Gap assessment and alignment against the Australian Government's Information Security Manual — for businesses that need to demonstrate more than the baseline eight strategies.
The ISM sets out controls the Essential Eight doesn't touch — governance, personnel, physical security, cryptography, cloud. Scope is tailored to which of these actually apply to your environment.
Policies, risk framework and oversight structured the way the ISM expects them to be, not just written down once.
Authentication, privilege and identity lifecycle assessed to the ISM's standard — a step beyond just switching on MFA.
Operating systems, applications and network devices configured against ISM-aligned baselines, not vendor defaults.
Classification, encryption at rest and in transit, and key management assessed against ISM cryptographic requirements.
Shared responsibility, vendor assessment and supply chain risk — where a lot of ISM gaps actually turn up.
Centralised logging, retention and alerting reviewed against what the ISM requires you to actually be able to see.
Plans checked against whether they'd actually work under pressure, not just whether one exists in a folder somewhere.
Vetting, physical access controls and staff awareness — the human and physical layers a purely technical audit misses.
Not every ISM guideline applies to every business — we work out which ones actually govern your environment first.
Controls checked against the relevant ISM guidelines, including the parts a technical scan alone would never catch.
A clear compliance position — what's aligned, what isn't, and what evidence backs each finding.
A prioritised uplift plan, sequenced by what's actually blocking your compliance position first.
If you're already aligned to Essential Eight and being asked for more, this is usually what's next.
Government contracts or panels that specify ISM alignment, not just Essential Eight.
Defence industry supply chain work that requires evidence against the broader framework.
Regulated or critical infrastructure businesses whose obligations go beyond the baseline eight.