Where we work
Three ways to work with us, wherever you are
On-site in Sydney and Canberra
Workshops, internal audits and executive briefings at your office, as often as the engagement needs.
Remote across Australia
Weekly online workshops, shared evidence folders and clear actions between sessions, in every state and territory.
Site visits where they count
Travel for audits, site walk-throughs and leadership sessions anywhere in Australia and the Asia Pacific, quoted up front.
On-site and remote
Sydney, NSW
Phoebus Group is based in Sydney, so most of our on-site work happens here: gap-assessment workshops, internal audits, board briefings and the working sessions where an ISMS actually gets built. We travel to your office across Greater Sydney, Parramatta and Western Sydney, the North Shore, the Northern Beaches and the Sutherland Shire, and to the Central Coast, Newcastle and Wollongong.
We support suppliers to NSW Government agencies who need to show alignment with the NSW Cyber Security Policy and the Essential Eight, and businesses across Sydney that need ISO/IEC 27001 certification to answer client security questionnaires and win contracts.
- NSW Cyber Security Policy
- Essential Eight
- ISO/IEC 27001
- Privacy Act 1988
We support
- Suppliers to NSW Government agencies
- Financial services, legal and professional-services firms
- Health, aged care and community services providers
- Technology companies selling to government and enterprise
On-site and remote
Canberra, ACT
Canberra is where most Commonwealth security requirements land on suppliers: the Information Security Manual (ISM), the Protective Security Policy Framework (PSPF), the Essential Eight and IRAP assessments. We work on-site in the ACT, preparing contractors and service providers for assessments and helping them answer agency security clauses with evidence rather than promises.
Sagar has led security programmes inside regulated environments, so Canberra organisations get someone who understands what an agency security adviser and an IRAP assessor will actually ask for.
- ISM
- PSPF
- Essential Eight
- IRAP
- DISP
We support
- Commonwealth contractors and panel suppliers preparing for IRAP assessment
- Defence industry suppliers and DISP members
- Employment and community services providers under Right Fit For Risk
- SaaS and managed-service providers hosting government data
Remote first, on-site when it counts
Melbourne, VIC
We work with Melbourne organisations through structured remote delivery: weekly workshops, shared evidence folders and clear actions between sessions, with on-site days planned around the internal audit and key management reviews. Travel is quoted up front.
Victorian Government suppliers also need to show alignment with the Victorian Protective Data Security Standards (VPDSS). We map the VPDSS alongside ISO/IEC 27001 so one set of controls serves both.
- VPDSS
- Essential Eight
- ISO/IEC 27001
We support
- Suppliers to Victorian Government agencies
- Education, health and community-sector providers
- Technology and professional-services firms pursuing ISO/IEC 27001
- Manufacturers and logistics providers facing customer security requirements
Remote first, on-site when it counts
Brisbane, QLD
We support Brisbane and South East Queensland organisations remotely, with on-site visits for workshops, audits and executive sessions. Queensland Government suppliers need to align with the Queensland Government Information Security Policy (IS18) and the Essential Eight; community-services providers work under Right Fit For Risk.
Engagements usually begin with a remote gap assessment within a week of first contact, so there is no waiting on travel to get started.
- IS18 (Queensland Government Information Security Policy)
- Essential Eight
- RFFR
- SOCI Act
We support
- Queensland Government suppliers and IS18 alignment
- Employment, disability and community services providers (RFFR)
- Critical infrastructure and utilities suppliers
- Growing technology and services businesses seeking ISO/IEC 27001
Remote first, on-site when it counts
Perth, WA
We work with Perth organisations remotely, scheduling workshops in the overlap hours and grouping site visits around audits. Resources, engineering and defence-industry suppliers face security requirements from large customers; WA Government suppliers need to align with the WA Government Cyber Security Policy.
An ISO/IEC 27001 certificate is often the fastest way to satisfy several of those requirements at once, and we build the system so a small team can maintain it.
- WA Government Cyber Security Policy
- DISP
- Essential Eight
- ISO/IEC 27001
We support
- Resources and energy supply-chain companies with customer security requirements
- Defence industry suppliers and DISP members
- WA Government suppliers
- Engineering and professional-services firms
Remote first, on-site when it counts
Adelaide, SA
Adelaide's defence industry means security requirements arrive from primes and from Defence itself. We support South Australian suppliers to meet the Defence Industry Security Program (DISP), the Essential Eight and ISO/IEC 27001, and to prepare the evidence those programmes require.
Delivery is remote by default with on-site days for workshops and audits, quoted up front.
- DISP
- Essential Eight
- ISO/IEC 27001
- SA Government cyber security requirements
We support
- Defence industry suppliers and DISP applicants
- SA Government suppliers
- Space, advanced manufacturing and technology companies
- Health and community services providers
Remote first, on-site when it counts
Hobart, TAS
We work with Tasmanian organisations fully remotely, with site visits arranged where an in-person workshop or audit adds real value. The method is the same as for any other client: a gap assessment first, then a prioritised plan, then the build and internal audit before certification.
We support Tasmanian Government suppliers, health and community services providers, and businesses pursuing ISO/IEC 27001 to meet customer requirements.
- Tasmanian Government cyber security requirements
- Essential Eight
- ISO/IEC 27001
We support
- Tasmanian Government suppliers
- Health, aged care and community services providers
- Agribusiness, tourism and professional-services firms with customer security requirements
- Technology companies pursuing ISO/IEC 27001
Remote first, on-site when it counts
Darwin, NT
We support Darwin and Northern Territory organisations remotely, with workshops scheduled to suit and on-site days arranged for audits where needed. Defence, government and community-services requirements are common in the Territory, and we help organisations meet them without a full-time security team.
We work with NT Government suppliers, defence-industry contractors and community organisations handling sensitive personal information.
- NT Government cyber security requirements
- DISP
- Essential Eight
We support
- NT Government suppliers
- Defence industry contractors
- Community services and health providers
- Infrastructure and logistics operators
How we work with regional organisations
Regional Australia
Security and compliance requirements do not change with the postcode, and neither does our approach. We work with regional organisations fully remotely: everything from the gap assessment to the internal audit is delivered online, with evidence shared securely and workshops run on video.
Where an in-person day matters, for example a site walk-through or a leadership session, we travel and quote the cost up front.
- Essential Eight
- ISO/IEC 27001
- RFFR
- State government supplier requirements
We support
- Regional health, aged care and community services providers
- Agribusiness and food manufacturers with customer security requirements
- Suppliers to local and state government
- Regional professional-services and technology firms
Remote delivery, with on-site visits quoted up front
Asia Pacific
We work with organisations across the Pacific and South East Asia, and are already working with clients in Papua New Guinea. Organisations in the region increasingly need ISO/IEC 27001 certification, virtual CISO support or a security uplift to meet the requirements of Australian and international customers, partners and regulators.
Delivery is remote, run from Sydney in overlapping business hours, with on-site visits for workshops, audits and leadership sessions quoted up front. The method is the same one we use in Australia: gap assessment, prioritised plan, build, internal audit, then ongoing support so the system keeps working.
- ISO/IEC 27001
- Virtual CISO
- Essential Eight
- Australian and international customer requirements
We support
- Organisations in Papua New Guinea meeting Australian customer and partner requirements
- Banks, telecommunications and infrastructure operators across the Pacific
- Suppliers to Australian Government programmes in the region
- South East Asian businesses pursuing ISO/IEC 27001 for international customers
Working hours are Monday to Friday, 9am to 5pm Sydney time (AEST/AEDT). Travel for on-site days outside Sydney is agreed and quoted up front.
Based outside Sydney?
Tell us where you are and what you need to meet. Most engagements start remotely within a week.