Governance & Compliance Projects
Governance and compliance projects prepare an organisation to meet a security or AI framework and to show evidence that it does. Umbrella Tech provides governance, risk and compliance support for Australian organisations working towards the Essential Eight, ISO/IEC 27001, ISO/IEC 42001, SMB1001, DISP or RFFR: we assess the gaps, fix the controls and policies, and prepare the evidence. Certification decisions stay with the independent assessor.
No case study is published for this area yet. Read the published case studies →
Illustrative project scopes
These describe the kinds of work we deliver. They are not accounts of specific client engagements.
Framework readiness
Agree the scope, review current controls and evidence, and set out a practical preparation roadmap.
Typical deliverablesScope statement, control and evidence review, preparation roadmap
Control remediation
Turn findings into technical and organisational changes, each with an owner and a way to show it works.
Typical deliverablesRemediation plan with owners, the changed controls, evidence that each one works
AI management systems
Connect an AI inventory, risk decisions and approval processes with the evidence an ISO/IEC 42001 review expects.
Typical deliverablesAI inventory, risk and approval records, evidence for an ISO/IEC 42001 review
What governance, risk and compliance means
Governance is how an organisation sets its security rules and makes decisions. Risk management is how it identifies and treats the threats that matter. Compliance is showing that it meets external requirements, such as a standard, a contract or a government framework. Cyber security compliance and IT compliance services sit where the three meet the technology.
The frameworks we work with
- Essential Eight: the Australian Signals Directorate's eight mitigation strategies and their maturity levels.
- ISO/IEC 27001: the international standard for an information security management system (ISMS).
- ISO/IEC 42001: the international standard for an artificial intelligence management system (AIMS).
- SMB1001: a tiered cybersecurity standard for small and medium businesses.
- Defence Industry Security Program (DISP): security requirements for businesses in the Defence supply chain.
- Right Fit For Risk (RFFR): the Department of Employment and Workplace Relations' assurance approach for providers' IT systems.
How outcomes are validated
We agree what evidence a reviewer will expect before work begins. Depending on scope, evidence can include:
A complete delivery record
Each project ends with the scope, the gap register, the changes made, the evidence collected and the items still open. It names who maintains each control and document, because a framework needs evidence of operation over time, not only at the start.
Initial condition
Frequently asked questions
What does Umbrella Tech provide for governance, risk and compliance?
Gap assessments, remediation, policy writing and evidence preparation against the frameworks above, plus the technical changes many controls need. We support readiness and preparation; we do not issue certifications or audit results.
Who are governance and compliance projects for?
Organisations facing a customer, contract, tender, insurer or government requirement, and leadership teams that want a recognised structure for security or AI decisions. Many are small and medium businesses without a dedicated compliance role.
What outcomes should a compliance project deliver?
A clear view of where you stand against the framework, the gaps closed or planned with owners, and evidence organised so an assessor can follow it. Whether certification follows is decided by the independent certification body or assessor.
Your next project
Tell us which framework or requirement you are working towards and by when. We can help define the scope and plan the work. You can also browse all Projects.