How government and enterprise actually buy digital agencies
Panels, tenders and security questionnaires are the product. A beautiful capability deck is not a submission. Here is how Australian public and enterprise buyers — and the shops that want their work — should behave.
By DMA Editorial · DMA Australia · 8 July 2026

Image: Victorgrigas · CC BY-SA 4.0. See all image credits.
Public sector and enterprise marketing teams do not buy agencies the way a founder buys a retainer over coffee. They buy through a process that has to be explained later — to audit, to a board, to a minister’s office, to a procurement lead who was not in the room when the work was good. The process is not a personality flaw. It is the product.
Shops that treat the process as an insult will lose, or win once and then drown in the reporting. Buyers who treat the process as a substitute for judgement will appoint a shop that can write a response and cannot run a weekly. Both failures are common. Both are avoidable if you name the actual constraints.
This sits in working together because the commercial relationship is downstream of the paper. The ranges in what Australian agencies actually charge still apply, but they arrive as day rates, statements of work and rate cards, not as a tile that says “from $3,000”.
The map: panels, tenders, and the work that sits beside them
Commonwealth buyers often start with BuyICT — the digital marketplace that replaced an older, more chaotic hunt across the open internet — and with AusTender when the engagement has to be openly approached. States have their own furniture: Buying for Victoria, NSW arrangements and supplier hubs, QTenders, TendersWA, and the South Australian and Tasmanian portals that a local shop will already know by login.
A panel is a pre-qualified list. Being on it is not a win. It is a licence to be asked. Being off it is not always fatal — some work can still be approached directly under a threshold — but “just email the marketing manager” is not a strategy if the marketing manager is not allowed to answer.
A tender is a comparable response to a specification. The specification may be good. It may be a capability shopping list written by a committee that has not agreed the outcome. You cannot fix a bad specification with a beautiful brand film in the appendix. You can ask a clarification question in the window they gave you. After the window, the paper is the brief.
Enterprise is a cousin, not a twin. There may be no AusTender. There is still a procurement policy, a vendor master, a security questionnaire, a legal template that was written for software, and a stakeholder who can stop the work without being able to describe it. Treat those as the environment, not as rudeness.
What buyers should put on the paper
Write the outcome a non-marketer can recognise. A program that has to recruit. A service that has to be used. A campaign that has to be defensible in an estimates hearing. “Digital transformation” and “cut-through” are not outcomes. They are how you attract adjectives.
Write the constraints that will not move. Protective markings. An existing panel you must use. A CMS you will not replace. A caretaker period. A style that has to survive a change of minister. An Indigenous Procurement Policy target. A requirement to use local labour or a particular region. Shops cannot price what you leave as a surprise.
Write the evaluation so that a good small shop can still win a slice. If every criterion rewards national footprint, you will get a holding-company collage and a junior team. If every criterion rewards the cheapest day rate, you will get the rate and the junior. Weight the people, the relevant work, and the operating model. Ask for named humans and a weekly, not a capability matrix with ticks.
Write the security and privacy requirements at the level of the data, not at the level of the brand. A content retainer that never sees a citizen record is not a hosting tender. A personalisation program that joins CRM to ads is. If you are unsure, ask the person who owns the Privacy Act conversation, not the person who owns the agency roster.
For the craft of choosing among shops once the paper is fair, how to choose a digital marketing agency in Australia still holds. Procurement does not replace a conversation with the people who will sit on the account. It should make that conversation possible.
What shops should stop doing in submissions
Stop sending the reel as if it were a response. Evaluators have a scoresheet. If your answer is not in the box, it does not exist.
Stop claiming every category. Government and enterprise buyers have seen the same three case studies rotated through health, finance and tourism with the logos swapped. They cannot always say so in the debrief. They can score you down.
Stop treating security as a paragraph. If you will hold personal information, say where it lives, who can see it, what you do at 11pm on a Sunday, and which of your tools are overseas. If you will not hold it, say that just as clearly. A slide that says “ISO-aligned” without a certificate, a scope or a date is noise.
Stop underpricing to get on the panel with a plan to “normalise” later. Public invoices are easier to explain than a quiet variation culture. If the rate cannot staff the work, you will either lose money or lose the account in a performance review that has minutes.
Stop ignoring the local and SME settings. If you are a small Australian shop, say so in the language the policy uses. If you are a global network bidding as a local studio, say who will be in the room in Canberra, Parramatta, Box Hill or the suburb the program actually lives in.
Security is a questionnaire with consequences
Essential Eight, the Information Security Manual, IRAP, SOCI, a vendor’s own control set — the alphabet is not the point. The point is whether the agency can handle the data the campaign will touch.
Most digital marketing work sits in a messy middle. Ad platforms, analytics, a creative drive, a community inbox, sometimes a list. That middle is enough to ruin a week if a contractor’s laptop is open, if a former employee still has the Facebook login, or if a pixel fires on a page that collects health or financial information.
Ask for a data map of the engagement, not a corporate security brochure. Where do files live. Which subcontractors — freelancers, editors, a media trader in another time zone — will see them. How access is removed. How an incident is notified in the time the law or the contract requires.
If the work is only public content and a brand drive, do not drown a mid-sized independent in a questionnaire written for a data centre. You will get performative answers and fewer bidders. If the work joins citizen data to media, do not waive the questionnaire because the creative is charming.
Buyers should allow a shop to say “we will not take that data”. That refusal is a security control.
Time, money, and the quiet costs
Public payment terms can be better than the worst of the private sector, and still wreck a small shop if the statement of work took six months to execute. Enterprise can be worse: ninety days, a portal, a purchase order that expired. Price the working capital or do not bid.
IP clauses written for software will try to eat the agency’s method. Push back to the work product. Government does need to reuse. It does not need to own a workshop format.
Reporting will be heavier than a private monthly. Budget for it. A shop that cannot write a plain English paragraph for a senior executive will drown you in dashboards at the exact moment you have to brief up.
Conflicts need a line. The shop’s other clients, a holding company’s interests, a political history. Public work is public. Assume a journalist can ask.
How a buyer should run the first ninety days
Award is not onboarding. The first quarter still has to produce keys, a measurement truce and a first ship — with the extra joy of access requests that travel through IT. Put those requests in the project plan, not in a side Slack.
Keep a named business owner who can decide. Procurement can open the gate. It cannot sit in the weekly forever.
If the shop is failing, use the contract you wrote. Public and enterprise exits are slower, which is why the paper had to be good. Do not improvise a vibe-based breakup in a category that keeps minutes.
The desk’s view
Buy through the panel you actually have, specify an outcome a non-marketer can recognise, and inspect the humans. Bid through the scoresheet, price a rate you can staff, and treat security as a map of the engagement. The process is slow because someone will have to explain it. That is not an argument for a worse agency. It is an argument for a better brief.
If you have lived a tender from either side and can write it without settling scores, write for us is open. We will not run a capability statement. We will run a piece that tells the truth about the paper.
Questions marketers actually ask
- Do I need to be on a panel to work with Australian government?
- Often yes for anything beyond a small engagement. BuyICT and state arrangements exist so a department can call a list, not the open internet. Ask which paper the buyer is allowed to use.
- What security does an enterprise expect from a digital agency?
- Something you can evidence — access control, a data map, incident process, maybe ISO or Essential Eight alignment if the work touches sensitive systems. A slide that says “we take security seriously” is not evidence.
- Why do tenders feel hostile to good agencies?
- Because they are designed to be comparable and defensible, not pleasant. Shops that refuse the format lose. Shops that only write the format, and cannot do the work, sometimes win. Buyers have to inspect both risks.