AI inventory, risk tiering and accountability; guardrails for LLM applications and agents; failure-mode analysis, evaluation and red-teaming; model risk management for scoring and automated decisioning; alignment to the Guidance for AI Adoption, ISO/IEC 42001, NIST AI RMF and OWASP Top 10 for LLM Applications
Workshops, executive briefings, hands-on labs and expert consultations in AI, software engineering, cloud, data and security, on-site in Adelaide or online
Web and mobile apps (React, Next.js, Flutter, .NET, Node.js, Python and others); Internal tools, portals and workflow automation; API design and system integration
AI opportunity discovery workshops; AI readiness and data maturity assessments; Responsible AI policy aligned to Australia's AI Ethics Principles and Voluntary AI Safety Standard
Customer service chatbots for websites, Teams and Slack; Internal knowledge assistants grounded in your documents; Agentic workflows that automate multi-step tasks with human approval
Process discovery and automation opportunity assessment; Workflow automation with Power Automate, Logic Apps and AWS Step Functions; Robotic process automation (RPA) for legacy systems without APIs
UX/UI design and brand-consistent design systems; Static and headless CMS websites with very fast load times; WCAG 2.2 AA accessibility and technical SEO
Application and cloud support with clear service levels; Monitoring, patching and backup management; ACSC Essential Eight assessments and uplift
Differentiators
SA economic benefit
Local ownership and local delivery staff, aligned to the SA Industry Participation Policy.
Security & compliance
Essential Eight-aligned delivery, the Australian Privacy Principles, and the SA Information Security Management Framework (ISMF) considered in design.
Responsible AI
AI governance aligned to national guidance, with human oversight and audit logging.
Agile & transparent
Fortnightly demos, clear reporting and fixed-price discovery phases that reduce procurement risk.
Corporate documents available on request
Certificates of currency: public liability, professional indemnity and cyber insurance
Information security, privacy, WHS, quality and modern slavery policies
Conflict of interest and confidentiality procedures
Key personnel CVs
Standards we help you meet
We help you design and evidence the technical controls behind these standards. We are not an assessor or auditor, and we do not claim certification against them. Assurance comes from accredited bodies and qualified assessors. This is general guidance, not legal advice, and obligations vary.
APRA CPS 230 Operational Risk Management: critical operations, tolerance levels, continuity testing and material service provider management for regulated entities and the suppliers that serve them.
APRA CPS 234 Information Security: third-party assurance, incident notification and control testing.
Security of Critical Infrastructure Act 2018: risk management program inputs and cyber incident reporting readiness.
ACSC Essential Eight, ISO/IEC 27001:2022 and the SA Information Security Management Framework.
Privacy Act 1988 and the Notifiable Data Breaches scheme, PCI DSS v4.0.1 and SOC 2 evidence for suppliers.
Practical guide for SA agencies, councils, NFPs and SMEs on APPs, NDB assessment clocks, and how privacy fits with CPS 230/234, SOCI and Essential Eight.
What APRA CPS 230 means for ICT leaders: critical operations, tolerance levels, continuity testing, material service providers and notification timeframes.
How SA councils make FOI and records work faster and easier to defend: State Records and GDS 40 duties, the 30-day FOI clock, search, redaction, 90-day plan.
How SA agencies and councils put Zero Trust into practice with Microsoft Entra Conditional Access: MFA, device trust, risk-based policy, break-glass and a 90-day plan.
How SA councils and small businesses stop spoofed email and fake invoice scams: SPF, DKIM and DMARC in plain words, a safe path to reject and a 90-day plan.
How SA agencies, councils and SMEs can modernise legacy systems: rehost, replatform, repurchase or rebuild, incremental cutover, data migration and RFT scope.
What SA agencies and councils should require for backup and DR in ICT tenders: RTO/RPO, immutable copies, restore tests, Australian residency and evidence.
What WCAG 2.2 Level AA means for South Australian agency and council websites, common audit failures, and how to write accessibility into tenders and CMS migrations.
How the SA Industry Participation Policy and Economic Contribution Test apply to ICT tenders, and how Adelaide SMEs can evidence local jobs and supply chains.
Practical guide for SA agencies, councils, NFPs and SMEs on APPs, NDB assessment clocks, and how privacy fits with CPS 230/234, SOCI and Essential Eight.
Why SA agencies ask for Australian cloud regions, how AWS and Azure residency works in practice, Privacy Act basics, and tender questions that go beyond a residency checkbox.
We support suppliers and primes through SA Government procurement channels. Prime contractors can engage us as a subcontractor, and agencies can contact us about opportunities where their procurement rules allow. Our guide to SA Government ICT panels explains how panels work.
Can you subcontract or team with a prime contractor?
Yes. We can deliver a defined package of work, such as AI proof of value, application development, cloud automation or accessibility remediation, inside a larger program. We agree scope, reporting lines and how our participation is described in the bid before submission.
How do you address the SA Industry Participation Policy?
EITSAA is South Australian owned, based in Adelaide. For each opportunity we prepare an Economic Contribution Test or Industry Participation Plan response based on the actual resourcing plan, so commitments are realistic and reportable. Read our guide to the SA Industry Participation Policy for ICT SMEs.
Which corporate documents can you provide?
On request we provide certificates of currency for our insurances, our information security, privacy, WHS, quality and modern slavery policies, conflict of interest and confidentiality procedures, and key personnel CVs. Tell us the opportunity number and the documents the buyer needs.
Can you help with APRA CPS 230 and CPS 234?
We help regulated entities and their suppliers design and evidence the technology side: critical operation dependency maps, recovery designs, resilience tests, provider registers and exit plans, and incident notification workflows. We are not an assessor, auditor or law firm, and we do not claim certification against these standards. Start with CPS 230 explained for ICT leaders. This is general guidance, not legal advice.
Can our data stay in Australia?
Where required, we design solutions to keep data in Australian cloud regions on AWS or Azure and document any data flows that leave Australia, including AI model calls. See what to ask about Australian data residency.
How quickly can you respond to an RFQ or clarification?
We aim to reply within one business day. For a live RFQ, choose “Tender / teaming opportunity” in the contact form and include the opportunity number and closing date, or call 0402 401 584.
Have a tender, RFQ or teaming opportunity?
Send us the scope or opportunity number. We reply within one business day and can provide corporate documents on request.