01
Set the expectation.
Choose requirements for the supplier and service. Define the scope, evidence needed and acceptance criteria before the review begins.
Customer requirement profile
SUPPLIER SECURITY ASSURANCE
Shared evidence.
Clearer decisions.
Bring customer expectations, supplier evidence and security decisions into one connected workflow.
Set the requirements. Reuse what’s already there.
Focus the next review on what changed.
✦ Australian regions. Source-cited AI. Human judgement.
A CONNECTED ASSURANCE WORKSPACE ILLUSTRATION
CUSTOMERClear expectations
SUPPLIERReusable evidence
Requirement workspace
ACCESS CONTROL Review required
Privileged access protection
Demonstrate MFA for privileged access, including support staff and subcontractors.
MFA verification reportLinked evidence · current version
Source-cited findingReport · p. 3
Employee coverage is evidenced.
Subcontractor coverage needs clarification.
Subcontractor coverage needs clarification.
R Customer review
Decision stays with you Evidence maintained once.Ready for the next customer review.
Clear requirements Evidence with context Traceable decisions Australian infrastructure
THE WORKFLOW
From expectations
to shared understanding.
Assurance is an ongoing relationship. Give both parties a clear view of what’s required, what supports it and what still needs attention.
02
Connect the evidence.
Suppliers maintain documents and artefacts in one repository, then share relevant evidence with authorised customers.
Supplier-controlled sharing
03
Review. Decide. Maintain.
Use cited findings to review gaps, record decisions and revisit affected requirements when evidence changes.
A traceable assurance history
BUILT FOR BOTH SIDES
One shared process.
Two clearer perspectives.
For customers01 / CUSTOMER
Know what you’re
accepting.
Make expectations repeatable. Review a recommended risk rating grounded in inherent exposure, evidence coverage, critical gaps and freshness. Keep the evidence and reasoning behind each decision visible.
- Requirements tailored to the service and relationship
- Evidence coverage and recommended risk, kept distinct
- Acceptance, conditions and remediation in context
For suppliers02 / SUPPLIER
Build on the evidence
you already have.
Understand what each customer expects. Maintain current documentation and reuse it where appropriate, while controlling who can access it.
- A repository for policies, reports and operational artefacts
- Evidence versions with clear scope and provenance
- Focus on missing evidence and customer-specific differences
EVIDENCE IS SHARED. ACCEPTANCE IS CUSTOMER-SPECIFIC.
Supplier evidenceOne maintained source.Scope · versions · access controls
A
Customer AOwn requirements. Own decision.
B
Customer BOwn requirements. Own decision.
New version suppliedRelevant reviews reopen
REUSE THE EVIDENCE. REVIEW THE DELTA.
The next review
shouldn’t start
from scratch.
A new customer may have different requirements. A new document may change an earlier conclusion. AssurTrail keeps the relationship between them visible.
Reuse valid evidence, address the differences and reassess what changed. Each customer retains its own acceptance decision.
AI THAT SHOWS ITS WORK
Less reading between files.
More insight from the evidence.
AI assists with document interpretation and assessment drafting. Source references, scope and uncertainty stay visible for the person making the decision.
Find what matters.
Extract relevant statements and connect them to the customer’s requirements.
Make the gaps explicit.
Draft findings and follow-up actions for missing, partial or conflicting assurance.
Keep judgement accountable.
Review the evidence before accepting a finding. A recommendation is a starting point for a decision.
Illustrative assessment findingPartial assurance
REQUIREMENT
Recovery testing covers the supplied service and the agreed recovery objective.
Recovery exercise report · p. 4
“The primary application was restored during the exercise.”
WHAT STILL NEEDS CLARIFICATION
The report describes a restoration, but does not establish the achieved recovery time or coverage of upstream dependencies.
Next action
Request measured recovery results and the dependency test scope.
Evidence supports a decision. It does not make one.
AUSTRALIAN SOVEREIGN CAPABILITY
Know where your
assurance lives.
Australian regions and explicit processing boundaries underpin the deployed application.
AU
SydneyAPPLICATION · EVIDENCE · AI
MelbourneAI INFERENCE
01 / APPLICATION & EVIDENCE
Sydney, Australia.
Application services and evidence storage run in the AWS Sydney region.
02 / AI INFERENCE
An Australian boundary.
Bedrock inference is restricted to approved Australian regions: Sydney and Melbourne.
03 / AI PRIVACY
Verified before processing.
Zero model-provider retention and disabled Bedrock content logging are checked before evidence is sent.
A PRACTICAL FOUNDATION
Familiar standards.
Clearer expectations.
Pilot requirement mappings connect established security guidance with scoped expectations and supporting evidence.
ASD ISMAustralian security controls01
Essential EightAustralian baseline guidance02
ISO/IEC 27001Security management & assurance03
NIST SP 800-161Supply-chain risk management04
Mappings support the review process. They are not certification, a complete framework assessment or government endorsement.
ASSURANCE THAT CONNECTS.
Make the next review
start with the evidence.
Access the app Customer expectations. Supplier evidence. Shared understanding.