ICT Procurement Index: Methodology and Sources

Research question and scope

Which Australian Government agencies published ICT contract notices, what initial lifetime contract values did those notices disclose, and which supplier identifiers appeared? The cohort covers publication dates from 1 July 2023 to 30 June 2026 in Australia/Sydney time, split into completed financial years.

This is a census of records returned by the official API under the documented query and classification rules, not a representative sample of all technology purchases. Below-threshold and unreported procurement, notices absent from the API and activity outside the reporting population are not captured. Contract values are initial commitments, not annual expenditure.

Sources, licence and archive

Primary data comes from the Department of Finance AusTender OCDS API, queried by contractPublished date. Each response declares CC BY 3.0 Australia. The official data catalogue and customised UNSPSC codeset are archived with source URLs, timestamps and SHA-256 hashes.

The committed SHA-256 manifest pins the original source files. Its request index records cursor URLs, download dates, licences, raw-byte hashes, release counts and terminal status. Source metadata and the codeset have their own entries. The compact derived cohort retains the original notice IDs, publication dates, agency identities, category, exact values, supplier keys and cyber-match flags needed to recompute the published aggregates. It omits descriptions and supplier display names, so it cannot independently reclassify a notice.

Consult Finance's procurement-statistics guidance for lifetime values and reporting changes. This index uses its own original-notice cohort and is not a reproduction of Finance's published net aggregates, which can include amendments.

Download and completeness checks

The downloader queries fixed UTC month windows, starting in June 2023 to cover the local financial-year boundary, and follows the API's next links until a terminal page. It validates the HTTPS origin and query prefix, rejects cursor loops, records each response and resumes from verified checkpoints. Inclusive-boundary duplicates are deduplicated by OCDS release ID; conflicting versions stop analysis.

The offline analysis refuses incomplete months, missing terminal pages, mismatched hashes, unexpected licences and conflicting releases. The completed archive contains 2,532 response pages. Complete cursor chains demonstrate retrieval completion, not an independent guarantee that the publisher's underlying database is exhaustive.

Original notices and financial years

The API can return original releases and later amendments for the same notice. Select the earliest release tagged contract for each contract notice ID, once only. Attribute it to its release publication date converted to Australia/Sydney. Do not use the contract start date, award date or a later amendment date to assign the financial year.

Retain original initial values even if the contract is later increased, reduced, cancelled or corrected. Amendment releases are evidence and are excluded from totals. This choice prevents adding successive full-value snapshots together, but it means the result is not a current portfolio valuation. The archive is an observation of the API during the collection window, not a historical database snapshot taken at each year-end.

ICT and cyber-related definitions

ICT includes UNSPSC codes beginning 43, beginning 8111, or exactly 80101507. These cover ICT equipment and software, computer services and IT consultation respectively. Match classification scheme UNSPSC explicitly. A notice with multiple matching codes is counted once, with the first matching code in sorted order selecting its table category. Values are not apportioned across categories or suppliers.

The cyber-related subset applies this case-insensitive description rule within ICT only:

\b(?:cyber(?:[ -]?security)?|infosec|information security|network security|penetration test(?:ing)?|security operations cent(?:re|er)|SIEM|SOC services)\b

This subset is a transparent text filter. It misses contracts with generic descriptions or other classifications, and mixed contracts can contain non-cyber activity. It must not be quoted as total government cybersecurity procurement.

Money, agencies and suppliers

Use reported nominal AUD values without inflation, GST, annualisation or currency adjustments. Use decimal arithmetic and require finite, non-negative original amounts in exact cents. Missing values, ambiguous procuring entities and ambiguous award links stop processing. Percentages round half up to two decimal places. Displayed table amounts preserve exact cents.

Count distinct AU-ABN values when the supplier party has an eleven-digit AU-ABN; otherwise retain the publisher's supplier identifier. These identifiers are not independently validated legal entities or corporate groups. A supplier can have several identifiers, and name changes can appear. Do not interpret the count as market competition, bid participation or SME participation.

Agency counts use procuring-entity identifiers. Machinery-of-government changes can split or rename entities. Agency-name changes are not evidence of new buying organisations. A notice with multiple suppliers contributes its full value once to the cohort; there is no inferred value allocation.

Reproduce the results

From a clean checkout, run the offline analysis against the hash-verified compact analytical cohort. It recomputes every finding and aggregate CSV using exact decimal arithmetic and notice-level identities; no headline value is copied into the calculation.

python3 -m unittest discover -s scripts/research/anz-government-ict -p 'test_*.py'
python3 scripts/research/anz-government-ict/analyse.py

To audit the earlier raw-to-clean transformation, retrieve the separately preserved source snapshot, verify every file against manifest.sha256 and run analyse.py --raw. The fetch command below attempts the original public URLs and refuses changed bytes. A live API is not a historical archive: a re-fetch probe found revised contract dates, and even empty terminal pages can change. If a hash differs or a file is withdrawn, the preserved original snapshot is required. It is not bundled with this aggregate-only release; its storage decision is pending. Do not silently substitute new data.

python3 scripts/research/anz-government-ict/fetch_pinned.py
python3 scripts/research/anz-government-ict/fetch_pinned.py --verify-only
python3 scripts/research/anz-government-ict/analyse.py --raw

Notice-level CSV download is deferred pending the source storage decision. The aggregate files below are available now.

Yearly CSV | Agency CSV | Category CSV | Computed findings JSON.

New Zealand and refresh policy

The official New Zealand catalogue lists GETS award-notice data under CC BY 3.0 NZ. Its linked MBIE CSV returned an HTML challenge during this collection, so no New Zealand numbers are reported. Search snippets, screenshots and catalogue descriptions do not replace a downloaded dataset. A later extension will report notice frequency separately from Australian contract value and document the NZ date, category and notice-type rules.

Refresh when a new source release is available, recording a new collection window and reviewing every changed finding. Do not silently re-date an unchanged analysis. No survey or D&G client data is included.