Security Solution Consultants (SSC) runs the kind of Essential Eight assessment Canberra agencies and their suppliers need when a maturity claim has to stand up in a PSPF report, a contract review or a DISP application. We also audit against the Information Security Manual, PSPF Release 2026, ISO 27001 and the ACT Government’s own framework. SSC is based in Tarneit, Victoria 3029. Most fieldwork is remote, and we come to Canberra for technical walkthroughs, physical security checks and the closing session.
Who in Canberra is asking for audits, and why
Commonwealth entities. Non-corporate Commonwealth entities have had to reach Essential Eight Maturity Level Two since 1 July 2022 and report on it every year. Few have arrived: ASD’s 12 February 2026 report on the Commonwealth’s cyber security posture put 22% of entities at overall Maturity Level Two in 2025. An independent assessment shows an agency whether its self-assessed maturity would survive scrutiny and where the next dollar should go.
Suppliers asked to prove maturity. When an agency’s own rating depends on its supply chain, suppliers receive questionnaires. A Canberra software firm, managed service provider or consultancy that answers “Maturity Level Two” should have an assessment behind the answer.
Defence industry. DISP members must meet Essential Eight Maturity Level Two on the corporate ICT they use with Defence. Applicants and members commission assessments before applying, before seeking a higher level, or after significant changes to their systems.
Cloud and hosting providers. Before an ASD-endorsed IRAP assessor arrives, or before seeking Assured or Strategic certification under the Hosting Certification Framework, providers want an independent readiness check against the ISM.
ACT Government directorates and contractors. The ACT Government Cyber Security Policy, under the ACT Protective Security Framework, sets expectations for directorates, and the Information Privacy Act 2014 (ACT) extends the Territory Privacy Principles to contracted service providers and subcontractors.
Audit, technical assessment or penetration test?
These three are bought for different reasons. A compliance audit asks whether you meet a named requirement, such as the PSPF, an ISM control set or ISO 27001, and reports findings against each clause. A technical assessment looks at real configuration: how macros are restricted, how quickly patches land, who holds administrator rights, whether backups actually restore. An Essential Eight assessment blends the two, because the maturity model asks for evidence that controls are both implemented and effective. A penetration test tries to break in. It is valuable, but it does not produce a maturity rating, and an agency asking for your Essential Eight level will not accept a penetration test report in its place. Check which one your contract names before commissioning anything. If a penetration test is what you need, see our penetration testing and security testing services.
How an assessment in Canberra runs
Scope. We fix the systems, entities and requirement before anything else: the corporate network used with Defence, one cloud service heading to IRAP, or every system an agency reports on. A tight scope is the main lever on cost.
Documents. System security plans, policies, the asset register, privileged access lists, patching records and supplier agreements. Missing or stale documents are recorded as findings.
Control testing. For Essential Eight work we test each mitigation strategy against the target maturity level on a sample of workstations, servers and accounts, relying on system-generated evidence such as configuration exports and logs wherever possible rather than statements.
Interviews. System owners, administrators, the agency security adviser and, for DISP, the people who manage personnel and physical security.
Report. Maturity by strategy or findings by clause, each with a severity, an owner and a practical fix, then a closing session with the people who will do the work.
Which standard to audit against in Canberra
- Essential Eight Maturity Model and ASD Essentials. PSPF Release 2026 still names Essential Eight Maturity Level Two. ASD Essentials, published on 15 October 2026, is its successor; we report against the maturity model and map results across. See our Essential Eight assessment service.
- PSPF Release 2026. Support for an agency’s self-assessment, including the new requirements on post-quantum cryptography transition planning, AI use training, bring-your-own-device and foreign interference training. The framework is published at protectivesecurity.gov.au.
- ISM September 2026. An ISM compliance review of a system or service, including newer controls such as ISM-2126 on confirming requests through a pre-agreed channel to counter deepfakes.
- IRAP readiness. A readiness assessment before your ASD-endorsed assessor begins. SSC does not perform IRAP assessments. See security certification and accreditation support.
- Hosting Certification Framework. Readiness for Assured or Strategic certification.
- DISP. A gap assessment across governance, personnel, physical, and ICT and cyber security before you apply to Defence or seek a higher level.
- ISO 27001, SOC 2 and ISO 42001. Internal audits and readiness reviews for ISO 27001, SOC 2 and ISO 42001, the last useful for AI vendors whose agency customers must meet the government AI policy.
- SOCI Act CIRMP. For data centres, hosting providers and utilities, an independent review before the board approves the annual report. See SOCI Act compliance and CIRMP audit.
What you get at the end
A maturity rating per strategy or findings per clause, the evidence each rating rests on, a prioritised remediation plan with owners, and a one-page summary for your executive or audit committee. For PSPF and DISP work we also suggest accurate wording you can reuse in an annual report or application.
Timing
A single-environment Essential Eight assessment for a small supplier usually needs a few days of fieldwork. Agency-wide assessments and IRAP readiness reviews take longer. Most elapsed time goes on waiting for evidence, so the full evidence request goes out on day one.
Price
We quote a fixed price once the scope is agreed. The number of systems, the target maturity level and whether personnel or physical security are included move the price more than headcount does. If you are also preparing for an external assessment such as IRAP or ISO 27001 certification, the assessor or certification body is a separate engagement you contract directly.
ACT specifics that change the scope
Release 2026 widens the self-assessment. Agencies that assessed only the Essential Eight last year now need evidence on post-quantum planning, AI use training, bring-your-own-device and foreign interference training. Suppliers should expect matching questions in the next contract round.
Deepfake controls reach finance and helpdesk teams. ISM-2126 in the September 2026 ISM is about verifying requests through a pre-agreed channel, which is a process control as much as a technical one. We test it by talking to the staff who approve payments and reset passwords, not only by reading the policy.
ACT contracts bring privacy and risk planning into scope. Territory Privacy Principles flow to contracted service providers and subcontractors under the Information Privacy Act 2014 (ACT). The ACT Auditor-General’s 2020 Data Security report found 89% of critical systems without a current security risk management plan, so for directorate suppliers we check system-level risk plans early.
Audits across the Canberra region
We assess organisations across the ACT and the surrounding capital region, including Queanbeyan, Yass and Goulburn. Work is mostly remote, with on-site sessions where physical controls or restricted environments call for them. For ongoing advisory work, IRAP readiness programs and DISP preparation, see our page on cyber security compliance and consulting in Canberra.
Frequently asked questions
What evidence does an Essential Eight assessment in Canberra rely on?
System-generated evidence wherever possible: group policy and configuration exports, patch and vulnerability scan reports, privileged account listings, backup restoration records and logs. Statements and screenshots support the picture but rarely prove effectiveness on their own. We record what each maturity rating rests on and hand that record to you, so the rating can be defended if an agency or Defence asks.
Can you support our agency’s PSPF annual self-assessment?
Yes. We review your evidence against PSPF Release 2026, which took effect on 1 July 2026, test the Essential Eight requirement at Maturity Level Two, and check newer requirements such as the post-quantum cryptography transition plan and AI use training. The self-assessment remains the agency’s own; we give you an independent view of where it is well supported and where it is not.
What is an ISM compliance review?
A structured check of a system or service against the Information Security Manual controls that apply to it, currently the September 2026 release. We confirm control applicability, test a sample of controls and record gaps with fixes. It is often the step before an IRAP assessment, but it is not an IRAP assessment and does not replace one.
How is an IRAP readiness assessment different from an IRAP assessment?
An IRAP assessment can only be performed by an ASD-endorsed IRAP assessor, and its report is what agencies rely on. An IRAP readiness assessment is preparation: we check the system boundary, documentation and ISM controls, test them, and help you close the gaps first. SSC provides readiness work only; you engage an endorsed assessor for the formal assessment.
Will an Essential Eight assessment be enough for DISP?
It covers part of it. Defence expects DISP members to meet Essential Eight Maturity Level Two on the corporate ICT used with Defence, so an assessment is useful evidence for the ICT and cyber security domain. DISP also covers governance, personnel and physical security, and Defence makes the membership decision. We can assess all four domains together before you apply.
How long does an Essential Eight assessment take for a small Canberra supplier?
For a contained corporate environment, fieldwork usually runs to a few days, followed by the report and a walkthrough. Larger estates, more than one target maturity level or a combined DISP review take longer. The quickest assessments are the ones where the evidence request is answered in the first week, which is why we send it on day one.
Do ACT Government contracts change what you audit?
They can. The Information Privacy Act 2014 (ACT) binds contracted service providers and subcontractors to the Territory Privacy Principles, so personal information handling comes into scope. Directorates also work under the ACT Government Cyber Security Policy, which can shape the security terms in your contract. We read the contract first and audit to what it actually requires.
Next step
Send us the clause, questionnaire or PSPF requirement that started the conversation and we will propose a scope and a fixed price. Contact us or email info@secsolutionshub.com.
