Cyber security governance
We assess, plan and evidence security controls against the Essential Eight, the Information Security Manual (ISM) and the obligations your organisation already carries.
Security governance is the record a board can rely on: which controls exist, who owns them, and how they are tested. We build that record and the plan that closes the gaps.
What this covers
- Essential Eight maturity assessment and uplift roadmap
- Security policy framework, written for your organisation
- Identity and access review: privileged access, joiners, movers and leavers
- Supplier and platform due diligence
- Risk register and control ownership
- Board and executive reporting on security posture
Typical engagements
- An assessment with a written roadmap
- A policy framework with named control owners
- An access review before an audit
- Governance support on a retainer
How an engagement runs
Enquiry
You describe what has to change. We reply in writing with questions.
Scoping
One conversation to agree the problem, the people affected and how the result will be accepted.
Proposal
A written scope, acceptance criteria, a price and a start date.
Delivery
We lead the work. Decisions, risks and changes are recorded as they happen.
Acceptance
The result is checked against the criteria agreed at the start.
Handover
Documents, access and records pass to your organisation.
Close
A short written close-out, and a support retainer if you want one.
Who this suits
Organisations that report to a board, a regulator or a funding body on how they protect information, and that need the evidence to hold when it is read.
Technology teams that run the controls but have no time to write the policy, the register and the report that sit above them.
We work to the Essential Eight and the ISM. Where an engagement needs independent technical testing, we scope and manage the external provider.
Typical platforms: Microsoft 365 and Entra ID, Google Workspace, AWS, Google Cloud and Azure.