Products on the list have completed an evaluation and meet international certification standards ensuring agencies have a definitive product reference when purchasing from IT security vendors.

Keen to ensure they are on the list, which was established more than a decade ago, many vendors spent as much as half a million dollars going through the evaluation process. They all wanted the coveted DSD stamp of approval.

But now the term "DSD approved product" has been dropped. This means government agencies can now buy from vendors that aren't included on the list. However, agencies who do not buy from the EPL must document why. Put simply, government departments are still expected to buy from the list they just have greater flexibility.

That is, they can buy from vendors not on the list if it is necessary to meet their business requirements.

Department insiders said the change was made because agencies were buying products that didn't meet their requirements.