# Phoebus Group > Cyber security and compliance consulting, Sydney ## Posts - [SOCI Act & CIRMP: A Compliance Guide for Responsible Entities](https://phoebusgroup.dignismedia.in/soci-act-compliance-guide/): A practical guide for Australian responsible entities on the Security of Critical Infrastructure (SOCI) Act 2018 and Critical Infrastructure Risk Management Program (CIRMP) obligations, scope, hazards, reporting timelines and how to align with ACSC ISM and Essential Eight. - [The Essential Eight Is Getting a Reboot](https://phoebusgroup.dignismedia.in/the-essential-eight-is-getting-a-reboot/): Eight years is a long time in cybersecurity. ASD has confirmed the Essential Eight is being replaced, gradually, by a new principles-based Essentials series. Here's what's changing, what it means for IRAP and transformation roadmaps, and what to pre-empt now. - [ISM Journey: From the 2019 Release to AI-Native Assurance](https://phoebusgroup.dignismedia.in/ism-journey-2019-2027/): A field-level view of how the ACSC ISM evolved from its 2019 foundation through the pandemic, Essential Eight uplift, Zero Trust and AI adoption, and what the next 12 months look like. - [ACSC ISM Roadmap (2025 → 2026)](https://phoebusgroup.dignismedia.in/acsc-ism-roadmap-2025-2026/): A high-level, minimal-wording, easy-to-present summary of the ACSC ISM's quarterly updates from March 2025 to a predicted March 2026, from the ISM restructure through third-party and crypto tightening, identity uplift, AI controls and CBOM, to Zero-Trust, hybrid-cloud, SBOM expansion and OT security. - [ACSC ISM Roadmap & Alignment with NIST 800-53 Rev 2](https://phoebusgroup.dignismedia.in/acsc-ism-roadmap-alignment-with-nist-800-53-rev-2/): How the ACSC ISM's 2025 quarterly updates (March, June and September) align with NIST SP 800-53 Rev 2 and the Risk Management Framework, while extending beyond it into AI, post-quantum cryptography and a Zero Trust model that reaches past the Essential Eight. - [How the ACSC ISM Roadmap Is Following NIST 800-52 Rev 2](https://phoebusgroup.dignismedia.in/how-acsc-ism-roadmap-is-following-nist-800-52-rev-2/): A point-by-point mapping of the March, June and September 2025 ACSC ISM updates to NIST 800-53 Rev 2 control families and Risk Management Framework steps, with a note on where the ISM is moving faster than NIST on AI, post-quantum cryptography and OT security. - [Meaningful and Cost-Effective: The Not-for-Profit Way of Tech and Security](https://phoebusgroup.dignismedia.in/meaningful-and-cost-effective-not-for-profit-way-of-tech-security/): A structured, budget-conscious approach for not-for-profits to build secure and scalable software systems aligned with ASD Essential 8, ISO 27001 and IRAP, covering governance, identity, application and data security, cloud, endpoints, monitoring, patching and compliance, plus the lessons the NFP model offers larger enterprises. ## Pages - [Digital transformation and automation](https://phoebusgroup.dignismedia.in/services/digital-transformation/): Business process automation on Microsoft Power Platform, with security designed in. - [Internal audit and integrated management systems](https://phoebusgroup.dignismedia.in/services/internal-audit/): Independent internal audits and one management system across ISO 27001, 9001, 14001 and 45001. - [Managed RFFR](https://phoebusgroup.dignismedia.in/services/managed-rffr/): Right Fit For Risk compliance as a service: the ISMS, evidence, internal audits and the accreditation cycle, run for you. - [Essential Eight and ASD Essentials](https://phoebusgroup.dignismedia.in/services/essential-eight/): Essential Eight maturity assessment and uplift, and migration to ASD's new Essentials series on a single evidence base. - [IRAP assessment readiness](https://phoebusgroup.dignismedia.in/services/irap-readiness/): Walk into your IRAP assessment with controls mapped, gaps closed and evidence ready. - [Australian Government compliance](https://phoebusgroup.dignismedia.in/services/government-compliance/): The overview: IRAP readiness, Essential Eight and ASD Essentials, PSPF and ISM alignment, and Managed RFFR. - [ISO/IEC 27001 certification](https://phoebusgroup.dignismedia.in/services/iso-27001/): From gap assessment to certificate, with an ISMS that fits your business. - [Virtual and fractional CTO](https://phoebusgroup.dignismedia.in/services/virtual-cto/): Technology direction without an executive hire: architecture, cloud, roadmap and suppliers. - [Virtual and fractional CISO](https://phoebusgroup.dignismedia.in/services/virtual-ciso/): A senior security leader on retainer, scaled to the size of your business. - [Terms of use](https://phoebusgroup.dignismedia.in/terms/): The terms on which Phoebus Group Pty Ltd makes this website available. - [Privacy policy](https://phoebusgroup.dignismedia.in/privacy/): How Phoebus Group Pty Ltd handles personal information, in line with the Privacy Act 1988 (Cth) and the Australian Privacy Principles. - [Contact](https://phoebusgroup.dignismedia.in/contact/): Tell us what you need to be ready for. Request a scoping call and you will hear back from Sagar within one business day. - [FAQ](https://phoebusgroup.dignismedia.in/faq/): Straight answers about certification timelines, virtual CISO engagements, IRAP readiness, ASD Essentials and how we work. - [Insights](https://phoebusgroup.dignismedia.in/insights/): Articles by Sagar Kamra on Australian cyber security, compliance and the frameworks that shape them. - [Case studies](https://phoebusgroup.dignismedia.in/case-studies/): Three engagements led by Sagar Kamra before Phoebus Group was incorporated, and what they show about how we work. - [Who we help](https://phoebusgroup.dignismedia.in/who-we-help/): Organisations that have to prove their security to a government agency, a regulator, a prime contractor or an enterprise customer. - [Service areas](https://phoebusgroup.dignismedia.in/service-areas/): Sydney-based, working with clients across Australia and Asia Pacific, including Papua New Guinea. On-site where it matters, remote where it is efficient. - [Services](https://phoebusgroup.dignismedia.in/services/): Senior security leadership, certification and government compliance, delivered as a project, a retainer or a managed service. - [About](https://phoebusgroup.dignismedia.in/about/): A Sydney cyber security and compliance consultancy, founded by a practising CISO who has sat on both sides of the audit table. - [Home](https://phoebusgroup.dignismedia.in/home/): Phoebus Group helps government suppliers and regulated businesses meet ISO/IEC 27001, IRAP, Essential Eight and PSPF obligations, led by a practising CISO with more than 19 years in security, cloud and enterprise technology. [comment]: # (Generated by Hostinger Tools Plugin)