Cyber risk assurance
Know where your cyber security stands, and what to fix first
Essential Eight assessments, ISM and PSPF alignment, penetration testing and board reporting, delivered as evidence your executive can act on.
Assurance that stands up to scrutiny
Cyber risk now sits with accountable executives, not only IT. Audit committees expect maturity evidence, critical infrastructure entities carry duties under the Security of Critical Infrastructure Act 2018 (SOCI), and one incident can trigger the notifiable data breaches scheme. We test where your controls stand and sequence the work to close the gaps.
Essential Eight maturity assessments
Evidence-based ratings for all eight mitigation strategies against the ACSC maturity model.
ISM and PSPF alignment
Systems and policies mapped to the Information Security Manual and the Protective Security Policy Framework.
Penetration testing
External, internal, application and cloud testing under written authorisation, retested once fixed.
Incident response and tabletop exercises
Clear decision rights, rehearsed by executives and technical teams before a real incident.
Strategy and board reporting
A multi-year plan tied to risk appetite, reported in terms a board can act on.
Virtual CISO
Senior security leadership on a part-time basis, accountable for your security program.
Four steps to a defensible position
- 01
Scope
Agree objectives, systems, frameworks and rules of engagement.
- 02
Assess
Test controls against evidence, not questionnaires alone.
- 03
Report
Rate findings by risk, with an executive summary and a technical annex.
- 04
Uplift
Deliver a sequenced roadmap and retest once changes are made.
Written for the people who sign off
Each engagement closes with a briefing for decision-makers: current maturity, residual risk and the cost of reaching your target. Technical detail sits in an annex for the teams who implement it.