GABEY Independent Provider Assessment
Evidarq

Selection chooses the provider. Evidence decides whether they receive the keys.

Evidarq™ is GABEY’s client-authorised provider assessment service for the period before service handover, live data migration and privileged access. We examine the people, controls, locations, subcontractors and software supply chain behind the proposed service.

Evidence-led SBOM assessment Offshore verification Contract-aligned
Seven assessment domains
Domain 07

Software & Technology Supply Chain

Applied where relevant to the service

Examines the software, platforms, dependencies and technology components that the provider develops, supplies, integrates, deploys or operates for the client.

How the assessment is performed

The delivery method is set by the client’s decision need, contractual rights, service boundary and relevant locations.

We examine documents, records, technical evidence, interviews and provider responses within the agreed assessment scope.

We do not inspect everything. We inspect what matters to the client’s decision.

Discuss Your Assessment Scope
Conditional outcome

Recommended for Conditional Acceptance

The provider may proceed only after specified conditions are completed, evidenced and, where required, retested. Service handover remains conditional until the client confirms that the named requirements have been satisfied or formally accepts the residual risk.

Example acceptance conditions

  • Privileged-access control completed and evidenced.
  • Undisclosed subprocessor resolved.
  • Current SBOM supplied and reconciled.
  • Incident-notification procedure amended.
  • Offshore personnel controls evidenced.
  • Exit and data-return terms corrected.
Client authority

The recommendation informs the decision.

The client determines what happens next, including whether residual risk will be accepted and by whom.

The client may accept the service where the recommendation and its own governance process support proceeding within the assessed scope.

The recommendation belongs to GABEY. The final decision belongs to the client.

Continuing assurance

When should the provider be reassessed?

A recommendation is tied to the evidence, scope and operating conditions available at the time. Material change can alter that basis.

A new offshore location may introduce different personnel, legal, subcontracting, data-access and physical-control conditions. The original recommendation may no longer describe the service as delivered.

Make service handover conditional on evidence.

Plan Your Acceptance Assessment
Step 02 · Core engagement

Conditional Service Acceptance Assessment

The client may have selected a preferred provider, but production access, data migration and operational authority remain conditional. GABEY examines the agreed evidence and provides a bounded recommendation before the client authorises service handover.

Typical engagement outputs

  • Defined assessment scope and evidence register.
  • Material findings and unresolved evidence.
  • Named acceptance conditions.
  • Recommendation outcome and decision basis.
  • Provider factual-review record.
  • Client handover decision support.
Commercial structure

Clear entry points. Scope-controlled delivery.

The starting point is clear, while the final engagement remains bounded by provider count, evidence volume, data classification, jurisdictions, site access and decision urgency.

Step 00 · Scoping CallComplimentary · 30 minutes
We map the proposed provider relationship, service boundary, data flows, locations and decision deadline. You receive a preliminary engagement path and a fixed-fee proposal. This call is not the evaluation.
Step 01 · Evidarq Provider Assessment ReportFrom AUD 6,500 · Includes 2 providers
Each additional provider: + AUD 2,500.
Evidence-based comparison against client-approved commercial, technical, governance and assurance criteria, with material findings and a written recommendation suitable for management, procurement or board review.
Step 02 · Evidarq Offshore Assurance AssessmentFrom AUD 25,000
Includes the applicable desk assessment plus authorised verification of relevant offshore delivery conditions. Pricing scales by site, provider, jurisdiction, travel and verification scope.
Step 03 · Remediation VerificationBy fixed-fee proposal
Independent verification of named acceptance conditions after the provider states that remediation is complete.
Step 04 · Continuous Provider AssuranceBy quotation
Quarterly, annual or change-triggered reassessment of provider drift, subprocessors, locations, certificates, controls, software and SBOM changes.

Fees are starting amounts in Australian dollars and are exclusive of GST. Final pricing depends on provider count, service boundary, data classification, evidence volume, locations, jurisdictions and the verification work required. Travel, accommodation, translation, local representation and third-party costs are quoted separately unless expressly included. The complimentary scoping call is diagnostic only and does not constitute an Evidarq assessment, recommendation, certification or provider approval.

Start with the decision. Then define the evidence needed to support it.

Scope Your Evidarq Engagement
© 2026 GABEY Consulting Pty. Ltd. Australia. Evidarq™ is a trade mark used by GABEY Consulting Pty. Ltd. Original content, interaction design and assessment materials are protected.
What the document can tell you

A structured assurance starting point

  • The issuing body, report type, date and stated scope.
  • The framework, controls or criteria examined.
  • A point-in-time or period-based opinion within a defined boundary.
  • Exceptions, exclusions or management responses recorded in the material.
What Evidarq examines

Whether it supports this client’s decision

  • Whether the proposed service, locations and systems sit inside the stated scope.
  • Whether material exclusions or exceptions affect the client’s data or access.
  • Whether relevant controls are supported by current operating evidence.
  • Whether subprocessors, offshore sites and changed delivery arrangements remain visible.
ISO/IEC 27001

Read the scope before relying on the certificate

The certificate can be genuine and still cover a narrower environment than the service the client is preparing to use.

Decision discipline

Do not convert a valid document into an unsupported conclusion.

Evidarq™ records what the assurance material supports, what remains outside its boundary and what additional evidence is required before the client relies on it for service acceptance.

The framework may change. The question remains: what does the evidence support?

Discuss an Assurance Review
© 2026 GABEY Consulting Pty. Ltd. Australia. Evidarq™ is a trade mark used by GABEY Consulting Pty. Ltd. Original content, interaction design and assessment materials are protected.
Evidarq™ · GABEY Independent Provider Assessment

Before you hand over the keys, establish what the evidence supports.

Evidarq™ gives the client an independent, bounded assessment before production access, data migration or operational responsibility is released to a provider.

GABEY recommends. The client decides.

What happens next

A controlled path from enquiry to recommendation.

Select a stage to see how the initial conversation becomes a bounded assessment engagement.

The client provides enough initial information for GABEY to understand the proposed provider relationship and determine whether an Evidarq engagement may be appropriate. No assessment or recommendation is made at this stage.
Public capability

Enough information to understand the service

The public page explains the Evidarq service, engagement pathway, assessment domains, recommendation outcomes and the client’s continuing decision authority.

  • Service purpose and client-authorised assessment model.
  • High-level assessment domains and evidence principles.
  • Recommendation categories and engagement stages.
  • Claims boundaries and client decision authority.

Methodology boundary

This public page describes Evidarq™ at a capability level. Detailed assessment instruments, scoring logic, evidence thresholds, weighting methods, decision rules, templates, verification procedures and implementation assets are not disclosed. No licence is granted to reproduce, adapt, teach, commercialise or independently implement GABEY’s original Evidarq materials.

Contact GABEY about Evidarq™

Ready to move from provider claims to decision-grade evidence?

Open a confidential Evidarq™ enquiry to discuss your provider shortlist, acceptance concerns, offshore assurance questions or software supply-chain review needs. GABEY recommends. The client decides.

Initial scopingClarify providers, service boundaries, evidence sources and decision objectives.
Evidence-led reviewCommercial, technical, governance and assurance factors examined against client criteria.
Clear next stepOpen the enquiry form and begin the conversation with GABEY.
Visit contact page
Episode One cover artwork for The Borrowed Light, A DotShield Audio Chronicle

DotShield® Audio Chronicle · Fiction

The Borrowed Light

A valid credential opens the door. But who is really using it?

Episode One follows an energy company as a trusted customer-care session begins to separate from the person it was meant to represent.

Open the Chronicle →

© 2026 GABEY Consulting Pty. Ltd. All rights reserved.