Governance, Risk and Compliance
Govern, manage and assess your cyber risk with certainty.
One framework across every obligation
Governance
Cyber governance operating models, board reporting and risk appetite that make accountability unambiguous.
Risk Management
Prioritised and right-sized risk profile connected to your cyber strategy, threat environment and business objectives.
Third-Party Risk Management
High volume, fixed price supplier assessments and continuous monitoring that clear your due diligence backlog.
Audit and Compliance
Independent ISO and industry standards-based audit and assurance from multiple certified lead auditors.
Business Continuity and Disaster Recovery
ISO 22301-aligned continuity and recovery planning, exercised rather than assumed.
Security Framework and Standards Implementation
Essential Eight, ISO 27001, NIST-CSF, SMB1001, PCI-DSS and SOC 2 — assessed once, mapped across every obligation.
Regulatory Compliance
SOCI Act CIRMP and Privacy Act obligations mapped, evidenced and kept current as the rules change.
Policy and Procedure Development
One maintainable policy framework mapped to your obligations, in place of policy sprawl.
How each capability works
Governance and Policy
Our governance practitioners are IT leaders with executive experience across enterprise, government and consulting, not documentation specialists. We hold CGEIT, CISM, CRISC, CISA and CDPSE, and many of our people sit on the governing bodies that set the standards we work to. That means we design governance a board and an executive committee can actually operate with clear accountability, decisions that get made, and reporting that survives scrutiny — rather than a policy library that goes stale between audits.
- Cyber security governance operating model, committee structures and terms of reference, aligned to ISO/IEC 38500, COBIT, ISO/IEC 27001:2022, ISO 9001, and the Business Model for Information Security.
- Board and executive reporting, risk appetite statements and escalation thresholds.
- Accountability and control ownership mapping (RACI).
- ISMS development, implementation and refinement.
- Policy and procedure development: framework architecture, drafting, review cadence, and exception and waiver handling.
- Cyber security centre of excellence, community of practice, and awareness and culture programs.
Risk Management and Third-Party Risk Management
We go beyond qualitative ratings to quantify cyber risk in dollar terms, giving leadership a figure they can act on. Using FAIR and FAIR-CAM alongside control 'what if' analytics, we can show you what a risk scenario is likely to cost, what a proposed control investment buys down, and therefore which remediation to fund first. On the third-party side, we deliver high volume, fixed price supplier assessments and continuous control monitoring, so a due diligence backlog becomes a predictable cost rather than an open-ended one.
- Risk management aligned to ISO 31000, covering enterprise, service, asset and supplier risk.
- Scenario development and threat actor analysis — MITRE ATT&CK, SABSA, NIST SP 800-30, CVSS and STRIDE threat modelling.
- FAIR quantification and FAIR-CAM control analysis, and control 'what if' analytics and risk buy-down modelling.
- Supplier tiering and criticality assessment, and third-party register establishment.
- Due diligence assessment against ISO 27001, NIST CSF, Essential Eight or your own control set, including evidence review of vendor trust portals and SOC 2 reports.
- Contract security schedules, right-to-audit clauses, onboarding/offboarding controls, and fourth-party and supply chain dependency mapping, including obligations under the Enhanced CIRMP Rules.
Audit, Compliance and Security Framework Implementation
We offer a wide range of ISO and industry standards-based audit and assurance services, with multiple lead auditors for each standard rather than a single certified individual. We assess once and report often: we maintain a single control set mapped across every framework and regulation that applies to you, so one assessment answers multiple obligations instead of triggering another round of interviews.
- Essential Eight assessment and uplift across Maturity Levels One to Three.
- ISO/IEC 27001:2022 gap assessment, ISMS implementation and certification support against the 93 Annex A controls.
- SMB1001 implementation and readiness.
- PCI-DSS QSA-led assessment, scoping and remediation.
- SOC 2 readiness and remediation across the Trust Services Criteria.
- Also including NIST CSF 2.0, ISAE 3402, ISO 9001, PSPF and ISM including IRAP, APRA CPS 234, NIST SP 800-53 and 800-171, HIPAA and Sarbanes-Oxley.
- SOCI Act Critical Infrastructure Risk Management Program design and annual reporting, and Privacy Act compliance including Notifiable Data Breach readiness.
Business Continuity and Disaster Recovery Planning
We have seasoned business continuity experts with multiple certifications, including ISO 22301 Lead Auditors, and experience developing enterprise-wide continuity and recovery capability rather than standalone plan documents. We test what we build, because a plan that has never been exercised is an assumption, and regulators increasingly treat it as one. This is a planning, design and assurance service: we build and exercise your capability to respond before an incident, and equip your teams to run it. We do not provide live incident engagement such as containment, digital forensics or hands-on recovery during an active incident.
- Business Impact Analysis and dependency analysis, including third-party and technology dependencies.
- Activation plan, response team and crisis management team definition, with recovery time and recovery point objectives set against business impact.
- BCP/DR testing including facilitated executive tabletop exercises.