ASD Essential Eight
Current-state assessment, target maturity discussion, risk-prioritised remediation and supporting evidence.
ASSURANCE & GOVERNANCE
Security controls that can be demonstrated.
From policy obligations to real design decisions, implementation evidence and review-ready documentation.
FRAMEWORKS & CONTROL SYSTEMS
Understand what applies. Prove what works.
Working to a framework is not the same as being certified, accredited or approved under it.
ASD Information Security Manual (ISM)
Control applicability, traceability, architecture and system security documentation.
Protective Security Policy Framework (PSPF)
Mapping protective security policy obligations to security architecture and evidence.
IRAP readiness
Assessment preparation and evidence support. Formal assessments are performed by ASD-endorsed IRAP assessors.
SOCI Act
Critical infrastructure risk management architecture and supporting cyber risk evidence.
APRA CPS 234
Information security capability, third-party risk and control assurance planning for regulated organisations.
ISO/IEC 27001
Information security management system readiness; accredited certification is performed independently.
SOC 2
Control design and audit evidence readiness; an independent auditor issues the report.
PCI DSS
Cardholder data environment scoping and readiness; required validation depends on entity and level.
NIST CSF 2.0
Govern, identify, protect, detect, respond and recover outcomes and a prioritised improvement roadmap.
ENGAGEMENT LIFECYCLE
From applicability to assurance.
- 01
Scope
Agree obligation, systems and accountable owners.
- 02
Assess
Map gaps to controls, impacts and practical risk.
- 03
Remediate
Sequence corrective design and implementation.
- 04
Evidence
Prepare and review what an assessor needs.