Skip to content
Cyber Security Co

Services

Cyber security services

Each service answers a defined question and ends with evidence, rated findings and a practical plan.

  • Essential Eight maturity assessments

    Assessment of all eight mitigation strategies against the ACSC Essential Eight Maturity Model, tested on live configuration. You receive a maturity rating per strategy, a gap register and a sequenced path to your target level.

  • ISM and PSPF alignment

    Mapping of systems and policies to Information Security Manual (ISM) controls and the Protective Security Policy Framework (PSPF), with evidence for annual PSPF reporting and system authorisation.

  • Penetration testing and vulnerability assessment

    External, internal, web application and cloud configuration testing under written authorisation and agreed rules of engagement. Findings are verified, rated by business impact and retested after remediation.

  • Incident response planning and tabletop exercises

    Plans and playbooks that set decision rights, escalation and communications, tested in facilitated exercises that include assessing a suspected eligible data breach under the notifiable data breaches scheme.

  • Cyber security strategy and board reporting

    A multi-year strategy linked to risk appetite and budget, and regular reporting that gives a board or audit and risk committee a clear view of maturity, trend and residual risk.

  • Third-party and supply-chain cyber risk

    Supplier tiering, evidence-based due diligence, contract security clauses and ongoing assurance, including supply-chain hazards in a risk management program under the Security of Critical Infrastructure Act 2018 (SOCI).

  • Security awareness training

    Role-based sessions for staff, executives and privileged users on phishing, social engineering, data handling and reporting, with measures that show whether behaviour has changed.

  • Virtual CISO

    Part-time senior security leadership: owning the security program, briefing executives, guiding internal teams and managing providers, without a full-time appointment.

  • ISO/IEC 27001 readiness

    Gap assessment against ISO/IEC 27001:2022, then scope, risk treatment plan, Statement of Applicability and internal audit, so your organisation enters its certification audit prepared.