Governance, risk and compliance (GRC) is how an organisation decides who owns security and AI risk, which rules apply and how it proves controls work. Umbrella Tech helps Australian organisations meet frameworks such as the Essential Eight, SMB1001, ISO/IEC 27001, ISO/IEC 42001, DISP and RFFR. We assess the gaps, implement the technical and procedural controls, and hand over evidence your team can keep current.
Most organisations arrive with a question from a customer, tender, insurer or regulator. We start by confirming which framework and scope actually apply, then measure the current position before anyone commits to implementation.
SMB1001 is a tiered cybersecurity standard for small and medium businesses, published by Dynamic Standards International (DSI).
Explore →The Essential Eight is a set of eight mitigation strategies published by the Australian Signals Directorate (ASD), measured using ASD's Essential Eight Maturity Model.
Explore →ISO/IEC 27001 defines requirements for an information security management system (ISMS).
Explore →ISO/IEC 42001 defines requirements for an artificial intelligence management system (AIMS).
Explore →The Defence Industry Security Program (DISP) is the Department of Defence membership program for businesses working in or seeking to join the Defence supply chain.
Explore →Right Fit For Risk (RFFR) is the Department of Employment and Workplace Relations (DEWR) approach to assurance over external IT systems used to deliver departmental services.
Explore → Start hereA cyber security risk assessment examines how threats and weaknesses could affect your organisation's information and operations.
Explore →Cyber security governance establishes how security decisions, responsibilities and performance are managed.
Explore →Security policy development defines how your organisation expects information and systems to be protected.
Explore →AI governance defines who can approve AI use, what information may be used and how outcomes are reviewed.
Explore →Compliance remediation turns identified control gaps into a coordinated improvement programme.
Explore →Cyber security compliance usually touches identity, devices, networks, Microsoft 365 and the people who run them. We can deliver a defined assessment or coordinate a broader programme, with your internal team, MSP and other providers keeping agreed responsibilities. The technical work draws on our Cybersecurity services, and AI obligations connect with AI & Automation.
A clear scope, the requirements we are measuring against, findings that separate missing controls from missing evidence, and a prioritised plan. Where we implement, you receive documented changes, validation records and a handover so ownership stays with your organisation. Certification, membership and accreditation decisions always rest with the relevant body.
We provide IT compliance services across assessment, implementation and ongoing governance: gap and readiness assessments, risk assessments, policy development, technical remediation and evidence preparation. The work covers the Essential Eight, SMB1001, ISO/IEC 27001, ISO/IEC 42001, DISP and RFFR, plus AI governance.
Australian organisations that need to show security or AI controls to a customer, tender panel, insurer, government department or certification body. That includes small businesses facing their first questionnaire and larger organisations building a formal management system.
A clear view of which requirements apply, controls that operate in your real environment, and evidence that shows it. You should also leave with named owners and a review routine, so compliance does not lapse after the project ends.
It depends on who is asking and why. A Defence contract points to DISP, a DEWR deed to RFFR, and an enterprise customer may ask for ISO/IEC 27001. If nobody has asked yet, an Essential Eight or SMB1001 baseline is often a sensible first step, and our Assessments & Roadmaps page lists the starting options.
Six questions about your customers, contracts and size. Frameworks worth considering appear as you answer, with the reason for each.
Answer a question and the frameworks worth considering will appear here.
General guidance only, not legal or compliance advice. Your contracts, funding deeds and the relevant program authority determine what applies.
Tell us which framework or requirement you need to meet, who is asking for it and what your environment looks like. We will help you find the right starting point.