No single statute says show training records before you can bid — but in 2026 the answer for most Australian government work is still yes. The Australian Government's own security framework expects annual cyber security awareness training for all personnel, and that expectation now flows through procurement: agencies score supplier security posture in tenders, prime contractors pass security questionnaires down to subcontractors, and cyber insurers ask for training records before they quote. If you sell to government, evidence of staff training has become part of the bid.
TL;DR
- No single law mandates training for every tender, but government buyers increasingly require evidence of it in procurement and security questionnaires.
- The root requirement sits in the Information Security Manual: annual awareness training for all personnel (control ISM-0252) and a maintained training register (ISM-2022).
- The Essential Eight — eight baseline mitigation strategies published by the Australian Signals Directorate — is the reference standard agencies and primes assess suppliers against.
- Evidence to have ready: per-learner completion records with dates, a training register, and phishing simulation results that trend over time.
- A security gap assessment shows where your evidence stands before the questionnaire arrives.
Is security awareness training required for government tenders?
| Buyer | What they check | Evidence they expect |
|---|---|---|
| Commonwealth agency | Supplier security posture in procurement | Documented, recurring staff training |
| Prime contractor | Security questionnaire passed down to subcontractors | Per-learner completion records |
| State and local government | Framework alignment (Essential Eight, ISO 27001) | Training register and certificates |
| Cyber insurer (behind the bid) | Human-layer controls before quoting | Completion history and simulation results |
Where the requirement comes from
The training requirement inside government is written down. The Information Security Manual, maintained by the Australian Signals Directorate, expects an organisation to provide cyber security awareness training to all personnel, tailored to general users and to classes of high-risk users. The ISM's personnel security guidelines spell out three controls that matter for a tender response:
- ISM-0252 — cyber security awareness training is undertaken annually by all personnel, covering the purpose of the training, authorised use of systems, protection of systems and reporting of incidents.
- ISM-1565 — tailored privileged user training is undertaken annually for everyone with privileged access.
- ISM-2022 — a cyber security awareness training register is developed, implemented and maintained.
That last control is the one bidders miss. The government's own standard does not just want training done — it wants a register that proves it, per person, with dates.
The framework most agencies measure against is the Essential Eight: eight baseline mitigation strategies published by ASD and public on cyber.gov.au. It is mandatory for non-corporate Commonwealth entities and is used as the reference standard by insurers, defence supply chains and larger customers assessing their vendors. User education is not one of the eight strategies, but an organisation that cannot show its people are trained will struggle to evidence the maturity levels the framework measures — a gap that surfaces in exactly the questionnaires tenders now carry.
The stakes behind those questionnaires are real. ASD recorded more than 84,700 cybercrime reports in FY2024-25 — one every six minutes — with an average self-reported cost of $56,600 for small businesses. Agencies know the human layer is where most breaches start; Verizon's 2025 Data Breach Investigations Report again found a human element in roughly 60% of breaches. It is why supplier security questions keep moving from firewalls to people.
How the requirement reaches suppliers
Three channels, and most tenders travel through more than one:
- Direct procurement questions. Agencies increasingly ask bidders to describe security controls, including staff awareness training, in their response — sometimes as a scored criterion, sometimes as a condition of contract.
- Pass-down from primes. A subcontractor rarely sees the agency's security schedule directly, but the prime contractor's questionnaire carries it. Fail the prime's security questions and the work goes elsewhere, even though you never dealt with the agency.
- Insurance and certification behind the bid. Cyber insurers ask for training records before quoting the policy that covers the contract; certifications such as ISO 27001 and PCI DSS expect documented, recurring awareness training. The tender is where all three land at once.
What evidence to have ready
- Per-learner completion records with dates — the register ISM-2022 describes. A spreadsheet of we did training once is not evidence; a dated record per person is.
- Certificates on pass. Branded, verifiable course certificates show competence, not attendance.
- Phishing simulation results that trend. Click rate falling and report rate rising over months is the single most persuasive human-layer number in a response. The published benchmark buyers recognise is KnowBe4's 2026 report — phishing susceptibility falling from 33.2% before training to 4.2% after twelve months of sustained monthly training and simulation.
- Framework mapping. Completion records mapped to the Essential Eight, ISO 27001 or PCI DSS clauses the buyer cares about, so the assessor does not have to do the join themselves.
Cyber Aware's awareness training issues branded certificates on pass and tracks completion per learner, and human risk reporting exports the branded PDF pack an agency assessor or insurer asks for. For MSPs serving government-adjacent clients, that export is the difference between answering a questionnaire in an hour and scrambling for a month.
How to build the evidence before the tender
- Run a baseline phishing simulation before you announce any programme. The uncoached first click rate is the honest number every later improvement is measured against.
- Move to a monthly cadence. An annual session produces a one-line answer; monthly training produces a trend line, and the trend line is what scores.
- Keep the register. Export per-learner completion with dates every month, not the week the tender is due — back-filling a register in 2026 is exactly what it sounds like.
- Map the evidence to the framework the buyer names in the RFT, and attach it rather than describing it.
- Check where you actually stand first. A security gap assessment tells you which control the next dollar belongs to — training, or something the questionnaire will also probe.
FAQ
Is security awareness training legally required for government tenders? No single law says so. The practical requirement comes from the Australian Government's own security framework — annual training for all personnel under the ISM — and from procurement and questionnaire processes that increasingly ask suppliers to evidence it.
What is a cyber security awareness training register? A maintained record of who completed which training and when. ISM control ISM-2022 requires government organisations to keep one, and suppliers are wise to hold the equivalent, because it is the artefact assessors and insurers actually ask to see.
Do small suppliers need this too, or only big primes? Small suppliers need it more. Primes push their agency's security requirements down to every subcontractor, and a 10-person firm with dated training records answers the questionnaire in minutes while a larger unevidenced competitor scrambles.
How much training counts as enough? The ISM baseline is annual training for all personnel. In practice, monthly short training with phishing simulations is what produces the trend evidence tenders and insurers respond to — the published 33.2% to 4.2% reduction is a twelve-month, monthly-cadence result.
What if we have no simulation results yet? Run a baseline simulation now, unannounced. Even one month of click and report data beats a questionnaire answer that says training is planned.
One last thing
The question behind the question is not whether you have done training — it is whether you can prove it per person, with dates, today. If the honest answer is no, the fix costs one month of cadence, not one tender cycle.