Case studies
What the work looks like in practice
Client names are withheld under non-disclosure agreements. Each engagement was led by Sagar Kamra in a previous role; Phoebus Group brings the same method.
RFFR compliance across 18 subcontractors
Led Right Fit For Risk (RFFR) readiness for a Commonwealth-contracted prime and 18 subcontractors in its supply chain, from fragmented baselines to a common ACSC ISM and Essential Eight ML2 posture across the network.
Frameworks: RFFR, ACSC ISM, Essential Eight, ISO 27001
Read the full case study
Challenge
A Commonwealth department programme required Right Fit For Risk (RFFR) compliance not only from the head provider but across a supply chain of 18 subcontractors, each with different tooling, maturity and executive appetite. Without a shared approach the prime contractor's own certification and Commonwealth contract were at risk. This is the same pattern faced by Defence primes under DISP, Home Affairs suppliers, and any Commonwealth-contracted provider whose obligations flow down to a subcontractor network.
Approach
- Established a single RFFR playbook aligned to the ACSC ISM and Essential Eight, reusable across the subcontractor supply chain.
- Ran structured ACSC ISM baseline assessments with each subcontractor, prioritising remediation by risk and Commonwealth contract impact.
- Built a shared evidence library and control mapping so subcontractors could reuse Essential Eight ML2 controls without duplicating effort across the network.
- Coordinated executive reporting for the prime contractor and Commonwealth department stakeholders through the assessment cycle.
- Handed the prime contractor a repeatable subcontractor onboarding pack, new suppliers now reach the ISM baseline in weeks, not months.
Outcome
- 18 subcontractor RFFR assessments delivered under a single, defensible Commonwealth supply-chain programme.
- Prime contractor's own Commonwealth contract protected, zero findings escalated to the department for missing subcontractor coverage.
- Common ACSC ISM and Essential Eight ML2+ baseline established across a previously fragmented supplier network.
- Programme repeatable, subsequent subcontractor onboarding compressed from months to weeks.
- Applicable pattern: Commonwealth prime contractors, Defence supply-chain primes (DISP-adjacent), Home Affairs suppliers, state government panel providers, and any RFFR-obligated organisation with a subcontractor network.
He has a remarkable ability to break down complex compliance standards into practical, understandable steps. He worked seamlessly with both technical and non-technical stakeholders, ensuring everyone understood the rationale behind the controls and the value they brought to our security posture.
Project Manager · Employment services sector
Six ISO 27001 audits. Zero non-conformities.
Designed and led an ISO 27001 Information Security Management System through six consecutive surveillance and recertification audits, every cycle closed with zero non-conformities.
Frameworks: ISO/IEC 27001:2022, ISO 27002, Annex A, ISO 31000
Read the full case study
Challenge
Inherited an ISMS that had passed certification but was operating as shelfware, heavy documentation, thin evidence, fragile at audit time. The board needed the certification retained and defended year after year without escalating consulting spend.
Approach
- Rebuilt the ISMS around a lean, auditable evidence pipeline, controls generated evidence as a by-product of BAU.
- Right-sized documentation and the Statement of Applicability to what the business actually operated.
- Established an internal audit and management review cadence that surfaced findings before external auditors did.
- Coached an internal ISMS owner through each cycle to reduce dependency on external specialists.
Outcome
- Six consecutive audits (surveillance + recertification) closed with zero non-conformities.
- External audit effort steadily reduced as the ISMS matured and evidence became self-generating.
- ISMS trusted as a live operating tool, used by leadership, not just referenced at audit time.
- Internal owner capable of running future surveillance cycles independently.
Thanks to his meticulous attention to detail, proactive communication, and strategic insights, we achieved measurable outcomes with greater confidence in our long-term security capabilities. His expertise in Zero Trust Architecture, ISO 27001 and RFFR further cemented his value as a trusted partner.
Technology Lead · government-aligned organisation
IRAP-ready not-for-profit, on a not-for-profit budget
Led a not-for-profit through an IRAP assessment against the ACSC ISM, from ad-hoc controls to a defensible System Security Plan and a clean assessor engagement.
Frameworks: ACSC ISM, IRAP, Essential Eight, ISO 27001 alignment
Read the full case study
Challenge
A not-for-profit handling Commonwealth-adjacent data was asked to demonstrate an IRAP-aligned control baseline. Budget was tight, the internal team was small, and neither the ISM nor the assessor process was familiar territory.
Approach
- Scoped the system boundary tightly, assessed only what genuinely needed to be in scope, not the whole organisation.
- Ran an ISM control-by-control gap analysis and rated evidence to focus remediation on real gaps, not paperwork.
- Authored the System Security Plan, Security Risk Management Plan and Incident Response Plan against real operating processes.
- Shortlisted and briefed an accredited IRAP assessor, kept preparation and assessment independent for a clean engagement.
Outcome
- Successful IRAP assessment cycle with no critical findings requiring rework.
- Reusable evidence library that now underpins the organisation's ISO 27001 and Essential Eight programmes.
- Internal team confident to sustain the ISM control baseline without ongoing specialist reliance.
- Delivered inside a not-for-profit budget envelope, no big-four overhead.
I had the pleasure of working with him on an IRAP assessment and can recommend him without reservation. His depth of knowledge in Australian Government security frameworks and best practices was invaluable, he guided us through the assessment requirements and helped us implement meaningful security improvements.
ITS Project Manager · Government-contracted provider
Want results like these for your organisation?
Tell us which framework you are up against and we will show you how the same method applies.