Construction
Tender questionnaires and supply-chain security, answered with evidence.
Head contractors, government panels and tier-1 builders ask subcontractors to answer security questionnaires before they will award the work. Defence suppliers see a stricter version of the same request. The questions are usually about accounts, email, backups and who looks after IT — and the firm that cannot answer them loses the tender, not an argument.
Your IT provider does the work. You’re the one who signs the insurer’s form.
In 2024–25, the average self-reported cost of cybercrime per report for a small business was A$56,600. ASD Annual Cyber Threat Report 2024–25.
Free 10-minute check
See whether you could answer an insurer’s cyber questions today. Eight short steps, no account.
Start the free 10-minute checkA first step
A tender is due in three weeks and it asks about multi-factor authentication, backups and how you handle a supplier’s documents. Could you answer it today?
In the Compliance Platform
- 1Upload the questionnaire, or start from the guided questions on accounts, email and backups.
- 2Send the technical questions to your IT provider. Record “not sure” where nobody knows yet — that is a gap to close, not a failure.
- 3Give each gap an owner and a date, and attach the evidence when it is done.
- 4Keep the pack, so the next tender starts from last time’s answers instead of a blank form.
What we can do for you
Cyber Guys can work through the questionnaire with you and your IT provider under an agreed scope, close what can be closed, and leave you with evidence for the answers you choose to give.
Done-for-You CyberWhat staff could practise
Site and accounts staff practise spotting a fake “updated drawing” or a changed bank-details request before anyone pays or opens the file.
User Awareness TrainingOther situations we see
A tier-1 security questionnaire
The builder’s portal asks whether every account uses multi-factor authentication, where backups are kept, and who would notice a compromised mailbox.
What helps: Answers recorded once, with the evidence beside them, so the office manager is not reconstructing it from old emails the night before the deadline.
Drawings shared with “anyone with the link”
A project folder of drawings and programmes was shared years ago and never reviewed. Subcontractors still have the link.
What helps: A review of shared links, access that matches the current project team, and a record of what was closed.
A supplier “updates” their bank details
An email that looks like a regular subcontractor asks accounts to change the account on a progress claim, the week the claim is due.
What helps: A call-back rule for every change of bank details, using a number you already hold, and email protections that make look-alike domains harder.
Privacy duties, including the Notifiable Data Breaches scheme, may apply when personal information is involved. Whether they apply to you is a question for your adviser. Read the terms.
Could you answer the tender questionnaire today?
Join the founding member waitlist, or take the free 10-minute check before the submission date.