Essential Eight, ISO 27001, APRA and SOCI are not interchangeable. We first look at your legal role, customer contracts, systems and business goals. From there, we can recommend a suitable assessment.
A supplier questionnaire mentioning CPS 234 does not automatically make your business APRA-regulated. Likewise, the Essential Eight is widely useful but isn’t a universal statutory requirement for Australian SMEs.
Usually relevant when: a government buyer, contract or internal security program asks you to assess eight core mitigation strategies.
We can help with: agreed-scope evidence review, control gaps and a realistic improvement plan. A formal maturity assertion needs the applicable complete methodology and scope.
Essential Eight readinessUsually relevant when: your organisation is considering the newer enterprise IT, cloud or operational technology guidance.
We can help with: explaining the transition, identifying the relevant chapter and reusing evidence where appropriate. An Essential Eight maturity rating does not automatically transfer.
Read the transition guideUsually relevant when: customers want a formal security management system, or your organisation is preparing for independent certification.
We can help with: scoping, risk assessment, control documentation, internal readiness and evidence gaps. Certification is issued by a certification body, not Cyber Evident.
ISO 27001 readinessUsually relevant when: you are an APRA-regulated institution; suppliers can also face related contractual information-security or resilience obligations.
We can help with: applicability screening, evidence mapping, control-assurance preparation and supplier documentation. We don’t imply a supplier is directly regulated just because its customer is.
Discuss APRA-aligned readinessUsually relevant when: your organisation holds a specific role for a covered critical infrastructure asset.
We can help with: examining the role and asset class, organising cyber-risk evidence and identifying gaps for specialist and legal review. We do not provide legal applicability determinations.
Explore SOCI readinessUsually relevant when: you’re managing cyber risk, handling personal information, or answering a large customer’s evidence request.
We can help with: control registers, practical action plans, incident process reviews and evidence packs aligned to the agreed obligation or customer question.
Supplier assuranceFramework guidance changes. Actual obligations depend on applicable law, policy and contracts.
Tell us who issued it, what it asks for and when a response is due. We can discuss an appropriate, limited engagement before requesting sensitive evidence.
Discuss your requirement