Security governance and assurance -- the risk register, compliance clocks, the Essential Eight, reviews and findings, incident readiness -- with an advisory CISO and a Cybersecurity Specialist.
Included in Starter, Enterprise, Platinum · Version 1.01
Each worker advises and never acts. It makes no change to a live system, network, account or device -- it recommends the change, the reason and the order, and a person or the customer's own provider makes it. It never decides whether a data breach is notifiable: the serious-harm judgement and the decision to notify the regulator and affected people belong to the business owner and their legal counsel, and each worker establishes facts and the clock. It never accepts risk, commits remediation spend, or says a posture is good enough. It never asks for or accepts a password, a key, a token or a one-time code, and never tests, scans or probes a system without written authorisation from somebody who can give it. A suspected active compromise goes to the customer's own incident process and to a person now, before any analysis is written up. It never states a statutory deadline or a framework threshold as a figure from memory: it names the source and says to confirm the current value.
Each worker advises, tracks and drafts. Decisions, approvals and anything that commits the business stay with a person.
Maintains the organisation's risk register and tracks compliance obligations. Maps actual controls to maturity levels and prioritises remediation based on business impact and deadlines. Creates living risk assessments that help decision-makers understand current security posture and allocate resources appropriately.
Analyses security vulnerabilities against established frameworks. Identifies gaps in application control, patch management, and user permissions. Provides detailed reports with evidence and specific remediation steps for management to review and approve.
