Southern ShieldCyber

02 · Federal government

Assurance you can rely on in a review.

Commonwealth entities, and the companies that deliver for them, require testing and advice that will stand in an assurance review. Scope, personnel, and evidence must be explicit.

Typical conditions

  • 01

    Evidence rather than narrative. Essential Eight and ISM expectations come with a requirement to produce the proof.

  • 02

    Procurement with defined boundaries. A scope, named deliverables, and a price that matches them. No open-ended discovery presented as a phase.

  • 03

    Handling before access. Australian hosting and data-handling requirements are settled before anyone logs in.

How the engagement is structured

  • 01

    Engagements structured for procurement from the first conversation

  • 02

    Findings pointed at ISM and Essential Eight themes where that is the language of the entity

  • 03

    Citizenship, clearance, and handling needs agreed before access

  • 04

    Onshore delivery, in Australian hours

Relevant services

01Penetration testingAuthorised testing of the applications, networks, and identities in operational use: the public portal, staff remote access, the API behind a form, and privileges that should not extend. Findings are ranked by what an attacker can reach, then written so an engineer and an executive can both act.TestingLearn more02AWS configuration reviewAccounts, identity, logging, network boundaries, and data guardrails, assessed against the settings around the workloads in production. The review separates a guardrail that can be closed promptly from a design change that requires a project.TestingLearn more03Incident response readinessPlans, roles, and a facilitated exercise that shows whether an incident can be contained: ransomware during business hours, a misused mailbox, exposed personal information, or failure of a public portal. The engagement concludes with an after-action record that names owners and dates.TestingLearn more06ComplianceEssential Eight, the Information Security Manual, the Privacy Act, SOCI, and the sector duties that already apply, mapped to evidence you hold. Gaps are ranked by obligation and effort, in language an auditor or a board can read.AdvisoryLearn more07GovernanceWe help you keep security decisions visible after the test, with a register that is maintained, policies staff can follow, and reporting suitable for a council, an executive or a board.AdvisoryLearn more

Contact

Talk to us about federal government.

Book a call about your organisation and the system you need to protect. We will come back with a scope, or with a question that makes the scope clearer.

Book a call