What Are Risk & Policy Services?
Cybersecurity is more than just tools and tech — it’s about understanding your unique threats and responding with clear, repeatable practices. We provide two foundational services to help your organisation make informed, consistent, and defensible decisions:
🔎 1. Cyber Risk Assessments
A structured review of your current cybersecurity posture using recognised frameworks such as:
- NIST Cybersecurity Framework (CSF)
- ACSC ISM or Essential Eight
- CIS Controls
- ISO/IEC 27005
We help you:
- Identify key assets, threats, and vulnerabilities
- Assess likelihood, impact, and existing controls
- Prioritise your remediation based on real risk
- Develop a practical, phased security roadmap
Deliverables:
✅ Facilitated risk discovery session
✅ Custom risk register (if one doesn’t exist)
✅ Risk heatmap and maturity summary
✅ Executive summary + actionable roadmap
This is ideal as a starting point before compliance projects, GRC implementations, or vCISO engagements.
📝 2. Policy & Procedure Development
Your cybersecurity policies should be practical, enforceable, and aligned to your operations — not copied from someone else’s PDF.
We help you:
- Review, draft, or refine cybersecurity policies
- Align with standards like ISO 27001, Essential Eight, ISM, or NIST
- Tailor policies to your org size, sector, and regulatory requirements
- Ensure procedures reflect how things actually work in your environment
Common Policies We Deliver:
- Information Security Policy
- Acceptable Use Policy
- Access Control & Remote Access
- Incident Response Plan
- Backup & Business Continuity
- Data Classification & Privacy
- Third-Party & Vendor Risk
- Secure Configuration or Change Management
Policies are delivered in editable format (Word), ready for rollout or review.
🧑💼 Who This Is For
- Councils and NFPs preparing for Essential Eight or ISM alignment
- SMBs building out their cyber program from scratch
- Organisations refreshing outdated or inherited policy suites
- Teams responding to cyber insurance or tender requirements
- Any business needing board-level cyber visibility and structure
📦 Optional Add-Ons
- Integration into a GRC platform (see our GRC as a Service (GRCaaS) offering →)
- Tabletop exercises based on risk scenarios
- Staff training on key policy rollouts
- Scheduled policy review cycles (e.g. annual or semi-annual)
💬 What Our Clients Say
“We finally have policies that reflect what we actually do — not what a consultant thinks we should. The risk register helped us show the board where our real priorities are.”
— ICT Coordinator, Community Housing Organisation
