Web Development Company in Canberra

Compliance overhead is what a Commonwealth web budget mostly buys: a small citizen-facing site or campaign landing page over eight to twelve weeks, including Drupal or Next.js build, WCAG 2.2 AA audit, Digital Service Standard alignment, and an IRAP-ready evidence baseline, a departmental internal portal with Azure AD or VANguard SSO, MFA, audit logging, and PSPF Section 4 alignment, or a full enterprise platform (agency-wide content management, multi-site Drupal estates, citizen identity integration with myID), usually procured through the Digital Marketplace or the Buying for the Australian Government panel. Canberra rates reflect the compliance overhead (Essential Eight, IRAP, PSPF, Hosting Certification) rather than premium CBD real estate. Every engagement is fixed-fee against signed contract.

Every Canberra engagement opens with an ISM scoping workshop and an Essential Eight Maturity Model assessment baselined against the four levels in the Australian Cyber Security Centre framework (Level Zero through Level Three). For IRAP we engage an accredited assessor early, produce a system security plan, a security risk management plan, and an incident response plan aligned with the ISM controls catalogue, and deliver an evidence pack ready for assessor review. For OFFICIAL: Sensitive workloads we constrain hosting to Australian regions; for PROTECTED we use Azure Australia Central 1 or 2 (the only Australian IRAP PROTECTED regions); for SECRET we work with Vault Cloud or AUCloud. The Essential Eight scorecard is updated with every release so the agency CIO and CISO have a real-time view, not a once-a-year audit.

Codazz holds the engagement structure to support DISP-cleared work but cannot publicly state membership status. For Defence and intelligence-adjacent web projects we run a DISP scope check in discovery, work alongside a DISP-cleared prime when membership is required for the specific clearance level (Entry, Member, Advanced), and constrain personnel, hosting, and supply chain accordingly. Hosting for DISP-cleared web workloads sits in Azure Australia Central 1 or 2, Vault Cloud, or AUCloud depending on the data classification. We produce IRAP system security plans aligned with the Defence Industrial Security Manual and supply security clearance evidence (AGSVA-issued NV1 or higher) for cleared personnel through the prime. We will tell you up front when a project requires clearance we cannot pre-emptively hold.

Yes. The Digital Service Standard is the AGDX rulebook for citizen-facing federal services and includes thirteen criteria covering user research, accessibility, plain English, and continuous improvement. The Style Manual (published by the AGDX) governs language, structure, and inclusive content. Our team delivers user research synthesis, plain English content reviews, WCAG 2.2 AA audits aligned with the Disability Discrimination Act, and Drupal or Next.js builds that pass the DSS assessment. For Drupal-mandated agency work we use the GovCMS distribution or AGDX-aligned themes where appropriate. Every release ships with a DSS self-assessment annex, an accessibility statement, and content baselined against the Style Manual reading-level targets.

A campaign landing page or small citizen-facing site takes eight to twelve weeks including Digital Service Standard self-assessment and WCAG 2.2 AA audit. A departmental internal portal with Azure AD or VANguard SSO, audit logging, and PSPF Section 4 alignment takes sixteen to twenty-eight weeks. A full Drupal estate or multi-site platform with citizen identity integration through myID and an IRAP PROTECTED hosting baseline runs nine to eighteen months. Canberra projects are paced by procurement cycles (end of financial year, May Budget cycle), IRAP assessor availability, and agency change advisory board windows. We design the schedule against those realities, not against a generic agile cadence, and we ship in AEDT or AEST with morning standups handled from Chandigarh.

For OFFICIAL: Sensitive and below, Azure Australia East (Sydney) and Azure Australia Central 1 and 2 (Canberra) both work and Australia East gives broader service availability. For PROTECTED, hosting must sit in an IRAP PROTECTED region — in Australia that is Azure Australia Central 1 and 2 (Canberra), Vault Cloud, or AUCloud, with overflow to certified strategic providers under the Hosting Certification Framework. For SECRET, hosting is constrained to certified strategic providers and the Department of Defence approves the specific deployment. AWS does not currently offer an IRAP PROTECTED region in Australia, so PROTECTED workloads route to Azure or sovereign clouds. We document the residency choice in the system security plan, the privacy impact assessment, and the agency security plan annex.

Yes. ANU is consistently ranked top in Australia and feeds federal research demand across policy, defence, and cyber. UNSW Canberra runs the Australian Defence Force Academy and educates ADF officers, which means web projects there often need DISP-aware access controls and Defence Trade Controls Act review. University of Canberra serves a mixed cohort with strong international student demand. Our engagements deliver research portals, grant management dashboards, and student-facing services aligned with the Tertiary Education Quality and Standards Agency, the Privacy Act, and the Higher Education Support Act. For UNSW Canberra and ADFA-adjacent work we constrain hosting to Australia Central and apply DISP awareness from discovery onward.

Yes. We deliver against the Digital Marketplace (BuyICT) and through the Buying for the Australian Government Digital Sourcing Network panels where eligible. We can also operate as a subcontractor under a DISP-cleared prime when membership and clearance are required. Engagement structure is fixed-fee against a signed work order with milestone billing, not time and materials. We provide the indicative tender pricing schedule, statement of work, and the standard Commonwealth contract clauses your contract manager expects, including IP assignment, security personnel commitments, and the moral rights waiver. The Department of Finance Commonwealth Contracting Suite (CCS) terms are workable for most projects.