Assess
Point-in-time- Cyber maturity assessment
- Vendor portfolio risk review
- AI inventory and ISO/IEC 42001 gap analysis
Services
One governed program for cyber, vendor and AI risk
Start with a focused assessment, build the program, or keep us on retainer for ongoing support.
Service 01
Technology & Cyber Risk
A clear, framework-based view of where your organisation stands, and a prioritised plan to close the gaps that matter most.
- ISO/IEC 27001
- NIST CSF 2.0
- Essential Eight
- CIS Controls
- SOC 2
- APRA CPS 230 / 234
- Maturity baseline. Assessment against your chosen framework, with control ratings verified by evidence.
- Risk and policy framework. A technology risk register, risk appetite statements and a right-sized policy set.
- Resilience readiness. Incident response planning, tabletop exercises and verified backup and recovery testing.
- Executive reporting. Board-ready reporting that tracks posture and remediation over time.
Service 02
Third-Party Risk Management
Our four-stage lifecycle gives verified, evidence-based coverage of every vendor that touches your data, systems or AI, scored with a single 0–100 TPR Score.
- CPS 230 / 234
- DORA
- NIST CSF 2.0
- ISO/IEC 27001
- Vendor inventory and tiering. A complete vendor list, including shadow IT and AI tools, tiered by criticality.
- Evidence-based assessments. Tiered questionnaires with mandatory evidence for critical controls such as MFA and backups.
- Contractual protection. Security addenda, right-to-audit and breach-notification clauses, plus AI data-use terms.
- Remediation, reporting and review. Verified closure of findings, executive TPR Score reporting and scheduled re-assessment.
Service 03
AI Risk & Compliance
Adopt AI with confidence. We help you understand where AI is used, what could go wrong, and how to govern it to ISO/IEC 42001, the international standard for AI management systems.
- ISO/IEC 42001
- NIST AI RMF
- EU AI Act
- AI inventory and classification. Every AI system in use, built, bought or embedded in SaaS, classified by risk.
- AI risk and impact assessments. Fairness, transparency, security and human-oversight risks, before and after deployment.
- AI vendor assurance. Data handling (no training on your data), model security and oversight of autonomous agents.
- ISO/IEC 42001 alignment. Design and implementation of an AI management system, and preparation for certification.
Working with us
Engagements that grow with you
Build
Program implementation- Risk and policy frameworks
- Third-party risk program stand-up
- AI management system design and rollout
Operate
Ongoing support retainer- Scheduled vendor re-assessments
- Quarterly executive risk reporting
- Ongoing AI governance and audit readiness
Ready to secure your third key?
Book a discovery session to baseline your cyber, third-party and AI risk posture.