Certification & Audit

Compliance Services

Certification programs that finish on time, at cost and survive the audit.

Compliance run from both sides of the audit table.

Vectra runs compliance certification assessments across many regulatory standards including IRAP, PCI DSS, PCI PIN, PCI SSF, PCI P2PE, ISO 27001, ISO 42001, SOC 2, Swift CSP, SOCI and CPS 234. We sit on both sides of the table - practitioners during uplift, assessors at certification. That means the controls we put in place actually meet the standard the assessor checks.

We start with a gap assessment against the framework, agree a remediation sequence, then carry the program through control design, evidence collection and the final audit. Findings are tracked in a system your team and the assessor can both see - no surprises in the closing meeting.

Compliance Services

Risk management is business management.

Managing risk is part of every business decision and of your strategy. It builds your resilience. An integrated approach to risk is not about ticking a box. It lets you take up opportunities while you respond and adapt to change and disruption.

Governance, risk and compliance (GRC) brings these three jobs together in one program.

  • Governance

    Your activities, such as running IT operations, line up in a way that supports your business goals.

  • Risk

    Any risk or opportunity tied to your activities is found and dealt with in a way that supports those goals. In IT, this means a full IT risk process that feeds into your enterprise risk management.

  • Compliance

    Your activities meet the laws and regulations that apply to them. In IT, this means your systems, and the data in them, are used and secured properly.

Risk and compliance platforms: SAI Global and Vanta.

Through our partnership with SAI Global, we offer a proven, integrated suite of risk and compliance solutions. They help you manage and assess your operational and strategic risk and your compliance obligations.

If you want compliance automation instead, we also partner with Vanta. It keeps watch over your controls, gathers evidence and supports frameworks such as ISO 27001, SOC 2 and PCI DSS. We help you choose the platform that fits and set it up.

About SAI Global About Vanta
SAI360 diagram showing integrated content for vendor, compliance, digital, operational, EHS, ethics and business continuity risk, wrapped in advanced capabilities and services

What an integrated GRC approach delivers.

Bringing governance, risk and compliance into one approach is not easy. Done well and embedded, it gives you:

  • A transparent, detailed view of the risks and control environment affecting your organisation.

  • Streamlined processes and better engagement with the business.

  • Consistent communication and understanding of the risk and control environment.

  • The opportunity to transplant leading practices from one area to another.

  • Common controls shared across functions, reducing duplicated effort and investment.

  • Risk data aggregated easily from every part of the organisation.

  • The possibility of reducing the number of controls and risks.

  • More efficient audit plans, because audit teams can access the control and risk data.

  • Numerous options for improving business processes and performance.

Start with a GRC strategy.

To gain from integration, start by building a GRC strategy. It should make the financial and non-financial case, such as culture, for the investment needed to embed and sustain the program.

Internal audit, risk management and compliance must work closely together. They need to agree whether to use an existing framework, such as COSO or ISO, or adapt one to how mature your risk practice is. They also need to agree on the risk language, definitions, library of terms, governance model and the GRC platform that will support the strategy.

Questions the strategy should answer:

  • How should the risk functions - risk, compliance, vendor and third-party management, IT and audit - fit into one corporate framework?

  • How do we engage the business today, what information is it asking for, and how do we teach it about risks and controls?

  • How can we set up the GRC platform so it shows the risk and control picture in real time, for informed decisions?

  • How can we test a control once and use the result across every GRC function?

  • How do risks roll up, and how do they relate to each other?

  • What savings will we make by removing duplicate effort across the GRC functions?

  • What IT costs can we save by merging our GRC tools into one platform over time?

Certification that holds up under assessor review.

PCI DSS QSA

Australia's first PCI DSS QSA company. Full QSA delivery, from scoping and gap analysis through to ROC and AOC.

PCI PIN

Assessments against the PCI PIN Security Requirements for organisations that handle cardholder PINs.

PCI P2PE

Assessments of point-to-point encryption solutions and their components against the PCI P2PE standard.

PCI SSF

Assessments of payment software and how it is built against the PCI Software Security Framework.

ISO 27001 end to end

Implementation, internal audit and certification support, with the same team across the lifecycle.

ISO 42001

Alignment, readiness and certification for the new AI management system standard.

SOC 2

Readiness, control design and evidence for SOC 2, working alongside your auditor.

IRAP at PROTECTED

PROTECTED-certified IRAP assessors with cleared personnel, delivering against the IRAP Policy and ISM.

APRA CPS 234

Assessments of information security capability against CPS 234 for APRA-regulated entities.

Swift CSP

Independent assessments against the Swift Customer Security Controls Framework to support your yearly attestation.

SOCI Act

Support to meet your Security of Critical Infrastructure Act obligations, including risk management programs.

Essential Eight ML2 / ML3

Maturity uplift to ML2 and ML3, with evidence pipelines that hold up under ASD review.

Best Practice Security Assessment

A review of your people, processes and technology against good practice, with a ranked plan to close the gaps.

Related products & services.

Advisory

IRAP Assessment

ASD-endorsed IRAP assessments for IT systems, cloud services, gateways and systems that serve government, at SECRET and below.
Advisory

PCI DSS Consulting & Compliance

Australia's first certified QSA Company. Twenty years of PCI DSS assessments, pen tests and v4.0 script monitoring for merchants, service providers and banks.
Advisory

ISO 27001 Compliance & Audits

Implement, certify and maintain ISO 27001, from initial scope through the full three-year cycle.
Advisory

ASD Essential Eight

Reach Maturity Level 3 across the ACSC's eight prioritised mitigation strategies.

Start with a conversation.

Speak to us about your cyber governance and compliance requirements.

Send us a message

What can we help with?

A sentence or two is plenty. We'll ask for detail when we reply.