Know exactly where you stand, and what to fix first.

Scope of workp. 2

Includes

• Current-state review of the whole program against the framework you answer to
• Maturity scoring on a recognised whole-program model (NIST CSF 2.0 or C2M2)
• Risk analysis across the enterprise, your cloud, and your vendors
• A prioritised, risk-ranked gap register with a remediation roadmap

Best for a first, complete read of where the program stands.

Scope of workp. 2

Includes

• Gap assessment of the program against one named standard: ISO 27001, SOC 2, or a sector regime
• Control-by-control review of what is in place against what the standard requires
• An honest read on the time and effort to certification

Best for teams heading into a first certification or surveillance audit.

Scope of workp. 2

Includes

• Vulnerability management, scored against the SANS VMMM
• Application security, scored against BSIMM or OWASP SAMM
• Security operations, scored against the SOC-CMM
• A focused, function-level maturity rating and improvement path

Best for a deep read of one capability, not the whole program.

Scope of workp. 2

Includes

• Shadow-AI discovery: the tools, models, and assistants already in use
• Data and model-pipeline exposure review, from training data to outputs
• Third-party AI risk across the vendors and features you already rely on
• Findings mapped to ISO/IEC 42001 and the NIST AI RMF

Best for organisations whose AI adoption is running ahead of governance.

Scope of workp. 2

Includes

• IR plan and playbook review against how your organisation actually runs
• A tabletop exercise with your leadership and technical teams
• Recovery validation: backups, continuity, and the path back to normal
• A clear read on insurer and reportable-incident expectations

Best for teams whose IR plan has never been rehearsed.

Scope of workp. 2

Includes

• Configuration and posture assessed against the CIS Benchmarks and the CSA Cloud Controls Matrix
• Identity, network, and data-exposure review across your accounts
• ISO 27017 and 27018 in scope where the cloud handles personal data
• Findings ranked by exploitability and blast radius

Best for cloud-first teams unsure what their accounts expose.

Scope of workp. 2

Includes

• Inventory and tiering of your vendors by the access and data they hold
• Risk review of your critical and high-tier suppliers
• A repeatable scoring method you can keep using

Best for organisations with a growing or unmapped vendor estate.

Scope of workp. 2

Includes

• Hands-on testing of network, application, or cloud, scoped to your estate
• Run to recognised methodologies: OWASP for applications, PTES and MITRE ATT&CK for adversary emulation
• Delivered by certified offensive-security practitioners
• Findings with clear reproduction steps and remediation guidance

Best for teams needing technical proof, not just a paper review.

Scope of workp. 2

Includes

• Current-state review of human and machine identity: joiners, movers, and leavers, privileged access, service accounts, and standing entitlements
• Access read against least privilege and segregation of duties, with the dormant, excess, and orphaned accounts surfaced
• Posture measured against the controls that bind you: the Essential Eight strategies for restricting admin privileges and enforcing MFA, APRA CPS 234 access management, and ISO 27001 Annex A identity controls
• A prioritised view of the gap between today's access model and the target state

Best for teams where identity has sprawled faster than anyone has governed it.

Scope of workp. 2

Includes

• Each of the eight mitigation strategies assessed against the ACSC Maturity Model, scored Maturity Level Zero to Three
• Evidence-based review across application control, patching, macro settings, application hardening, administrative privileges, MFA, and backups
• Alignment to the broader ACSC Information Security Manual where it applies to you
• A clear path to the target maturity level you actually need, not Level Three for its own sake

Best for Australian teams holding themselves to the ACSC baseline.

Scope of workp. 2

Includes

• Information-security capability assessed against each CPS 234 requirement, from policy to control testing
• Information-security roles defined and the board's ultimate accountability mapped
• The classification of information assets by criticality and sensitivity reviewed
• Third-party and related-party arrangements tested against the standard's reach into your supply chain

Best for APRA-regulated entities and the providers who serve them.

Scope of workp. 2

Includes

• Critical operations identified, with tolerance levels for disruption set and tested
• Operational risk and business-continuity capability reviewed against CPS 230
• Material service-provider arrangements mapped, with concentration and exit risk surfaced
• Scenario testing of severe-but-plausible disruption against your tolerances

Best for APRA-regulated entities preparing for CPS 230.

Scope of workp. 2

Includes

• Your obligations confirmed: which assets are covered, and whether enhanced obligations for systems of national significance apply
• A Critical Infrastructure Risk Management Program reviewed across the cyber, physical, personnel, and supply-chain hazard domains
• Cyber hazard maturity assessed against a recognised ACSC framework (the Essential Eight or the ISM), as the rules contemplate
• Incident-reporting readiness against the mandatory 12-hour and 72-hour timeframes

Best for responsible entities for assets covered by the SOCI Act.