Engineering capacity behind Australia's government IT primes.
FISTA Solutions delivers as a subcontractor to Australian primes on federal and state government IT work, including BuyICT panel holders and DTA-aligned programs. The prime holds the panel position, clearances, and customer relationship; FISTA supplies engineering capacity for applications, cloud, data, and AI, with government data kept in certified Australian hosting and workshare designed around the ISM and Essential Eight.
- 150+
- projects delivered
- 50+
- companies served
- 99.9%
- verified uptime
- 47%
- efficiency gains
- 12+
- countries reached
Panels and portals
Which Australian panels and portals matter, and where does FISTA fit?
Federal ICT buying runs through AusTender and the Digital Transformation Agency's BuyICT marketplace, which replaced the Digital Marketplace, with panel arrangements that let agencies buy from pre-qualified suppliers. States run their own portals. Panel holders need delivery capacity to perform on the work they win; FISTA is the subcontractor behind them.
| Panel or portal | What it is | FISTA's role |
|---|---|---|
| AusTender | The Australian Government's procurement information system for tenders and contract notices | Intelligence on winning primes; sub to those primes |
| BuyICT (DTA) | The whole-of-government ICT marketplace and panels, successor to the Digital Marketplace | Delivery subcontractor to panel holders on engagements |
| Digital Transformation Agency | Sets the Digital Service Standard, hosting certification, and whole-of-government ICT policy | Defines the standards FISTA's work packages are built to |
| buy.nsw and NSW eTendering | New South Wales procurement and prequalification schemes | Sub to NSW scheme members on digital and data work |
| Buying for Victoria | Victoria's procurement portal and panels | Sub to Victorian panel suppliers |
| QTenders and Tenders WA | Queensland and Western Australia procurement portals | Sub to state suppliers on modernization and digital services |
Work packages
What work packages does FISTA take behind Australian primes?
Digital services built to the Digital Service Standard patterns, cloud on Australian regions, data platforms, AI agents over agency knowledge, modernization of legacy systems, and accessibility to WCAG 2.1 AA. Each is delivered against de-identified data with government data staying in certified Australian hosting the prime or agency owns.
- 01
Digital services to the Digital Service Standard
Citizen and business services built to the DTA's standard, with research inputs from the prime and accessibility and performance evidence from FISTA.
Services - 02
Cloud on Australian regions
Infrastructure as code, hardened pipelines, and observability on IRAP-assessed cloud services in accounts the prime or agency owns.
Cloud - 03
Data platforms and reporting
Pipelines, warehouses, and reporting with lineage and reconciliation evidence for agency programs.
Data - 04
AI agents and document intelligence
Claude-based agents and document-processing pipelines with permissions, evaluation, and human review designed for public scrutiny.
AI - 05
Legacy modernization
API layers and incremental migration for aging federal and state systems, sequenced around live services.
Modernization - 06
Accessibility to WCAG 2.1 AA
Conformance built in for the Digital Service Standard and the Disability Discrimination Act context, with assistive-technology test evidence.
Accessibility
Flow-downs
What flows down, and how does FISTA handle it?
Australian government contracts flow down the Information Security Manual and Essential Eight controls, personnel security under the Protective Security Policy Framework, the Hosting Certification Framework, IRAP-assessed cloud requirements, and the Privacy Act. FISTA maps its controls to the ISM and Essential Eight, keeps data in certified hosting, and leaves cleared work with the prime.
| Obligation | What it requires | How FISTA handles it |
|---|---|---|
| ISM and Essential Eight | The Australian Cyber Security Centre's control manual and its eight baseline mitigation strategies at a required maturity level | Controls mapped in the security practices summary; maturity status stated, not implied |
| PSPF personnel security | Baseline and higher clearances for personnel with access to classified or sensitive systems | Stays with the prime's cleared staff; FISTA's workshare excludes cleared access |
| Hosting Certification Framework | Government data hosted with certified providers | Certified hosting in the prime's or agency's accounts; FISTA holds only work-package access |
| IRAP-assessed cloud | Cloud services assessed under the Infosec Registered Assessors Program | Build on assessed services; FISTA claims no assessment of its own |
| Privacy Act and Australian Privacy Principles | Handling of personal information, including overseas disclosure rules | DPA with the prime; de-identified development data; access limited and logged |
| Digital Service Standard | Design, accessibility, and performance criteria for government digital services | Built to the standard with evidence per criterion FISTA is responsible for |
General guidance for teaming planning, not legal advice.
Working day
How does the time zone work?
Faisalabad is UTC+5; Sydney, Melbourne, and Brisbane are UTC+10 (UTC+11 in daylight time). Pakistan's morning is Australia's afternoon, which gives a daily window for stand-ups, reviews, and decisions, and FISTA's afternoon work lands before the Australian team starts the next day. The cadence is written into every task order.
Perth, at UTC+8, shares a longer window. For programs that need more overlap with the eastern states, FISTA shifts working hours for the engineers on the package and records that in the teaming agreement. The specification names the window, the ceremonies, and the handover format.
Teaming call → engagement
How does an Australian teaming engagement start?
With a call on the panel or contract, the agency, and the work packages. FISTA sends the due-diligence pack under NDA, the teaming agreement fixes workshare around clearances and hosting, and the first engagement runs specification to acceptance with evidence the prime can present to the agency.
- 1
Teaming call
Twenty minutes on your pursuits, the work packages you need covered, the flow-downs in play, and whether FISTA's capacity and time zone fit. No deck; a conversation between delivery people.
OutputFit decision and a named pursuit or task-order scope
- 2
Due-diligence pack under NDA
Capabilities statement, rate card by role, key personnel, security practices summary, registration and certification status, references, and FISTA's NDA and teaming templates, or yours.
OutputEverything your contracts and compliance reviewers ask for
- 3
Teaming agreement or subcontract
Scope, workshare, exclusivity per pursuit, rates, flow-down clauses, data handling, IP, key personnel, and exit terms fixed in writing before any task order starts.
OutputSigned agreement with the flow-down set reviewed line by line
- 4
Task-order delivery
Each work package runs specification to verified production: a written spec, a working system, an evidence package, and documentation you can hand to the contracting officer.
OutputAccepted deliverables and a past-performance letter
Regulatory and procurement references on this page are general guidance for planning a teaming engagement, not legal advice. Confirm obligations with your contracts and legal teams for each solicitation.
Clear answers
What primes ask before teaming.
Straightforward guidance for evaluating scope, fit, and the next step.
01Can offshore engineers work on Australian government data?
Only within what the contract and the Privacy Act's overseas-disclosure rules allow, which in practice means FISTA develops and tests against de-identified or synthetic data while government data stays in certified Australian hosting the prime or agency owns. Access to production systems, where needed, is limited, logged, and covered by the prime's terms.
02Does FISTA hold an IRAP assessment or an Essential Eight maturity rating?
No claim is made. FISTA builds on IRAP-assessed cloud services in the prime's accounts and maps its engineering controls to the ISM and the Essential Eight; the due-diligence pack states any assessment or maturity status exactly as it is. Where a requirement is hard for FISTA's workshare, it is written into the agreement with a date or carved out.
03Which states does FISTA work in?
Any state where the prime holds the contract or scheme position. New South Wales, Victoria, Queensland, and Western Australia are named here because they run the largest state ICT programs and their own portals; the model is the same everywhere: sub to the supplier that holds the position.
04Do you build to the Digital Service Standard?
Yes. FISTA's work packages are built to the DTA's Digital Service Standard for the criteria FISTA is responsible for, with accessibility to WCAG 2.1 AA, performance evidence, and documentation. User research and service ownership criteria stay with the prime and the agency.
05How quickly can an engagement start?
After the teaming agreement is signed and the work package is specified. Timing depends on scope, environment access, and the seniority required, and is stated per engagement rather than promised generically, with the first evidence gate visible in the first week.
Six markets
Every market FISTA subcontracts in
- 01SLED and federal civilianUnited StatesOpen the market brief
- 02G-Cloud, CCS, NHS, TEDUK and EuropeOpen the market brief
- 03Digital Agency-era programsJapanOpen the market brief
- 04UAE, KSA, Qatar, Kuwait, Bahrain, OmanMENAOpen the market brief
- 05Federal supply arrangements, provincesCanadaOpen the market brief
- 06BuyICT, DTA, statesAustraliaOpen the market brief
Continue exploring
Related capabilities
Sub-first, on the record
Name the panel and the agency. We will propose the workshare.
Tell us which panel or state contract you hold, the agency, and the work packages. FISTA sends the pack and a workshare that keeps clearances and certified hosting with you.