Security Solution Consultants (SSC) are cyber security consultants Canberra agencies, Defence suppliers and software companies engage when a Commonwealth buyer wants evidence, not assurances. We are based in Tarneit, Victoria 3029, and work remote-first. We travel to Canberra when being in the room changes the outcome: control owner workshops, DISP physical security walk-throughs, data centre visits and findings sessions with executives. Our work in the capital covers PSPF and Essential Eight compliance, IRAP readiness, DISP preparation, ISO 27001 and the newer questions buyers ask about AI governance.

Canberra differs from other Australian markets because the customer is so often the Commonwealth. A software company in Braddon, a facilities contractor in Fyshwick and a consultancy in Barton can all receive the same procurement questions: what is your Essential Eight maturity, where will our data be hosted, has the service been through an IRAP assessment, are you a DISP member? We help you answer those questions truthfully and with evidence, and fix what needs fixing before you answer.

Which rules apply in the Australian Capital Territory

Most Canberra organisations answer to more than one set of rules. Find your row in the diagram first.

Which cyber security obligations apply to Australian Capital Territory organisations, by type of organisation
Commonwealth entities, their suppliers, ACT Government directorates, Defence industry and private businesses each answer to a different mix of rules.

Commonwealth entities. The Protective Security Policy Framework is now PSPF Release 2026, issued by Home Affairs with effect from 1 July 2026 and replacing Release 2025 of 24 July 2025. Non-corporate Commonwealth entities have been required to reach Essential Eight Maturity Level Two since 1 July 2022. Release 2026 adds a post-quantum cryptography transition plan, training on the use of AI, bring-your-own-device requirements and foreign interference training. The distance to travel is still long: ASD’s report on Commonwealth cyber security posture, published on 12 February 2026, found that 22% of entities reached Maturity Level Two overall in 2025. Alongside the PSPF sits the Information Security Manual, now at its September 2026 release, which includes new controls such as ISM-2126 on verifying possible deepfake requests through a pre-agreed channel.

Suppliers to Commonwealth agencies. The PSPF does not bind you directly, but agencies pass its expectations down through contracts, panels and security questionnaires. Cloud and hosting providers face two further gates. IRAP assessments can only be performed by ASD-endorsed IRAP assessors, and the Hosting Certification Framework, in place since 1 May 2023, certifies hosting providers at Assured or Strategic level.

ACT Government directorates and their contractors. Territory agencies work under the ACT Government Cyber Security Policy, which sits within the ACT Protective Security Framework (the policy portal was last updated on 8 October 2025). The Information Privacy Act 2014 (ACT) and its Territory Privacy Principles bind contracted service providers and their subcontractors on ACT Government contracts, so a private supplier can carry territory privacy obligations through its contract. The ACT Auditor-General’s Report 3 of 2020, Data Security, found that 89% of critical systems had no current security risk management plan. The report is several years old, but system-level risk plans are still the first document we ask directorate suppliers to show us.

Defence industry. Businesses on Defence contracts are commonly required to hold Defence Industry Security Program (DISP) membership, covered in detail below.

Private businesses. The ACT has no general data breach notification scheme of its own. Organisations covered by the Privacy Act 1988, broadly those with turnover above $3 million and all health service providers, notify eligible breaches under the Commonwealth Notifiable Data Breaches scheme. Businesses above $3 million turnover must also report a ransomware payment within 72 hours under the Cyber Security Act 2024.

Certifications Canberra businesses ask us about

Beyond the government frameworks, buyers in the capital commonly ask for six things.

  • SOC 2. Canberra SaaS companies that grow beyond government sales often meet corporate or overseas buyers who want a SOC 2 report rather than an IRAP assessment. A licensed CPA firm issues the report; we prepare the controls and evidence, and map them to the ISM so the work counts twice.
  • ISO/IEC 27001. The most portable credential a Canberra supplier can hold. Defence states that ISO 27001:2022 can partly evidence DISP requirements, and agency buyers commonly ask for it next to Essential Eight results. An accredited certification body issues the certificate; we build the management system and run the internal audit.
  • ISO/IEC 42001. The Policy for the responsible use of AI in government v2.0, effective 15 December 2025, asks agencies for accountable officials, an AI use-case register, impact assessments, transparency statements and staff training within 12 months. It does not mandate ISO 42001. For vendors, a 42001-aligned AI management system is a clear way to show agency buyers that the product is governed in a way that supports their obligations.
  • ISO 9001. Facilities, construction, fit-out and professional services firms on government panels are commonly asked for certified quality management, and Defence primes commonly expect it of their subcontractors.
  • ISO 22000. A smaller market in the capital, but food manufacturers and caterers that supply institutions, events and national retailers are commonly asked for ISO 22000 or the FSSC 22000 scheme built on it.
  • Critical infrastructure security. Data storage and processing providers, hosting providers and utilities serving the ACT can carry SOCI Act obligations, covered in the next section.

Critical infrastructure in the ACT

Critical infrastructure in Canberra is less visible than a port or an LNG plant, but it is there: the territory’s water, electricity and gas networks, the data storage and processing providers that host government workloads, and the health and higher education assets that sit alongside them. Responsible entities under the Security of Critical Infrastructure Act 2018 must keep a critical infrastructure risk management program (CIRMP), report serious cyber incidents within 12 or 72 hours and give a board-approved annual report by 28 September. The enhanced CIRMP rules that commenced on 10 June 2026 add obligations on 12 and 24 month grace periods, including a framework uplift such as Essential Eight Maturity Level Two, phishing-resistant multi-factor authentication and segregation of critical systems.

For hosting providers, Hosting Certification Framework certification and an IRAP assessment usually sit next to SOCI, with heavily overlapping evidence. We build one control set that answers all three. See our SOCI Act compliance and CIRMP audit service and our note on the enhanced CIRMP rules.

Our services in Canberra

Selling to Commonwealth agencies: PSPF, IRAP readiness and DISP

Most Canberra engagements start with a procurement question rather than a regulator. Three paths come up most often.

PSPF-driven supplier questions. An agency working towards Maturity Level Two, and reporting on it every year, will ask its suppliers the same questions it asks itself. Expect requests for your Essential Eight maturity, how privileged access to the agency’s data is controlled, where data is stored and, under Release 2026, how you approach post-quantum cryptography and staff use of AI. A short, honest maturity statement backed by evidence earns more trust than a thick policy pack.

IRAP readiness. If you are taking a cloud service or system to government, an IRAP assessment is likely to be on the path. Only ASD-endorsed IRAP assessors can perform one, and SSC does not. What we do is the work before the assessor arrives: define the system boundary, decide which ISM controls apply, write or tidy the system security plan and supporting documents, test the controls ourselves and close the gaps.

DISP membership. Defence grants DISP membership; consultants cannot. We prepare you for Defence’s assessment. Membership runs from Entry Level through Level 1 (PROTECTED), Level 2 (SECRET) and Level 3 (TOP SECRET), across four domains: governance, personnel security, physical security, and ICT and cyber security. Defence expects members to meet Essential Eight Maturity Level Two on the corporate ICT they use with Defence, and ISO 27001:2022 certification can evidence part of that domain. We run the gap assessment, help set up the governance roles and policies Defence looks for, and walk the physical controls with you on site in Canberra where that helps.

Canberra also has its own cyber ecosystem, including the Canberra Cyber Hub set up by the ACT Government and UNSW in February 2022.

From the Essential Eight to ASD Essentials

ASD published the ASD Essentials series on 15 October 2026, with separate chapters for enterprise IT, cloud and operational technology and a guide on transitioning from the Essential Eight. For Canberra this means a period of dual reporting, because PSPF Release 2026 still names the Essential Eight at Maturity Level Two. We assess against the current maturity model and show where the same evidence lines up with Essentials actions, so nothing has to be redone. Our guide to ASD Essentials explains the change.

GRCLens for Canberra suppliers

A Canberra supplier can face the ISM, the Essential Eight, ISO 27001, SOC 2 and a DISP review in the same year, each asking for much the same evidence. GRCLens, the GRC platform we build, keeps one control set and maps every framework to it, so you evidence a control once and report it many times.

Audits and assessments in Canberra

If you need a point-in-time view rather than ongoing advice, see our page on Essential Eight assessments and cyber security audits in Canberra, which covers PSPF self-assessment support, ISM compliance reviews and IRAP readiness assessments.

Penetration testing and security testing in Canberra

Penetration testing in Canberra sits alongside, not instead of, the formal assurance agencies already require. IRAP assessments are performed by ASD-endorsed assessors against the ISM; a penetration test shows whether a system can actually be broken, and gives both the assessor and the agency stronger evidence. Agencies working to PSPF Release 2026 and DISP members working to the Essential Eight at Maturity Level Two use testing to confirm their mitigations work in practice.

We test government-facing web applications and APIs, internal networks and Active Directory, and cloud tenancies hosting OFFICIAL and sensitive workloads. The September 2026 ISM added a control requiring identity to be verified through a pre-agreed channel to counter deepfake impersonation, which makes social engineering testing more relevant than ever. Canberra SaaS companies selling to government benefit most from threat modelling and secure code review early, because secure by design is now a procurement expectation. See our penetration testing and security testing services, or Essential Eight assessments in Canberra.

Frequently asked questions

Can SSC carry out our IRAP assessment in Canberra?

No. Only ASD-endorsed IRAP assessors can perform an IRAP assessment, and SSC is not one. We provide IRAP readiness: defining the system boundary, working out which ISM controls apply, preparing the system security plan and supporting documents, testing controls and fixing gaps. You then engage an endorsed assessor for the assessment itself, starting with a system that is documented and already tested.

Does PSPF Release 2026 apply to a Canberra company that supplies an agency?

Not directly. The PSPF binds Commonwealth entities, not their suppliers. In practice its requirements reach you through contract clauses, panel terms and security questionnaires, because the agency remains accountable for how its information is protected. Expect questions about Essential Eight maturity and data location and, since 1 July 2026, about post-quantum cryptography planning and the use of AI.

How does a Canberra business become a DISP member?

You apply to Defence, which assesses your business and grants membership at Entry Level, Level 1, Level 2 or Level 3. No consultant can grant it. We help you prepare across the four domains of governance, personnel, physical, and ICT and cyber security, including reaching Essential Eight Maturity Level Two on the corporate systems you use with Defence.

Do we need ISO 42001 to sell an AI product to a Commonwealth agency?

No. The Policy for the responsible use of AI in government v2.0, effective 15 December 2025, places obligations on agencies, such as accountable officials, a use-case register and impact assessments, and does not mandate ISO 42001. A 42001-aligned management system is still a practical way to show an agency buyer how your product is governed and how it supports the agency’s own obligations.

Does the ACT have its own data breach notification law?

There is no general ACT breach notification scheme. Private organisations covered by the Privacy Act 1988 notify under the Commonwealth Notifiable Data Breaches scheme. ACT Government contractors should also read their contracts: the Information Privacy Act 2014 (ACT) binds contracted service providers and subcontractors to the Territory Privacy Principles, and a contract may add its own incident reporting terms.

Do your consultants come on site in Canberra?

Yes, where it adds value. Document review, control testing and most interviews work well remotely from our base in Tarneit, Victoria 3029. We travel to Canberra for DISP physical security reviews, data centre and hosting visits, executive workshops and findings walkthroughs, and plan those visits into the fixed scope so travel does not become a surprise cost.

How should a Canberra agency handle the move from the Essential Eight to ASD Essentials?

Keep reporting against the Essential Eight, because PSPF Release 2026 still requires Maturity Level Two and names the Essential Eight. At the same time, map your existing evidence to the ASD Essentials actions published on 15 October 2026, so that when the PSPF and your contracts are updated you are relabelling evidence rather than starting again.

Next step

Tell us which buyer, contract or framework is behind the question and we will tell you what evidence you need and what it will take to produce it. Contact us or email info@secsolutionshub.com. We also support organisations in Sydney, Melbourne and Darwin.