Independent advice, then the team that delivers it
Our Advisory and Consulting practice helps executives and IT leaders make informed decisions about their technology environment. We assess what you have, map it against the standards you answer to, and give you a costed roadmap. Where you want it delivered, the rest of our practice does the work.
Independent. Vendor neutral. Accountable.A selection of the organisations our engineers deliver for.
What we deliver
Advisory work is only useful if it changes a decision. Every engagement ends with something you can act on: a ranked list of gaps, a costed roadmap, or a recommendation you can take to a board or an assessor.
Who we work with
The analysis is the same discipline either way. What changes is who has to be convinced and what evidence they accept.
- Who. Federal and state agencies, councils, statutory bodies and government owned corporations planning transformation, uplift or remediation programmes.
- Drivers. Accreditation obligations, audit findings, machinery of government change and end of life infrastructure that has outlasted its funding cycle.
- Evidence. Findings mapped to the Information Security Manual, the Protective Security Policy Framework and the Essential Eight, in the form your assessor and your risk committee already work with.
- Procurement. Engagement through established government panels and arrangements, with security cleared personnel where the environment requires it.
- Independence. Advice separated from delivery. If you take the roadmap elsewhere, it still works, because it is not written around our own products.
- Who. Australian mid market and enterprise organisations, usually at the point where the environment has outgrown how it is run.
- Drivers. Cyber insurance conditions, customer security questionnaires, a cloud bill nobody can explain and a growing gap between what IT is asked for and what the team can absorb.
- Evidence. The same control frameworks government relies on, translated into what an insurer, an enterprise customer or an acquirer will actually ask you to show.
- Cost. Licensing, cloud consumption and support arrangements reviewed together, because most of the savings sit in the overlap rather than in any one line.
- Continuity. Co-managed by design. We work with your people rather than around them, so the capability stays in the business after we leave.
Where you sit between the two, a government owned corporation, a funded not for profit or a regulated commercial operator, the mixed obligation set is familiar ground for us.
How we engage
Advisory engagements are short, paid and scoped to a decision. You should know what you are buying and what you will hold at the end of it.
- FrameA working session to agree what decision the engagement has to support, who has to sign it off and what evidence they will accept.
- AssessDiscovery across environment, identity, cloud, security posture, operations and spend, using your own data rather than a questionnaire.
- AnalyseFindings mapped against the relevant control frameworks, with gaps ranked by consequence and effort rather than presented as a flat register.
- RecommendA costed roadmap with options, sequencing and the trade offs stated plainly, including the option of doing less than proposed.
- TransitionWhere you want it delivered, the work moves to the relevant practice with the same people who did the assessment still involved.
The rest of our practice
Advisory sets the direction. These are the teams that deliver it, and most engagements draw on more than one.
Standards and assurance
Public sector clients need the evidence to get accredited. Private sector clients increasingly need the same evidence for insurers, customers and boards. We advise to one standard and produce the artefacts once.
- FRAMEWORKACSC Essential Eight
- FRAMEWORKInformation Security Manual
- FRAMEWORKProtective Security Policy Framework
- CERTIFICATIONISO/IEC 27001 certified
- ASSESSMENTIRAP assessed
- MEMBERSHIPDefence Industry Security Program
- SOVEREIGNTYAustralian data sovereignty
- PERSONNELSecurity cleared personnel
- DELIVERYOnshore delivery and support
Our heritage is Federal Government and critical national infrastructure. That is why the analysis holds up when a commercial client is asked, at short notice, to show a regulator or a customer how their environment is controlled.
Accreditations
Independent assessment, security clearances and industry recognition, held so that our clients do not have to take our word for it.
Start with an assessment, not a proposal
Tell us what is driving the conversation, whether that is an audit finding, an accreditation deadline, ageing infrastructure or a technology decision nobody internally can settle. The usual first step is a short paid assessment that gives you a costed plan before you commit to anything larger.