Case studies
Outcomes that hold up under audit.
Selected engagements — client identities withheld under NDA. Sectors and metrics are real. Full references available on request under NDA.
Commonwealth supply chain · Government-contracted prime
RFFR compliance across 18 subcontractors — Commonwealth supply chain case study
Led Right Fit For Risk (RFFR) readiness for a Commonwealth-contracted prime and 18 subcontractors in its supply chain — from fragmented baselines to a common ACSC ISM and Essential Eight ML2 posture across the network.
Regulated services · Mid-market
Six ISO 27001 audits. Zero non-conformities.
Designed and led an ISO 27001 Information Security Management System through six consecutive surveillance and recertification audits — every cycle closed with zero non-conformities.
Not-for-profit · Commonwealth-adjacent
IRAP-ready not-for-profit, on a not-for-profit budget
Led a not-for-profit through an IRAP assessment against the ACSC ISM — from ad-hoc controls to a defensible System Security Plan and a clean assessor engagement.
Considering a similar engagement?
A 30-minute confidential call — no pitch. I'll tell you honestly whether an approach like this will work for you.