Gap analysis
Control framework mapping
Map your existing controls to the framework you are being measured against, and get a control mapping matrix that shows coverage and the genuine gaps.
Map · remediate · evidence
Governance, risk and compliance
Security controls you cannot evidence do not count. We map your controls to the framework you are measured against, close the gaps, and hand over the registers and matrices your auditor will accept.
Governance, risk & compliance
Turn the audit finding into a closed item
Security controls you cannot evidence do not count. We build the governance layer that proves the controls exist, work, and are being reviewed — without burying your team in paperwork.
Close the loop
Audit findings remediation
Take the findings you already have and close them — owners, evidence and dates against each one, so next audit starts from a clean base.
Written to be read
Policy suite
Acceptable use, password, BYOD and information security policies written for your business and readable by your staff, not lifted from a template pack.
Tested process
Incident management
An incident management policy, reporting and tracking sheet, and a response process that works at 2am — because that is when it gets used.
Stop the repeats
Problem management
Known-error records and a problem management process, so recurring incidents get a root cause and a fix instead of being closed again each month.
Rehearsed
Business continuity & DR
DR plan, asset register, communications plan and closure reporting — a continuity capability that has been walked through rather than filed.
Database DR ›Frameworks
What we map your controls against
We map and prepare — the certification itself is issued by an accredited auditor, not by us. Knowing that distinction up front saves an awkward conversation later.
Australian obligations
- ACSC Essential Eight
- Privacy Act & APPs
- Notifiable Data Breaches
- APRA CPS 234
International standards
- ISO/IEC 27001
- NIST Cybersecurity Framework
- SOC 2
- PCI DSS
Operational frameworks
- ITIL service management
- CIS Controls
- Risk registers & treatment plans
How an engagement runs
Four stages to audit-ready
Assess
Review the controls you have, the framework you are measured against and the evidence you can currently produce. You get a gap list, not a lecture.
Map & prioritise
A control mapping matrix showing coverage, gaps and the risk each gap carries — so remediation money goes to the findings that matter.
Remediate
Close the gaps: policy written, controls implemented, owners named and evidence captured as the work happens rather than reconstructed later.
Evidence & review
Registers, matrices and logs handed over in a form your auditor accepts, plus a review cycle so compliance does not decay the week after sign-off.
Audit coming, and not sure you would pass?
Better to find out from us than from the auditor. Book a free scoping call and we will tell you where you stand and what closing the gap involves.
Book a Compliance Gap ReviewPublished
FAQ
Common questions
No, and be wary of anyone who says they can. Certification is issued by an accredited external auditor. What we do is assess your current position, map controls, close the gaps and prepare the evidence — so the audit is a formality rather than a discovery exercise.
ACSC Essential Eight, the Privacy Act and Australian Privacy Principles, the Notifiable Data Breaches scheme and APRA CPS 234 locally; ISO/IEC 27001, the NIST Cybersecurity Framework, SOC 2, PCI DSS and CIS Controls internationally; plus ITIL for service management.
Yes, and it is one of the most common engagements. We take the findings you have, assign owners and dates, implement the fixes and capture the evidence as the work happens — so the next audit starts from a clean base rather than the same list.
Yes — acceptable use, password, BYOD and information security policies written for your business and readable by your staff. A template pack nobody reads satisfies nobody, least of all an auditor who asks how it is enforced.
Because recurring incidents are a security risk, not just an annoyance. Problem management finds root cause and produces known-error records, so the same issue stops being closed and reopened every month.
Yes — DR plan, asset register, communications plan and closure reporting, walked through rather than filed. For database-level recovery specifically, that is covered in depth on our upgrades, migrations and DR page.
It depends entirely on your starting point, which is why the first step is a gap review. We will tell you honestly how far off you are before you commit budget — an unrealistic timeline helps nobody once the auditor arrives.
The gap review is a fixed-price assessment. Remediation is quoted once the gaps are known, as fixed price where the scope can be defined or $150 per hour with a four-hour minimum where it cannot. All prices are GST exclusive.