractors that touch it, and in which countries.
- Write down the end of the contract. How you return data and how you destroy it, with a record that you did.
- Check your insurance. Confirm your cyber cover is current and in proportion to the contracts you are bidding for.
If you think something has already happened
If you supply a WA agency and you suspect an incident touching its systems or data, check your contract for the reporting clause and the contact, and start the clock now rather than when you are sure. Report the incident to the ACSC through ReportCyber at cyber.gov.au (opens in a new tab) or call 1300 CYBER1 (1300 292 371). If personal information may be involved, check whether the Notifiable Data Breaches scheme applies.
Where Geidi fits
Geidi is a Perth IT company that has been operating since 2000, working with organisations of 5 to 1,000 staff. Our cyber security service provides a 24/7 security operations centre and security practices aligned to Essential Eight, ISO/IEC 27001 and SMB1001. If you're preparing for a WA government tender or contract, talk to us.
Sources
- Office of Digital Government, WA: 2024 WA Government Cyber Security Policy (publication page) (opens in a new tab)
- Office of Digital Government, WA: Western Australian Government Cyber Security Policy 2024, PDF (opens in a new tab)
- Department of the Premier and Cabinet, WA: Cyber Security Measures for WA Government Entities, Premier's Circular 2025/13 (opens in a new tab)
- Office of Digital Government, WA: Cyber Security Unit (opens in a new tab)
- Office of the Auditor General, WA: State Government 2025, Information Systems Audit Results (opens in a new tab)
- Australian Cyber Security Centre: Essential Eight maturity model (opens in a new tab)
- Australian Cyber Security Centre: Report a cyber security incident (opens in a new tab)
