Australian local government: privileged script evidence for councils and their MSPs

Australian local government buyers (councils, shires, regional councils) and the MSPs who serve them get asked about Essential Eight, IRAP consumer duties, and privileged remote access. Trustholm can supply evidence of signed script policy and tenant-scoped audit export. Trustholm does not achieve Essential Eight for the council, is not IRAP assessed as a product badge, and is not an ISM certification.

Lead with Australia because this page is for that buyer. Other regions should use the regional compliance hubs instead of copying this framing.

What councils usually need

• A story for who can run PowerShell that changes identity or servers
• Exportable history for internal audit or a state-linked questionnaire
• Honest SaaS isolation (schema-per-tenant) without claiming sovereign-by-default beyond published residency notes
• Coexistence with the incumbent RMM already on the estate

What to put in the tender file

Public AU ISM vendor pack PDF, Essential Eight and IRAP consumer pages on www, trial Assessor ZIP, audit export, and the limitations appendix that says customer-operated patching, macros, and application control stay with the council/MSP. Do not stamp “E8 ML3 achieved.”

MSP serving many councils

Use one Trustholm tenant per MSP with customer (council) scope, not one SaaS tenant per council unless you sell it that way. Staff allowlists and customer-scoped roles exist so a technician is not automatically fleet-wide. Do not load every council endpoint into a dropdown.

Residency and subprocessors

Point at /trust/subprocessors and published AU hosting notes. If a clause requires a specific region, request that in writing; do not invent a second region. Global edge discovery is deferred until a second region or universal installer exists.

Workshop for a council GRC lead

Use the 90-minute audit workshop agenda. Replace “enterprise renewal” language with “council ICT questionnaire.” Keep not-certified language for Trustholm’s own SOC program.

Claims to avoid

No ACSC endorsement. No IRAP certificate number. No “Protected” classification of the SaaS by default. No cyber-insurance guarantee for the council.

Related live pages (existing copy)

/govern/compliance/au/essential-eight, /govern/compliance/au/irap-readiness, AU ISM vendor pack PDF, and /govern/trust. Prefer those URLs over attaching internal repo markdown.

Field notes (AU local government)

Lead with Australia because this page is for councils and their MSPs. Do not copy this framing onto global pages. No ACSC endorsement, no IRAP product badge, no default Protected classification of the SaaS. Usually the MSP is the tenant and councils are customers. Confirm commercially.

Date the diligence folder YYYY-MM-DD and record the portal product version. Re-export after upgrades. Do not reuse last week's grant token. Public starter PDFs copy without email. Gated files need a live grant. If the Platform API is down, HubSpot may still capture the lead with no download buttons. Say that out loud so GRC does not think the trial is broken.

Walk one denied unsigned dispatch when RequireSigned is on. Capture a 403 from a mismatched tenant header. Export audit for one window and confirm no foreign tenant codes. Open the Assessor ZIP trust-artifacts.json and read the limitations appendix. Leave Gap rows as Gap. Do not paste LabVerified for Entra, Okta, Stripe, or SMTP until the capability verification registry says LabVerified.

Keep the incumbent RMM. Trustholm does not replace OS patching, remote takeover, or a NOC hero pitch. Probe and observe features are operator tools, not the reason a council or insurer should buy. Named design-partner logos stay off marketing pages until attestation exists.

Store ZIP files with access control. They hold tenant metadata even when secrets are stripped. Email security@trustholm.com only for Manual DPA or pentest summary. Do not invent those PDFs on www.

If someone asks to select all agents in a dropdown, stop and show catalog pagination. If someone asks for a second region or a single global edge FQDN, say Phase 1 Australia edge is current and global discovery is deferred.

Copy the trust hub sentence into the packet: we do not hold SOC 2 Type I or Type II and do not claim an observation period. Trustholm supplies technical artifacts for the customer's program. It does not automate customer SOC 2 Trust Services Criteria like a GRC product.

Assign an owner to refresh this packet quarterly or after a Shipped/Gap change. Workshops go stale. Prefer live reproduction over architecture slides. Prefer export files over screenshots alone, then keep both.

Lead with Australia because this page is for councils and their MSPs. Do not copy this framing onto global pages. No ACSC endorsement, no IRAP product badge, no default Protected classification of the SaaS. Usually the MSP is the tenant and councils are customers. Confirm commercially.