Real CISOs, on call
Industry veterans who have run security functions in regulated environments. Strategy, risk and leadership for your board and regulators.
Security leadership for critical infrastructure and enterprise
We deliver measurable security outcomes for critical infrastructure operators, enterprises and Defence suppliers across Australia. Our approach combines strategic leadership with hands-on operational delivery, and starts with getting the fundamentals right.
DISP and Essential EightAESCSF and SOCIOT and SCADA security
What we do
Four services, CISO-led from start to finish
Use one, or bring us in across the whole security program.
Maturity and compliance
Assessments, roadmaps and governance against DISP, Essential Eight and the ASD Essentials, AESCSF, ISO/IEC 27001 and the SOCI Act.
Design, build, hand over
Disciplined delivery of security controls and tooling, from planning through execution to clean handover to your team.
Service and stretch resources
Ongoing support to detect, protect, respond and recover, including monitoring, vulnerability management and incident readiness.
Defence Industry Security Program
A clear pathway to DISP membership, and keeping it
Defence and its primes expect suppliers to be DISP members. We take Australian businesses from first assessment to membership, then keep them suitable year after year across all four DISP domains.
Readiness assessment
An evidence-based baseline against DISP Entry Level and Level 1, including an Essential Eight Maturity Level 2 assessment of your corporate ICT.
- You get
- Gap register, Maturity Action Plan, executive briefing
- Typical timeframe
- About 4 weeks, fixed price
Essential Eight uplift
Close the gaps that block eligibility, prioritised by risk and effort, working alongside your IT provider.
- You get
- ML2 controls in place, documented and evidenced
- Typical timeframe
- 6 to 12 weeks
Security policies and plans
Right-sized SPPs, registers and procedures, including AS 4811 screening, insider threat and security awareness.
- You get
- A governance framework your team can actually run
- Typical timeframe
- 3 to 6 weeks
Application and CSQ
We prepare the DISP application and Cyber Security Questionnaire with you, then handle Defence's questions during assessment.
- You get
- A complete, evidence-backed application
- Typical timeframe
- 2 to 3 weeks, then Defence processing
Ongoing suitability
Annual Security Report, SPP reviews and staff acknowledgements, change reporting, and readiness for Defence assurance activity.
- You get
- Membership that stays current and defensible
- Typical timeframe
- Ongoing retainer
Managed DISP
One engagement, one accountable partner
Prefer not to manage five separate pieces of work? CISO52 can run the full pathway as a managed program: assessment, uplift, governance, application and annual reporting, with a CISO accountable for the result. We also help eligible SMEs apply for Defence Industry Development Grants to co-fund the uplift.
Governance
CSO and Security Officer roles, SPPs, registers, reporting and the Annual Security Report.
Personnel
AS 4811:2022 screening, clearance management, travel and contact briefings.
Physical
Access control, site security plans, and security zones for classified holdings.
Cyber
Essential Eight ML2, the Cyber Security Questionnaire, and the move to the ASD Essentials.
Critical infrastructure and OT
Security for systems that keep the lights on
Our team has led cyber uplift in energy transmission and distribution, transport and heavy industry. We understand SCADA, plant networks and the regulators that oversee them.
- AESCSF and SOCI. Maturity assessments against SP-1 to SP-3, CIRMP support and regulator-ready reporting.
- Secure data transfer and remote access. Data diodes, managed file transfer, removable media control and zero-trust OT access.
- Asset visibility. Find and classify every IT, OT and IoT device before you try to protect it.
- Implementation that sticks. Cyber technology is only as good as its implementation and support.
Our partners
We use technology we believe in and partner with specialists who lead their field, so you never get a D-team after being sold an A-team.
Technology partners
Implementation partners
Get started
Not sure where to start? Get in touch
Tell us about your security challenges to discuss how we can help. Start with a 30-minute strategy call with a CISO, or a fixed-price DISP readiness assessment with a costed plan to close the gaps.
info@ciso52.com
Sydney, New South Wales, Australia