Get the controls working before the assessment starts.

How it is shaped

A defined program with milestones toward the certification or audit date.

Questions, answered

Which frameworks does your compliance work cover?

The frameworks Australian businesses are asked for. Essential Eight uplift: a current maturity rating across all eight strategies, an uplift plan to your target maturity level, and an evidence trail for each mitigation. SMB1001 certification readiness: a gap review against your target tier, step-by-step remediation, and an evidence pack ready for the certifying assessor. ISO 27001 readiness: scoping your Information Security Management System, a gap analysis against Annex A controls, and the core policies an auditor expects. Privacy Act uplift: a data map of what you hold and where, a gap review against the Australian Privacy Principles, and practical changes for the 2026 reforms. If a tender or client contract names something else, ask. Much of the control work overlaps, and we will say plainly if it sits outside our practice.

Does readiness work end in certification?

Readiness takes you to the audit. Where the framework certifies, the certificate itself comes from the certifying assessor, the way our own SMB1001:2026 Gold was issued by CyberCert. Where the framework is a maturity model, the work ends in a rated position and an uplift plan. Our part is the same in every case: map the environment to the framework, close the gaps, and build the evidence trail the assessment expects. Certification is won on evidence, and the evidence is what we build.

Who performs the work?

Engineers who build and run production software in regulated industries. Black Shard operates its own systems in production every day, and we hold SMB1001:2026 Gold ourselves, verifiable on the public CyberCert registry. That matters here because the person mapping your environment to a framework has run the same controls in production: least-privilege access, patching, multi-factor authentication, audit trails. You get controls that hold up in operation. We do not write paper policies to satisfy a checklist.

How is our data handled during an engagement?

On the same practices we apply to our own estate. Access is least-privilege: we ask for what the work requires and no more, and administrative privilege is only ever granted deliberately. Data is encrypted in transit and at rest. We keep the set of third parties that touch data deliberately small and choose Australian regions for the services that host client data. We comply with the Privacy Act 1988, including the Notifiable Data Breaches scheme. Anything a gap review surfaces lands in your report.

What do we receive, and who owns it?

A written deliverable specific to the framework, and all of it is yours: the reports, the policies, and the evidence pack belong to the business. Every gap comes back with the change that closes it, so your team can act on it directly, and the evidence pack is built to be handed straight to the assessor.

What happens after delivery?

The finish line is the audit. The engagement does not end with a report that arrives and sits. And a certificate is a snapshot the day it is issued. What holds it up between renewals is operating discipline: the patching, access reviews, and evidence habits the uplift put in place. Frameworks move as well; the 2026 Privacy Act reforms are the working example. Where a business wants a standing owner for that discipline, our security advisory and vCISO work covers it: a named security lead on a regular cadence.

Do you deliver outside Brisbane?

Yes. We are a national firm, head office in Brisbane, delivering Australia-wide. Most of the work runs against your environment and your documentation rather than your floor space, so location changes nothing about a gap review or an evidence pack.

How is the cost set?

Scope first, then the number. Compliance work runs as a defined program with milestones toward your certification or audit date, or as a fixed-scope engagement with a clear target, timeframe, and deliverable. What drives the scope: the framework and your target tier or maturity level, the number of environments and tenancies in scope, and how much of the evidence trail already exists. We do not publish rate cards or indicative ranges, because a number quoted before scoping is a guess. Send a brief through the contact page with the framework you are targeting and the date you need to be ready.

The rest of the firm.

• Software engineering

  We design, build and operate applications, internal systems and cloud infrastructure for Australian businesses.

  Read more

• Offensive testing

  We test applications, APIs, networks and cloud environments for vulnerabilities that can be reproduced and exploited.

  Read more

• Defensive & advisory

  Ongoing security leadership for organisations that need somebody to own cyber risk but do not require a full-time CISO.

  Read more

• Breach remediation

  If you have suffered or suspect a security incident, the first priority is establishing what happened and containing any continuing access.

  Read more

• Secure development

  Black Shard reviews source code and system architecture for vulnerabilities that automated tooling cannot reliably identify on its own.

  Read more

• AI cyber defence

  We test AI-backed applications and Microsoft Copilot rollouts, assess AI governance against ISO 42001 and the Voluntary AI Safety Standard, and defend against AI-enabled attacks such as phishing and deepfake fraud.

  Read more