Maturity CheckTalk to an Expert

Government & Public Sector

Essential Eight, VPDSS, and PSPF-aligned security for Victorian state, local, and Australian federal government entities. From maturity assessments to uplift programs, we deliver sovereign aware security at the right scale.

VPDSS attestation preparation and Essential Eight uplift for Victorian state agencies, local councils, and contracted service providers across Melbourne and regional Victoria – plus Commonwealth work aligned to PSPF and the ACSC ISM.

Aligned
PSPF · VPDSS
ML2+
Essential 8
Sovereign-aware
Identity
FRAMEWORKS & STANDARDS
PSPFVPDSSEssential EightISMISO 27001
SERVICES FOR THIS SECTOR
Advisory & ConsultingCybersecurity ServicesCloud & Modern WorkplaceManaged Security Services (MSSP)
WHAT YOU WILL GET
  • Essential Eight maturity assessment and ML2+ uplift programs
  • VPDSS attestation preparation and evidence packages
  • PSPF-aligned control implementation
  • IRAP and sovereign-hosting decisions
  • Protected classification handling and controls
  • Sovereign identity and Conditional Access architecture
  • Tender security response preparation
  • Government-grade incident response and reporting
SECTOR CHALLENGES WE ADDRESS
Essential Eight progression pressure
Commonwealth entities are expected to reach and maintain higher Essential Eight maturity levels; Victorian state entities face parallel expectations under VPDSS. Progression isn't a one-off project – it's a sustained program of control implementation and evidence maintenance.
Sovereign data residency and classification
Where data lives, who can access it, and under what jurisdiction matters – especially for PROTECTED and higher classifications. Cloud choices need to be defensible against both technical requirements and political scrutiny.
Tender and procurement gate
Cybersecurity posture is increasingly a tender evaluation criterion, not a compliance afterthought. Poor responses lose contracts; overpromising responses create obligations you can't meet.
Audit and attestation cycles
VPDSS attestation, internal audit, OAIC investigations, sector-specific audits – the reporting cycle is dense. Evidence needs to be captured continuously, not reconstructed at audit time.
Scale differences between agencies
A large department and a small local council have the same regulatory obligations but nothing like the same capacity. Uplift programs need to fit the entity's actual scale, not a template.
HOW WE DELIVER
Essential Eight Uplift
Maturity assessment against Essential Eight, prioritised uplift roadmap, and Maturity Level 1→2 or ML2→3 progression – with the evidence packages internal audit and external attestors actually want to see.
VPDSS Attestation Preparation
For Victorian public sector entities and contracted service providers – control mapping to the Victorian Protective Data Security Standards, gap remediation, evidence collection, and attestation package assembly.
PSPF Control Alignment
Protective Security Policy Framework alignment for Commonwealth entities – information security, personnel security, and physical security controls, with practical implementation guidance.
Sovereign Hosting Decisions
Guidance on IRAP-assessed sovereign cloud (Azure IRAP, AWS AGS) versus commercial cloud versus on-premises – informed by classification level, data residency requirements, and total cost of ownership.
Protected Classification Handling
Design and implementation of controls for information classified up to PROTECTED – network zoning, cryptographic requirements, media handling, and clearance-based access.
Sovereign Identity Architecture
Entra ID Government / sovereign identity design, Conditional Access aligned to classification and role, and Privileged Identity Management for public sector environments.
Tender Security Response
Cybersecurity sections of tender responses – control statements, evidence attachments, and posture narratives that meet common evaluation criteria without overpromising.
Government Incident Response
Documented incident response aligned to reporting obligations (ACSC, OAIC, sector regulators) – including drill exercises with executive and board involvement.
FREQUENTLY ASKED QUESTIONS

What government organisations ask about cybersecurity and IT.

What's the difference between VPDSS and PSPF?

PSPF (Protective Security Policy Framework) is the Commonwealth government's protective security policy. VPDSS (Victorian Protective Data Security Standards) is the Victorian state equivalent – 12 high-level standards under the Privacy and Data Protection Act 2014, administered by OVIC. Control sets overlap heavily. A single well-designed ISMS can address both if you're a Victorian entity with Commonwealth contracts, but the attestation and reporting cycles are separate.

Do we need to use IRAP-assessed cloud providers?

Depends on the classification of the data. For OFFICIAL:Sensitive and PROTECTED workloads, Commonwealth entities generally need IRAP-assessed hosting at the appropriate protection level. VPDSS-aligned Victorian entities have similar expectations for classified information. For OFFICIAL data without a sensitivity marker, commercial cloud is typically acceptable with the right controls.

How does Essential Eight maturity progression actually work?

Assessed against the eight strategies at Maturity Level 0/1/2/3. Progression requires demonstrable, sustained implementation – not just tool deployment. Independent assessment (usually IRAP or a qualified consultant) validates the level. Realistic pace: ML1→ML2 is 6–12 months of focused work for most entities; ML2→ML3 is another 12–18 months and involves architectural change, not just configuration.

How do you approach tender security responses?

We start from what you actually do, not what looks impressive. Overpromising on tender responses creates obligations that become compliance failures. We build a reusable posture narrative – Essential Eight maturity, ISO 27001 status, IRAP-assessed hosting, incident response – that can be tailored to specific tenders quickly without stretching the truth. Evaluators recognise both patterns and are increasingly skeptical of over-polished responses.

Ready to talk about government?

Free initial consultation with a certified expert. Melbourne-based, Australia-wide.