| Q1 (LV-6) | Any ILAC-accredited testing lab is acceptable — not specifically iBeta. Must evidence accreditation scope, methodology, version, PAD assurance level, limitations. | sable-fit / Part 3a — broaden lab options |
| Q2 (TV-3) | Algorithm must be tested using diverse cohort per Digital ID Accreditation Data Standards: disability; diverse abilities including technology ability; diverse age, gender, ethnicity. Applies to vendor’s own algorithm, not FVS. | Part 3a TV-3 — add explicit diversity commitment |
| Q3 (H-2) | ATO is open to multiple deployment models — vendor-managed SaaS or ATO-managed within ATO AWS environment. Both should be described with infrastructure, ops, security, support, licensing implications. | Part 3a H-2 — add a second deployment-model description |
| Q4 (IN-4) | IaC required for the deployment model proposed, plus document responsibility split (vendor vs ATO). | Part 3a IN-4 — clarify responsibility matrix |
| Q5 (IN-1) | If MAUI not available at RFI response time, provide committed delivery approach, timeline, risks, dependencies. Phased delivery acceptable subject to ATO assessment. | Part 3a IN-1 — already a 4-6 week commitment; refine risk/dependency narrative |
| Q6 | Liveness only required at enrolment + reverification + recovery, NOT every login. 95M login figure is total activity, not liveness volume. | Part 3a P-1 / Pricing — clarifies sizing |
| Q7 (P-1) | 10 000/hr is combined projected + observed; applies to enrolments, reverifications, account recovery events. | Part 3a P-1 — explicit |
| Q8 (P-2) | No growth forecast available — respondents to provide their own Software Capacity Plan with assumptions, scalable architecture, headroom, constraints, scaling triggers, monitoring, commercial implications across contract term. | Part 3a P-2 — strengthen Capacity Plan narrative |
| Q9 (OP-9) | NV1 clearance needed before personnel access PROTECTED/production systems, no later than production go-live. Interim arrangements possible (restricted access, supervised access, role separation, use of already-cleared personnel, deferral) subject to ATO Security approval. Respondents must provide current clearance status, sponsorship assumptions, lead times, mitigation. | Part 3a OP-9 — add interim arrangement plan |
| Q10 (SC-6) | IRAP scope includes all components processing/storing/transmitting/administering/monitoring/supporting ATO data: production platform, management plane, support portal, admin tooling, integrations, logging/monitoring, connected environments. Respondents to define proposed scope, current status, residual gaps, timeline; IRAP readiness must align with security assurance + production-readiness milestones. | Part 3a SC-6 — broaden scope statement |
| Q11 (SC-5) | SC-5 applies across full delivery chain: subcontractors, sub-processors, PAD providers, hosting providers, support providers, telemetry, logging. Foreign-incorporated PAD vendor OK if all PI stays in Australia. | Part 3a SC-5 — already strong (no PI ever crosses boundary); add explicit sub-processor coverage |
| Q12 | Solution must follow privacy-by-design + data minimisation; biometric data must not be retained longer than required. | SABLE’s no-PI-server-side architecture: ideal fit; add explicit alignment statement |
| Q13 (TV-1) | No volume forecast for offshore NFC verification; phased delivery acceptable. | Part 3a TV-1 — already a 8-12 week phased commitment; add forecast acknowledgement |
| Q14 (OP-6) | Requirement is for organisational/operational controls, not clinical assessment: security awareness, escalation pathways, welfare/supervision, privileged access monitoring, separation of duties, peer review for sensitive actions, incident reporting, unusual access/behaviour detection. | Part 3a OP-6 — upgrade from Partially Compliant to Compliant with organisational-controls answer |
| Q15 (ISO 14001) | Must state in RFI response whether currently certified, aligned, or can achieve within 6 months. Must provide certification/alignment evidence, planned uplift, responsible owner, timeframe. | Part 3 General — add ISO 14001 statement |