ISO 27001 & compliance consulting for Perth businesses.

Mining & resources sector

WA's resources sector is a major target for ransomware and nation-state attackers because operational technology (OT) — mine control systems, SCADA, and industrial automation — is increasingly converged with corporate IT networks. A ransomware event that crosses from IT into OT can halt production at scale. Essential Eight is highly relevant: its controls around application control, patching, and privileged access management address the OT/IT convergence risk directly. ISO 27001 is increasingly required by enterprise mining primes (BHP, Rio Tinto, Fortescue, Woodside) from technology and professional services suppliers in contracts and panel arrangements.

WA Government procurement

WA Government ICT suppliers face growing security requirements under the WA Digital Ready for Business framework and agency procurement policies. State government agencies in health, education, and infrastructure are tightening supplier security gates following public sector cyber incidents across Australia. Holding ISO 27001 certification or demonstrated Essential Eight maturity positions WA suppliers to clear security qualification criteria in state procurement panels without lengthy, bespoke security questionnaires for each tender. CCIWA members supplying to government and WA exporters facing enterprise procurement gates encounter these requirements directly.

Defence & shipbuilding

WA hosts significant defence industry, anchored by Austal's shipbuilding operations at Henderson. Austal's contracts with the Royal Australian Navy, the US Navy, and partners including Lockheed Martin, HII, and CASC create compliance obligations across the supply chain. Defence Industry Security Program (DISP) membership is required for companies working on classified defence contracts. ISM alignment and Essential Eight ML2 are the standard technical baseline. Perth companies in the defence supply chain — maritime, electronics, and professional services — face these requirements whether they are primes or sub-contractors.

University research & biotech

Curtin University, UWA, and their affiliated research institutes handle sensitive research data, international collaborations, and government-funded research subject to the Australian Government's Research Security framework. Biotech companies commercialising research — particularly those with US NIH grants or international pharma partnerships — face ISO 27001 requirements from enterprise partners and grant conditions. The WA biotech sector is growing and ISO 27001 is becoming a standard requirement in enterprise licensing and partnership agreements for WA-headquartered life sciences businesses.

Can you deliver in Perth from the east coast without it being painful?

Yes — the delivery model is remote-first by design, not as a compromise. The work happens inside your own Microsoft 365 tenant, so configuration, evidence collection and reporting do not depend on anyone being in the room. Workshops, leadership briefings and internal audit rehearsals are scheduled to WA hours, and we attend on-site where a session genuinely benefits from it.

Does the two-hour time difference slow an engagement down?

It has not in practice. Milestones are fixed at scoping and the bulk of the work is asynchronous — evidence lands in your SharePoint as it is produced. The overlap window covers workshops and reviews comfortably, and WA-hours scheduling means your team is not taking calls at the edges of the day.

Do you deliver in Perth or only in the eastern states?

We deliver across Australia. All engagements are remote-first — video, shared Microsoft 365 environments, and asynchronous collaboration work well for the entire programme. For Perth clients we can travel for kickoff workshops, leadership briefings, and internal audit sessions where in-person presence adds value. Perth's AWST timezone also means we share working hours with Singapore and Malaysia, making us well-positioned to support WA businesses with APAC customer or partner obligations.

What do WA mining companies typically need?

Mining and resources companies typically need two things: Essential Eight maturity uplift to address OT/IT convergence risk in mine operations, and ISO 27001 to satisfy procurement requirements from enterprise mining primes and joint venture partners. These are often delivered together — the control overlap is substantial, and a combined engagement is 30–40% cheaper than running them sequentially. Companies supplying to BHP, Rio Tinto, Fortescue, or Woodside should expect ISO 27001 to appear as a requirement in new contract negotiations.

What does the WA Government require from ICT suppliers?

WA Government agencies are increasingly requiring ICT suppliers to hold ISO 27001 certification or demonstrate Essential Eight maturity as a condition of tender qualification under WA procurement policy. The WA Digital Ready for Business framework and agency-level security policies are tightening. Holding ISO 27001 allows WA ICT suppliers to clear the security gate in government tenders without completing bespoke security questionnaires for each agency — a significant commercial efficiency for businesses supplying multiple WA Government customers.

How much does it cost and how long does it take?

Most Perth mid-market organisations (50–200 staff) complete ISO 27001 in 10–14 weeks at $40k–$80k fixed-price. Essential Eight uplift to ML2 typically runs 6–10 weeks depending on current maturity. Combined ISO 27001 + Essential Eight engagements are the most common shape for Perth technology and resources-sector businesses — one engagement, both certifications, 30–40% cheaper than running them separately. A 30-minute scoping call gives you a precise estimate for your environment.

ISO 27001 + Essential 8

WA Government agencies

The WA Government Cyber Security Policy, overseen by the Office of Digital Government, sets expectations for agencies and flows down to their suppliers. ISO 27001 plus evidenced Essential Eight maturity is the combination that survives procurement review.

ISO 27001 + Essential 8 ML2

Mining and resources

Major operators impose security requirements on digital and operational technology suppliers, and the consequences of downtime make resilience evidence a commercial condition rather than a formality. Essential Eight maturity is the control set most commonly named.

DISP + Essential 8 ML2

Defence and shipbuilding

Western Australia's defence sustainment work, particularly around Henderson, pulls suppliers into Defence Industry Security Program requirements and ISM-aligned controls.

ISO 27001 + SOC 2

Technology and services

Perth technology firms selling east-coast or offshore meet the same enterprise security bar as anyone else. Running ISO 27001 and SOC 2 together shares one control set across both reports.