Compliance insights for Australian organisations

Practical, audit-ready guidance on ISO 27001, Essential Eight, SOC 2, ISO 42001, and ISO 27701 — with Microsoft 365 examples and implementation patterns that pass auditor sampling.

Written by practising consultants who run certification engagements for Australian healthcare, financial services, SaaS, and government-adjacent businesses. Every article covers implementation specifics — not framework summaries you could get from the standard itself.

Filter:

Latest

Essential EightEssentials SeriesASD

ASD Has Published the Essentials: What Changed from the Essential Eight

ASD published the Essentials on 15 October 2026: chapters for enterprise IT, cloud and OT, and area-by-area reporting instead of one maturity level.

15 October 2026Read article →

All articles

Security

Essential EightEssentials SeriesASD

Essential Eight to the Essentials Series: Where Things Stand in October 2026

ASD is replacing the Essential Eight with the Essentials series. Consultation has closed and no publication date is set. What is known, and what to keep doing.

10 October 2026Read →

AutomationMicrosoft 365ISMS

Continuous Compliance Is Not a Slogan — Here's What It Actually Looks Like Inside Microsoft 365

Most 'continuous compliance' claims are marketing. Here's the literal mechanism — scheduled scans, drift alerts, and automated chasing, inside your own tenant.

22 August 2026Read →

ISO 27001Essential EightRisk Management

ISO 27001 and Essential Eight: The Same Controls, Wearing Two Name Tags

Already certified to ISO 27001 or assessed against Essential Eight? The two frameworks share most of their technical control ground. Here's the actual overlap.

22 August 2026Read →

APRACPS 230CPS 234

CPS 230 Is in Force. Essential Eight Is the Control Backbone APRA Expects Underneath It.

APRA's CPS 230 came into force alongside CPS 234, and Essential Eight is the control set regulated entities use to evidence both. How they fit together.

1 August 2026Read →

NIS2ISO 27001SaaS

Does NIS2 Apply to You? If You Have EU Customers, Maybe Already.

NIS2 is driving ISO 27001 demand across EU supply chains. If you sell to EU customers, their obligations may already flow down to you. What to check.

1 August 2026Read →

Cyber Security ActRansomwareEssential Eight

If You Pay a Ransom, You Now Have to Report It. Do You Know the Process?

The Cyber Security Act made ransomware and extortion payment reporting mandatory. What the obligation requires and how it pairs with Essential Eight.

31 July 2026Read →

ISO 27001AWSMicrosoft 365

DLP in Purview vs Macie: Compliance When Your Product Isn't in Microsoft 365

How the Statement of Applicability, evidence and control mapping work when staff use Microsoft 365 but your product runs in AWS — DLP as the example.

28 July 2026Read →

CheckpointISO 27001SOC 2

Introducing Checkpoint — the Compliance Console That Never Leaves Your Tenant

The compliance console we build every engagement on. Every record stored as SharePoint lists in your own tenant — no backend, no third-party platform.

9 July 2026Read →

Essential EightACSCAustralia

Essential Eight Maturity Level 2 vs ML3: What's Actually Different?

Most Australian organisations target Essential Eight ML2. What genuinely changes at ML3, who should pursue it, and what it takes to get there.

8 May 2026Read →

ISO 27001SOC 2Australia

ISO 27001 vs SOC 2: Which Should Australian Companies Do First?

ISO 27001 and SOC 2 often come up together in Australian enterprise sales. How to decide which to pursue first — and when to do both.

1 May 2026Read →

Enterprise SalesComplianceISO 27001

3 Compliance Fears Killing Your Enterprise Deals — And How to Turn Them Into a Competitive Advantage

Losing enterprise deals because you can't prove security, privacy or AI governance fast enough? What procurement looks for, and how to fix each gap.

25 January 2026Read →

ISO 27001ISMSRisk Management

13 Things Most People Don’t Know About ISO 27001 & the ISMS

ISO 27001 is one of the most misunderstood security standards. Here are 13 surprising truths about the ISMS, with practical business examples for each.

22 January 2026Read →

ISO 27701ISO 27001PIMS

ISO/IEC 27701:2025 — Align Security and Privacy (ISMS + PIMS)

What's new in ISO/IEC 27701:2025, how it aligns with ISO/IEC 27001:2022, and the fastest path to dual assurance in Australia.

21 October 2025Read →

ISO 27001ISO 27701PIMS

ISO 27001 vs ISO 27701 in Australia — Which, When, and Why Both?

The key differences between ISO 27001 and ISO 27701, when to implement each, and why most Australian organisations now certify both together.

20 October 2025Read →

ISO 27001ISMSSecurity

7 Practical ISO 27001 Quick Wins for Australian Organisations

High-impact actions that build real ISMS momentum — scope definition, risk registers, Annex A mapping and Microsoft 365 evidence automation.

9 October 2025Read →

Privacy

Privacy ActAPPsData Breach

Privacy Act Tranche 2: What the Draft Bill Means for Australian Businesses

The tranche 2 Privacy Act exposure draft brings a fair and reasonable test, tighter consent and 72-hour breach statements. It isn't law yet. What to prepare now.

10 October 2026Read →

Privacy ActData BreachAutomated Decision-Making

The Privacy Act Changed. Here's What Actually Applies to You Now.

The reforms tightened breach notification, added automated decision-making duties and raised penalties. What changed, and what to check first.

30 July 2026Read →

ISO 27701PrivacyPIMS

ISO 27701 in Australia: Building a PIMS That Satisfies the Privacy Act

Extending ISO 27001 into a Privacy Information Management System under Australian law — the 13 APPs, ROPA, DPIAs and the Notifiable Data Breaches scheme.

2 October 2025Read →

AI

ISMDISPIRAP

ISM September 2026: AI Agents, App Consent and Threat Hunting — What Changed

The September 2026 ISM treats AI agents as identities, stops staff approving third-party apps and sets threat hunting every three months. What to change in Microsoft 365.

10 October 2026Read →

Privacy ActAPP 1AI Governance

Automated Decisions and Your Privacy Policy: The 10 December 2026 Deadline

From 10 December 2026, privacy policies must explain when software makes or substantially informs significant decisions about people. Who is caught and what to write.

10 October 2026Read →

ISO 42001AI GovernanceEnterprise Sales

Your Enterprise Customer's Security Questionnaire Now Asks About AI — Are You Ready?

Enterprise buyers now ask about AI governance. What they're asking, why most SaaS vendors can't answer yet, and how ISO 42001 gets you a ready answer.

28 July 2026Read →

ISO 42001AI GovernanceRisk

ISO 42001 (AI Governance): A Simple, Business-Ready Playbook

A practical guide to implementing ISO 42001 AI governance using tools you already have — Microsoft 365, SharePoint and simple workflows.

17 October 2025Read →

SOC 2

SOC 2Type 1Type 2

SOC 2 Certification Timeline for Australian SaaS — Microsoft 365 Guide

How long SOC 2 Type I and Type II actually take for Australian SaaS — real timelines, cost breakdown, and how to automate evidence in Microsoft 365.

2 November 2025Read →

Risk

NIST CSFCyber SecurityRisk Management

NIST CSF 2.0 for Australian Organisations: What It Is, and What It Isn't

NIST CSF 2.0 keeps showing up in Australian procurement and insurer questionnaires — but it isn't a certification. What it actually is, and how to use it.

22 August 2026Read →

Compliant Isn't the Same as Findable: Getting Onto Australian Government Procurement Panels

IS18, DISP and RFFR make you eligible for government work. Panels like BuyICT and state supplier lists are the actual door — here's how they work.

22 August 2026Read →

DISPDefenceISM

DISP Membership Requirements: What Australian Defence Contractors Actually Need

A plain-English guide to Defence Industry Security Program membership — what's assessed, what the levels mean, and what it takes to get there.

15 May 2026Read →

Want tailored guidance for your organisation?

These articles cover the general principles. A free 30-minute call will tell you what applies to your specific situation — and the fastest path forward.

Book a free 30-min call

Compliance insights for Australian organisations

ASD Has Published the Essentials: What Changed from the Essential Eight

Security

Privacy

AI

SOC 2

Risk

More reading

Want tailored guidance for your organisation?