Field notes › Choosing software
The security questionnaire your client's procurement team sends you
It usually turns up as a spreadsheet attached to a contract renewal, with a column for your answer and another for evidence. Procurement at a larger client wants to know where the personal information of the crew you send them is kept, who can get at it and what happens if something goes wrong. For plenty of labour hire owners it's the first time anyone has asked, and the honest answer to half the rows is "I'd have to check".
What they're really asking
The wording changes from client to client, but the concern is the same. If a supplier leaks worker details, the client's name gets attached to the breach, and their own people may be caught up in it. So the questions come back to a familiar set:
- Where is worker data stored, including backups?
- Who can access it, on your side and on the software vendor's side?
- Do logins use two-factor authentication?
- How are sensitive details like tax file numbers and bank accounts protected?
- How often are backups taken, where do they go, and has one ever been restored?
- How is access removed when someone leaves your office?
The last two catch people out. Backups are easy to claim and hard to prove. Removing access sounds like housekeeping until you count the shared passwords, the old laptop in the cupboard and the personal email account that still has last year's worker list sitting in it.
Answer for the systems you actually use
The common mistake is answering for the system you think you run. Your rostering platform might tick every box, but if licence photos are also emailed to a shared inbox, copied into a spreadsheet on someone's desktop and saved on the rosterer's phone, those are all places worker data is held. A procurement team asking where data is stored is asking about every one of them.
So before filling anything in, follow a new worker's details from the day they apply. Their licence photo, their tax file number form, their bank details, their emergency contact. Write down every place each one lands. That list is your real answer, and it's usually longer than you'd like.
Shrinking it is often the most useful work a questionnaire prompts. Every copy you delete is a row you no longer have to explain, and a spreadsheet emailed around the office is very hard to describe in a way a security reviewer will accept. The post on holding tax file numbers and bank details for a casual crew goes further into the sensitive end.
Be precise about whose control is whose
Honest answers separate what you do from what your vendors do. If your software vendor encrypts data, that's their control, and you should be able to point to where they say so. If a data centre holds a certification, say the data centre holds it, rather than implying your business or the software does.
Mustr is a fair example of how careful the wording needs to be. It runs on hardware Mustr's team manages, in an Australian data centre certified to ISO 27001, and that certification is the data centre's. Writing "our rostering software is ISO 27001 certified" in a questionnaire would be wrong, and a careful reviewer will notice. The rest is set out on the security page: data stays onshore, every login uses two-factor authentication, organisations are isolated at the database level, and data is encrypted in transit and at rest. Tax file numbers, bank and super details are additionally encrypted individually and stay hidden until a fresh two-factor check at the moment someone views them, with every reveal logged. Accounts are created deliberately by an administrator, there's no public signup into a live workspace, daily encrypted backups are held offsite in Australia, and security is reviewed quarterly.
Your own controls still count. Two-factor on the software means little if the office shares one login. Who in your team is an administrator, how a leaver's access is removed, and what you do when a worker's details go to the wrong person are questions only you can answer.
When the honest answer is "not yet"
You won't have a good answer to every row, and pretending otherwise is the worst option. Questionnaire answers can end up forming part of the contract, and a claim you can't back up becomes a real problem the day something goes wrong.
Write what's true. Where there's a gap, say what you're doing about it and when you expect it closed. Procurement teams see gaps all the time; what worries them is a supplier who answers yes to everything and can't produce evidence when asked. If you're unsure what your obligations are around personal information, the Office of the Australian Information Commissioner publishes guidance for businesses, and your own adviser can help with the parts that depend on your circumstances.
Keep your answers once they're written and review them when your systems change. The next client will ask most of the same questions, and a current, honest set saves you starting from a blank spreadsheet at every renewal.
If a questionnaire has you rethinking where your worker data lives, book a demo and bring the questions with you.