- ISO/IEC 27001:2022
- IRAP
- Essential Eight
- ASD Essentials
- PSPF
- ISM
- Right Fit For Risk
- ISO 9001
- ISO 14001
- ISO 45001
- Privacy Act 1988
- ISO 27001 Lead AuditorExemplar Global certified
- ISO 27001 Lead ImplementerISO/IEC 27001:2022
- IMS Lead AuditorISO 9001, 14001, 45001 · Exemplar Global certified
- ISC2 CCCertified in Cybersecurity · Credly
Why Phoebus Group
Senior security leadership, delivered the way you need it.
One senior point of contact
You work directly with Sagar Kamra, an Exemplar Global certified ISO/IEC 27001:2022 Lead Auditor and Lead Implementer, from gap assessment to certificate.
Built for Australian requirements
ISM, PSPF, Essential Eight, ASD Essentials, IRAP and Right Fit For Risk are the frameworks we work in every week, not an add-on.
Systems that keep working
We build management systems your team can run, and offer managed services for those who would rather we ran them.
Services
What we do
Engage us for a defined project, a set number of days a month, or a managed service that keeps you compliant all year.
Virtual and fractional CISO
A senior security leader on retainer, scaled to the size of your business.
Learn more
ISO/IEC 27001 certification
From gap assessment to certificate, with an ISMS that fits your business.
Learn more
Australian Government compliance
The overview: IRAP readiness, Essential Eight and ASD Essentials, PSPF and ISM alignment, and Managed RFFR.
Learn more
IRAP assessment readiness
Walk into your IRAP assessment with controls mapped, gaps closed and evidence ready.
Learn more
Essential Eight and ASD Essentials
Essential Eight maturity assessment and uplift, and migration to ASD's new Essentials series on a single evidence base.
Learn more
Managed RFFR
Right Fit For Risk compliance as a service: the ISMS, evidence, internal audits and the accreditation cycle, run for you.
Learn moreWho we help
Built for organisations that have to prove their security, not just claim it.
Government suppliers
Evidence ISM, PSPF and Essential Eight controls, and get ready for an IRAP assessment.
Who we helpEmployment and community services
Meet Right Fit For Risk and keep it that way with a managed ISMS.
Who we help
Regulated and growing businesses
Win contracts with ISO/IEC 27001 certification, or bring in a senior security lead part-time.
Who we help
About
Led by Sagar Kamra, Principal Consultant and Director.
Around 10 years of CISO and ISMS leadership and more than 19 years across security, cloud and enterprise technology. Sagar has built and run information security management systems in regulated environments and sat on both sides of the audit table.
- ISO/IEC 27001:2022 Lead Auditor (Exemplar Global certified)
- ISO/IEC 27001:2022 Lead Implementer
- Integrated Management Systems Lead Auditor: ISO 9001, ISO 14001 and ISO 45001 (Exemplar Global certified)
- ISC2 Certified in Cybersecurity (CC)
- Eligible for Australian Government security clearance
- 19+ years across security, cloud and enterprise technology, including around 10 years of CISO and ISMS leadership
Service areas
Sydney-based, working across Australia and the Asia Pacific.
On-site in Sydney and Canberra, remote or on-site for clients in every state and territory, and remote delivery with site visits for organisations across the Pacific and South East Asia.
FAQ
Questions we hear first
How long does ISO/IEC 27001 certification take?
For a small to mid-sized organisation, typically four to nine months from gap assessment to certificate, depending on how much is already in place and how quickly decisions can be made.
What is a virtual CISO?
A senior security leader engaged part-time or on retainer. You get strategy, risk management, board reporting and audit ownership without a full-time executive salary.
Do you work outside Sydney?
Yes. Phoebus Group is Sydney-based and works with clients across Australia and the Asia Pacific, remotely and on-site, including regular work in Canberra for government suppliers and with clients in Papua New Guinea.
What is IRAP assessment readiness?
Preparation for an assessment by an IRAP assessor against the Australian Government Information Security Manual (ISM): mapping controls, closing gaps and assembling evidence so the assessment runs smoothly. We prepare; an independent assessor assesses.
Not sure where to start?
Send us your tender clause, audit finding or accreditation letter. We will tell you what it takes to meet it.