Skip to content
CYBERSECURITYLINKBook a confidential strategy session
Home/Cybersecurity
PILLAR OVERVIEW · 12 SERVICES

Cybersecurity

Twelve productised services covering security strategy, assurance and compliance, resilience, and the Australian frameworks buyers and regulators actually ask about.

Every service, and how it is priced
01 / The complete practice

Every cybersecurity service, with what it costs.

Indicative fees are available to registered users with an organisational email address. From means the fee moves with scope; Discovery means it is scoped in a workshop before anything is quoted.

ServiceWhat it producesDurationModeFee
Security Strategy & Roadmaps
A phased, costed security roadmap with board-ready framing8 to 12 wksFromRegister to see indicative fees
Security Architecture & Zero Trust
A target-state architecture and a migration sequence10 to 16 wksDiscoveryScoped
Identity & Access Security
An identity control baseline and a privileged-access design8 to 12 wksDiscoveryScoped
Cloud Security
A cloud control baseline with a configuration gap register6 to 10 wksFromRegister to see indicative fees

Indicative fees are shown to registered users and confirmed in writing after scoping · Full pricing detail, and what moves each fee

ONE
DISCIPLINE
WHY THESE BELONG TOGETHER

Twelve services, one
operating discipline.

These twelve sit together because they answer to the same standard of evidence: every engagement ends in something a board, an auditor or a customer can inspect.

Strategy produces a sequenced plan. Assurance produces a control-mapped position. Resilience produces a tested playbook. Framework work produces a rating or a gap set someone else will check.

02 / Choose by situation

Four groups, chosen by situation.

Cybersecurity service categories

01

Strategy & Architecture

If security spend has grown without a plan behind it, and you need a sequence you can defend in a budget submission, this is the group.

Usually starts with Security Strategy & Roadmaps. Architecture without a strategy is an expensive guess.
Security Strategy & Roadmaps

A phased, costed roadmap with the board framing already done

Security Architecture & Zero Trust

Target-state architecture and a migration sequence that survives contact with the estate

Identity & Access Security

An identity control baseline and a privileged-access design

Cloud Security

A cloud control baseline with a configuration gap register

02

Assurance & Compliance

If a customer, an auditor or a regulator has asked you to prove something, and the evidence doesn’t currently exist in one place, this is the group.

Usually starts with Security Assessments. You can’t close a gap you haven’t evidenced.
Security Assessments

Control-mapped findings with severity ratings and a remediation sequence

ISO 27001 Readiness

An audit-ready ISMS and an Annex A evidence pack

GRC & Third-Party Risk

A supplier risk framework and an assessed vendor register

Continuous Compliance

Monitored controls and a quarterly evidence cycle, month to month

03 / The usual sequence

The order these usually happen in.

Most organisations don’t buy all of these, and almost nobody buys them at once. This is the sequence we see most often.

01

Establish the position

An evidenced current state. Every figure and every plan after this depends on it being real rather than asserted.

Security Assessments · Essential Eight Readiness
02

Set the direction

A sequenced, costed roadmap. This is the artefact that turns findings into a budget submission.

Security Strategy & Roadmaps
03

Build and close

Architecture, identity, cloud and supplier work. The longest and most expensive stage, which is why it follows a plan.

Architecture & Zero Trust · Identity & Access · Cloud Security
04

Evidence it, repeatedly

Certification and continuous assurance. Both evidence work already done; neither creates security on its own.

ISO 27001 Readiness · Continuous Compliance

Runs alongside rather than after: Incident Response & Resilience and Cyber Insurance Readiness. Both are driven by external dates (an exercise schedule, a renewal) rather than by programme stage.

If a tender or a policy instrument has named a framework and given you a date, start there instead. IRAP and Essential Eight work has its own sequence driven by someone else’s deadline, and fitting it into a broader programme usually costs more time than it saves.

04 / Named accountability

Who leads this practice.

05 / Scope you can inspect

The standards and frameworks
we work to.

Where a framework has its own page, the name links to it.

01ISO/IEC 27001
02ISO/IEC 27002
03NIST Cybersecurity Framework
06Protective Security Policy Framework · AU
07APRA CPS 234 · AU
08SOCI Act & CIRMP Rules · AU
09CIS Controls

AU marks frameworks that apply in a specific jurisdiction.

06 / The boundary

What this
practice doesn’t
cover.

01
Operations

We are not a managed security service.

We don’t run your SOC, monitor your environment, or hold an operational pager.

02
Certification

We prepare organisations for assessment and certification, but we do not certify our own work.

Accredited certification bodies certify. We are not one, and we never sit on both sides of that line. For IRAP-related work, we clearly separate assessment and advisory roles.

03
Products

We don’t resell, implement or support security products.

We take no vendor margin. Remediation is delivered by your team or a partner you choose.

04
Referrals

If you need one of these, say so and we’ll point you to someone.

We take nothing for the referral.

CLIENT EVIDENCE

What this work produces

Financial services400 to 800 staff
The challenge

A tender required an evidenced Essential Eight maturity position within eight weeks, and the organisation’s last assessment had been a self-scored spreadsheet that nobody was willing to sign.

The approach

An evidence-based maturity assessment across all eight strategies, then a costed uplift roadmap prioritised against the specific level the tender required rather than against a generic target.

More of the work
7 weeks

From engagement to an evidenced maturity position submitted with the tender, inside the eight-week window.

07 / What this costs

What thesecost.

Indicative fees

Register to see indicative fees

Indicative fees are available to registered users with an organisational email address. Each service is a fixed fee, a “from” fee or scoped in a discovery workshop, and one runs as an ongoing monthly service. What moves a “from” fee is almost always the same three things: how many systems are in scope, how much evidence already exists, and the target you’re being held to. Discovery-mode services are the ones where those variables are wide enough that quoting a number before scoping would be guessing.

Every fee, what moves it, and how engagements are contracted
08 / Questions

Questions about cybersecurity.

Almost always an evidenced current position: Security Assessments, or Essential Eight Readiness if a framework has already been named for you. The sequence above sets out what usually follows, and the exception line covers when it doesn’t apply.

THE ADJACENT PILLAR

If your question is actually about AI.

A growing share of readers arrive here through a cybersecurity search when the real trigger was AI adoption: a tool deployed without review, a board question, a procurement questionnaire. The two are one accountability problem, and the governance model usually extends rather than duplicates. If AI is what’s actually driving this, start there.

AI Security: 9 services
CHOOSE YOUR NEXT STEP

Most people who read this page start with one of three things.

01
Still working out what you needFree AI Risk Self-Assessment
02
Ready to talk it throughBook a confidential strategy session
03
Want the numbersPricing