Skip to content

Cybersecurity and compliance, regardless of your industry.

No sector regulator is writing IT rules for your industry. The pressure arrives another way: a customer's security questionnaire, an insurer's renewal form, a tender that wants ISO 27001. The controls behind all three are the same, whatever business you are in.

What's being asked of you ·  customers and insurers

What compliance means when your industry has no regulator of its own.

The pressure usually arrives from a customer or an insurer, not a regulator. The Privacy Act still applies by default to most businesses that hold personal information. The Notifiable Data Breaches scheme comes with it. Cyber-insurance questionnaires have gone from polite to demanding in two renewal cycles, and the questions barely change from one industry to the next.

ISO 27001 is the requirement you are most likely to be handed. It appears in supplier-assurance packs and tender documents across every sector. Tier 1 corporate customers, federal departments, state-funded agencies, defence-adjacent procurement: the same certificate, over and over. Most businesses we see outside the named sectors did not go looking for it. A major customer or a contract asked, and now it has a due date.

Then there is the contract itself. A 30-seat firm with one large customer can inherit the same evidence demands a 300-seat firm gets. The clause is written into the master services agreement, cascaded to their legal and procurement teams, and arrives in your inbox as a questionnaire. Someone spent hours preparing it. You get days to answer it.

In legal, finance, construction, mining, registered training, health and not-for-profit, the rules get sector-specific. Compliance pages for those seven sectors cover what each regulator expects.

What we do ·  Map, build, maintain

Compliance work for an industry with no framework of its own.

First we work out which rules actually capture you. The Privacy Act and the Notifiable Data Breaches scheme catch most Australian businesses by default. After that it depends on what you do and who you sell to. A logistics firm keeping employee and subcontractor records has the same Privacy Act weight as a payroll bureau. Homeowner data on residential projects gives an architecture practice obligations a purely commercial outfit avoids. Sign a sole-source government contract and you inherit whatever that contract bound you to. So we build the map from your customers, your contracts and the personal information you keep, rather than assuming it.

The practical work is the same shape whatever your industry. You need a written control environment, identity and access discipline, and logging that produces evidence when someone asks. You also need an incident-response plan the team can follow at 2am. When a specific framework does attach, it goes on top of that baseline rather than replacing it. ISO 27001 for a tender. The Essential Eight at a set maturity level for an insurer. Privacy Act evidence for a regulator query. A head contractor's own security questionnaire. Same foundation underneath, every time.

None of it is a one-off. We start with a gap analysis against the obligations that are genuinely in scope. We watch it as your customer mix and your contracts change, and we fix the drift when it shows up. The evidence pipeline keeps producing whatever the next questionnaire or audit will ask for.

We do not write your compliance program documents. The policy calls and the legal reading stay with you and your advisers. What we own is the machinery underneath: the controls, the logs, the retention, the evidence. And an answer that holds up when an auditor asks how a control is implemented.

The tools and the role ·  the operational toolkit

The capabilities you need together, and almost nobody has in-house.

Compliance frameworks have converged on much the same operational expectations, whatever sector you are in. We run these five as a service, so the cycle is continuing work rather than an annual scramble.

  • Trouble shows up while it is still recoverable

    Your device, identity, network and cloud logs go into one system, a SIEM (security information and event management). Alerting answers 'are we under attack right now', not 'were we under attack last quarter'.

  • Unapproved software never gets to run

    Allowlisting stops unauthorised programs running on your managed devices. It is one of the highest-impact Essential Eight controls and one of the hardest to operate in-house without breaking something. We run it as a service, exception handling included.

  • Known vulnerabilities get closed, not just listed

    Most providers run a scanner and email you the list. We run the scanner and then do the work that closes the findings, inside the thirty-day window most frameworks expect.

  • Staff finish the training, and you can prove it

    Annual training your staff actually finish, phishing simulations that escalate rather than scold, and completion reporting for your auditor or insurer.

  • Someone senior owns the roadmap, without the salary

    A virtual chief information officer (vCIO) gives you strategic IT advice, framework gap analysis, board-level reporting, risk register upkeep and vendor oversight. It is the compliance-aligned strategic role most firms your size cannot justify as a salary.

    vCIO service in detail

The risk that matters ·  Evidence gap

The compliance risk that actually breaks things.

You answer yes to a control on a questionnaire because the policy document says yes, while the control itself is patchy. Then something happens, and the customer or the insurer asks for the evidence behind that yes. The gap between the two is what the breach gets judged on. Flagging the gap up front nearly always keeps the relationship better than a yes that falls over later.

Where it fits ·  managed IT engagement

What a managed IT plan already covers, before any overlay.

Every CCP managed IT plan requires the same baseline controls, whatever industry you are in. Multi-factor authentication (MFA) on everything that matters, tested backups, same-day offboarding, and a password manager for every user. Ours or an equivalent from another provider, either works. That already clears part of a cross-industry security questionnaire before anything sector-specific goes on top.

The Managed IT + Compliance plan adds the next layer as a standing service rather than a one-off project: application control, vulnerability scanning with remediation inside the thirty-day window, centralised log monitoring, and cybersecurity awareness training with completion reporting for an auditor or insurer. That is where most of the rest of a security questionnaire gets covered without a special engagement.

Beyond that, we add work per engagement. ISO 27001 evidence for a corporate customer's supplier-assurance program. Data loss prevention (DLP) controls around a contractually sensitive data set. The Essential Eight at maturity level 2 for an insurer. Retention labels for a specific records obligation.

Most businesses outside the named industries do not need the Compliance overlay running continuously. They need the baseline done properly and a credible answer when the next questionnaire arrives, with the overlay added once a customer, insurer or tender actually asks for it. We will scope it straight in the fit conversation instead of pushing you up a tier by default.

Outside our scope: how your contracts should be read, which clauses you accept, and where you set your risk appetite. Those are calls for your lawyers and your board. We build and run the machinery those answers depend on.

Common questions

Questions about ISO 27001, the Essential Eight and the Privacy Act.

Can you help us reach ISO 27001 if a corporate customer requires it?
Yes. Outside the named regulated sectors, ISO 27001 is the framework customers demand most often. We have been through the certification cycle ourselves. That covers gap analysis, control implementation, documentation, the certification audit, and the surveillance audits that follow.
Do you handle Essential Eight maturity assessments?
Yes. The Essential Eight is the Australian Signals Directorate's set of eight mitigation strategies. It turns up regardless of sector, especially in cyber-insurance questionnaires and government-adjacent procurement. We run the assessment, name the gaps against a specific maturity level, and stage the work to reach that level inside a defined window.
What if our industry has its own compliance framework?
We map the framework, work out which controls it expects, compare that against what you already have, and build the overlay. Most industry frameworks share a common core: identity, access, logging, retention, incident response. The sector-specific parts go on top of the baseline instead of becoming a separate stack.
How is this different from hiring a compliance consultant?
A compliance consultant usually owns the policy work, the framework interpretation, the regulator conversations and the governance reporting. We own the technical machinery that work depends on: the controls, the logs, the evidence, the implementation the policy assumes exists. The two roles fit together. Some clients keep both. Some use us for the controls and external counsel for the legal side.
Can you help with cyber-insurance questionnaires in any industry?
Yes. Insurer questionnaires have converged on roughly the same controls whatever your industry or policy size. They ask about MFA coverage, backup testing, patching cadence, offboarding discipline, endpoint detection and response (EDR), and incident-response capability. We treat the renewal as a yearly evidence cycle and pre-fill what we can from your live control environment.
What Privacy Act obligations apply outside regulated sectors?
The Privacy Act applies to any Australian business keeping personal information, with formal Australian Privacy Principles (APP) obligations once you pass the small-business threshold. Tranche 2 of the reform is widely expected to remove that exemption for around 100,000 more Australian businesses. We configure your environment against the Australian Privacy Principles either way, so a change in the law is not a scramble.
What size of business does this make sense for?
Our sweet spot is 20 to 250 staff, and the minimum for a managed IT engagement is ten seats. The compliance overlay usually earns its cost once a major customer or an insurer starts demanding evidence. Or once you decide ISO 27001 is worth having to widen your customer base. Below that, the baseline plan does most of the work on its own.

Next step ·  start with the evidence

Find out where you actually sit.

The Essential Eight self-assessment takes about ten minutes. You get a branded PDF report you can hand to your insurer, your board or your compliance officer the same day. It works the same whatever industry you are in. If you want to know whether we are the right shop for the work, the fit check is next.

Start the Essential Eight self-assessment See if we're a fit
See if we're a fit