CIS & ISO compliance support.

Why recognised security frameworks matter

Frameworks such as ISO 27001, the CIS Controls and ASD Essentials help businesses move away from ad hoc security decisions and toward a structured, repeatable and auditable model. They give you a clearer basis for governance, internal accountability and prioritised security improvement.

For some businesses, this is about demonstrating maturity to clients, partners and tender panels. For others, it’s about creating a more disciplined approach to security that’s easier to maintain over time. Either way, the work is far easier when it’s planned once and mapped to every framework that matters to you.

How ISO 27001, CIS and ASD Essentials fit together

The three frameworks answer different questions. ISO 27001 asks whether you manage security systematically. The CIS Controls ask whether specific technical safeguards are in place. ASD Essentials asks whether the outcomes that matter most against today’s threats are actually effective in Australia’s context.

In practice they complement each other: ISO 27001 provides the management system, CIS supplies detailed technical safeguards, and ASD Essentials sets the priorities for Australian organisations.

ISO 27001 in depth

ISO/IEC 27001 is the international standard for an information security management system (ISMS). It doesn’t tell you which firewall to buy. It requires you to understand your risks, choose controls to treat them, and prove the system keeps working and improving. The current edition is ISO/IEC 27001:2022; the transition period from the 2013 edition ended on 31 October 2025, so all certificates now need to be on the 2022 version.

The management system: Clauses 4–10

4 · Context

Understand your organisation, interested parties and obligations, and define the scope of the ISMS.

5 · Leadership

Top management commitment, an information security policy, and clear roles and responsibilities.

6 · Planning

Risk assessment and treatment, security objectives, and the Statement of Applicability.

7 · Support

Resources, competence, awareness, communication and documented information.

8 · Operation

Run the risk treatment plan and operate the controls you’ve chosen.

9 · Evaluation

Monitoring and measurement, internal audit and management review.

10 · Improvement

Handle nonconformities, take corrective action and continually improve.

Annex A: 93 controls in four themes

The 2022 edition reorganised Annex A from 114 controls in 14 domains into 93 controls across four themes, adding new controls for areas such as threat intelligence, cloud services, configuration management, data masking and secure coding.

Organisational · 37

Policies, roles, asset management, access control, supplier relationships, incident management, business continuity and compliance.

People · 8

Screening, employment terms, awareness and training, disciplinary process, remote working and event reporting.

Physical · 14

Secure areas, entry controls, equipment protection, clear desk and screen, and secure disposal.

Technological · 34

Endpoint devices, privileged access, authentication, malware protection, vulnerability and configuration management, backup, logging, monitoring and secure development.

Every organisation produces a Statement of Applicability: a record of which Annex A controls apply, whether they’re implemented, and why any are excluded. It’s the document auditors rely on most, and it should reflect what’s actually running in your environment.

The certification path

Readiness

Define scope, run the risk assessment, build the Statement of Applicability, implement controls and gather evidence.

Internal audit

Audit your own ISMS and hold a management review before the external audit. Both are mandatory.

Stage 1 audit

The certification body reviews your documentation, scope and readiness.

Stage 2 audit

The auditor tests whether controls are actually operating, sampling evidence across the scope.

Surveillance

Annual audits in years two and three to confirm the ISMS is maintained and improving.

Recertification

A full audit every three years to renew the certificate.

Choose an accredited certifier. In Australia, look for a certification body accredited by JAS-ANZ. Certificates from unaccredited providers may not be accepted by tender panels or enterprise customers.

CIS Controls in depth

The CIS Critical Security Controls, published by the Center for Internet Security, are a prioritised set of technical safeguards drawn from real-world attack data. The current version, v8.1, contains 18 Controls broken into 153 specific Safeguards, with mappings to frameworks including ISO 27001 and NIST CSF 2.0.

Implementation Groups: right-sized for your business

IG1 · 56 Safeguards

Essential cyber hygiene. The minimum every organisation should have in place, designed for small and medium businesses with limited IT security expertise.

IG2 · 130 Safeguards

IG1 plus 74 more. For organisations with dedicated IT staff, multiple departments or sensitive client data.

IG3 · 153 Safeguards

The full set. For organisations handling highly sensitive data or facing sophisticated, targeted attackers.

The 18 CIS Controls

• 1. Inventory of enterprise assets
• 2. Inventory of software assets
• 3. Data protection
• 4. Secure configuration
• 5. Account management
• 6. Access control management
• 7. Continuous vulnerability management
• 8. Audit log management
• 9. Email and web browser protections
• 10. Malware defences
• 11. Data recovery
• 12. Network infrastructure management
• 13. Network monitoring and defence
• 14. Security awareness and skills training
• 15. Service provider management
• 16. Application software security
• 17. Incident response management
• 18. Penetration testing

CIS Benchmarks sit alongside the Controls. They’re detailed hardening guides for specific platforms such as Windows, macOS, iOS and Microsoft 365, and they’re the practical way to meet Control 4 (secure configuration). We deploy benchmark-aligned baselines through Intune and Jamf.

One program, three frameworks

Most of the technical work counts towards all three frameworks at once. We design each capability once and record the evidence against every framework you need, so you’re not running parallel projects.

Mappings are indicative. Each framework words its requirements differently, so we confirm coverage against the exact text during a gap review.

Practical implementation, not just policy documents

One of the biggest challenges with compliance work is that it can become too theoretical. Policies get written, but the underlying platforms, user behaviours and device controls don’t actually match them — and auditors notice.

We bridge that gap by linking standards-based requirements to practical implementation: identity controls, endpoint management, configuration hardening, access governance, documentation uplift and control validation. Framework alignment usually means making better use of what you already own, such as Microsoft 365, Microsoft Intune, Jamf and your endpoint protection tools.

The objective isn’t to claim compliance through software alone, but to use the right technology to support the right controls, and to produce evidence as a by-product of normal operations.

How EduCom IT helps

Gap review

Review against the frameworks that matter to you: CIS IG1/IG2, ISO 27001 clauses and Annex A, and ASD Essentials.

ISMS build

Scope, risk methodology and register, Statement of Applicability, and the core policies ISO 27001 requires.

Identity

Phishing-resistant MFA, admin role review, conditional access and identity hardening.

Devices

Endpoint management, CIS Benchmark-aligned baselines and patching evidence across Windows, macOS and mobile.

Policy

Policies written for your environment and aligned to the controls actually in place, not generic templates.

Evidence

Dashboards, reports and records that show controls operating over time, ready for auditors, insurers and tenders.

Audit readiness

Internal audit support, management review preparation and guidance through Stage 1 and Stage 2.

Remediate

Practical, prioritised remediation rather than a flat list of every gap.

A practical path toward stronger security maturity

Not every organisation needs full certification, but many benefit from aligning to stronger frameworks. A common path is to secure the technical baseline first, then build the management system around it.

Step 1 · Baseline

Phase 1 of ASD Essentials and CIS IG1: identity, MFA, internet-facing services, patching and backups.

Step 2 · Strengthen

Extend to CIS IG2 and later ASD Essentials phases: privileged access, logging, detection and secure configuration.

Step 3 · Manage

Wrap the controls in an ISMS: risk register, Statement of Applicability, internal audit and management review.

Step 4 · Certify

If tenders or customers require it, proceed to ISO 27001 certification with an accredited body.

• Builds on ASD Essentials foundations.
• Informed by an upfront security review.
• Reinforced by backup & recovery maturity.

Frequently asked questions