Answers to common questions about defence cyber compliance

A structured evaluation of your organisation's controls against the Australian Signals Directorate's Essential Eight mitigation strategies, with a maturity level scored for each of the eight controls. Assessments reveal gaps, prioritise remediation, and produce evidence you can use for DISP, CSQ, and board reporting.

An Essential Eight assessment usually takes 3–6 weeks depending on environment size and documentation maturity. DISP support runs longer — typically a few weeks for scoping and gap assessment, followed by a tailored uplift program whose length depends on the starting point.

Assessment engagements start from $15,000. Uplift programs start from $40,000 and scale with the scope of remediation required. Assurance subscriptions start from $8,000/month. All pricing is indicative — your environment and objectives drive the final quote.

Yes. Our team is Canberra-based but we deliver across Australia. We have location hubs covering Sydney, Melbourne, Adelaide, and Perth, and travel in-person where engagements require it.

Yes. All consultants hold AGSVA clearances. Most of the team hold CISM certification, and we have an IRAP assessor on staff.

A half-day diagnostic where we identify your most material cyber risks against the Essential Eight and related frameworks. Indicative only — not a full assessment. Windows environments only; non-Windows clients will get a consultation meeting instead.

Yes, as part of a broader compliance engagement. We don't sell CMMC readiness as a standalone service — it only makes sense alongside Essential Eight, DISP, or dual AU/US compliance work.