Cyber Compliance Services

When an insurer, client, tender, or Defence opportunity asks for Essential Eight, SMB1001, or DISP, the hard part is often working out what actually applies and what evidence is expected. Novaguard translates the requirement, assesses the current position, and helps implement the agreed controls.

This page explains all three in plain language, why compliance is worth taking seriously beyond ticking a box, and which one is the right starting point for your business.

Why evidence matters as much as the checkbox

Cyber-insurance questions need accurate, supportable answers

Cyber-insurance applications commonly ask about specific controls such as MFA, patching, backups, endpoint protection, and privileged access. A formal assessment gives you a clearer basis for answering those questions and produces evidence of what was in place at the time. It does not guarantee insurance acceptance or the outcome of a future claim.

Compliance wins, and losing it loses, tenders and contracts

More government, Defence, and enterprise procurement processes now ask suppliers to demonstrate a specific security standard before they'll even be considered, let alone win the work. Businesses that can point to a real, current certification move through these processes faster.

The three frameworks Novaguard works with, in plain language

These aren't three unrelated things, DISP's cyber requirement is built directly on Essential Eight, not a separate standard next to it, but they do solve different problems, and most businesses only need one or two of them, not all three.

Essential Eight, the Australian government's technical baseline

The Essential Eight is the Australian Signals Directorate's set of eight technical mitigation strategies, things like application control, patching, restricting admin privileges, and multi-factor authentication, ranked across maturity levels. It's less a "certification" you buy and more a technical standard you can be assessed against and asked to prove.

See how we scoped an Essential Eight Level 2 environment within one Microsoft tenant for a consulting firm with Defence-related requirements. The client successfully submitted the supporting evidence to the Department of Defence.

See the full Essential Eight compliance offer →

SMB1001 (CyberCert), the certification standard built for small business

SMB1001 is a tiered cybersecurity certification standard purpose-built for small and medium businesses, Bronze through Gold and beyond, designed to be achievable without the cost and complexity of an enterprise-grade framework like ISO 27001.

Our five-person Queensland startup case study shows the controls, policies, and evidence work behind an SMB1001 Gold certification.

See the full SMB1001 certification offer →

DISP, accreditation for working with Defence

The Defence Industry Security Program (DISP) is the accreditation businesses need to work with or supply the Australian Department of Defence. On the cyber side, DISP's cyber security requirement is the Essential Eight, at a minimum of Maturity Level 2 across every membership level, Entry through Level 3.

See the full DISP accreditation offer →

What you actually get from Novaguard: the evidence, not just the badge

A lot of compliance work in the market amounts to a checklist and a certificate. Ours doesn't stop there. When we help a client achieve any of the three certifications above, they get a full evidence export: every control that's in place, exactly how it's being met, and evidence checked against their actual environment, not a generic template.

That export is directly useful in three places at once: handed to a cyber insurer as proof the controls you're claiming are real, handed to a tender or procurement team as evidence rather than a claim, and kept on file for your own records if a regulator or an insurer ever asks after an incident.

Which one do you need?

Insurer or a specific client is asking for a named security standard, and you want a public, third-party-verified badge → start with SMB1001 certification.
You want to align with Australia's official government technical standard → start with Essential Eight compliance.
You do, or want to do, work with the Department of Defence → start with DISP accreditation, note this includes Essential Eight Maturity Level 2 by default.

Many businesses end up needing more than one, a DISP engagement typically is an Essential Eight engagement plus the governance, personnel, and physical requirements on top. If you're not sure, book a call and we'll tell you honestly where to start, not sell you all three at once.

Already have a managed IT or cyber security provider? Compliance comes with it.

You don't have to treat compliance as a one-off project. Novaguard's managed IT services and managed cyber security plans can include the ongoing control maintenance and evidence work behind an agreed SMB1001 or Essential Eight target. Certification and maturity outcomes remain subject to scope, assessment, and completion of the required actions; the value of the managed model is that the work continues after the initial assessment.

Frequently asked questions

What's the difference between Essential Eight, SMB1001, and DISP?

Essential Eight is a technical standard from the Australian government, a set of controls, not a certificate you're handed. SMB1001 is a small-business-specific certification with a public badge, built to be achievable without enterprise-level cost or complexity. DISP is Defence's own accreditation, required specifically for businesses that work with or supply the Department of Defence, and its cyber security requirement is Essential Eight itself, at a Maturity Level 2 minimum regardless of membership level, with governance, personnel, and physical security requirements added on top.

Do I need all three?

Almost never all three at once. Which ones apply depends on who's asking, an insurer, a tender, a specific client, or Defence, not on doing "more compliance" for its own sake. Talk to us and we'll tell you honestly which applies to your situation.

Does compliance actually help with cyber insurance?

Insurers can ask detailed questions about controls such as MFA, patching, backups, endpoint protection, and privileged access. A scoped assessment and supporting evidence help you answer accurately; certification or a badge does not determine coverage or guarantee that a claim will be accepted.

How long does compliance take?

It depends which framework and your current starting point, covered in detail on each offer page. As a general shape: an assessment comes first to establish where you actually stand, then a scoped project closes whatever gaps it finds.

Do I have to switch my whole IT setup to get certified?

No. Assessment, implementation, and evidence work can be delivered as a standalone engagement alongside your existing IT provider. Novaguard managed clients can instead include an agreed SMB1001 or Essential Eight target in their ongoing service, subject to scope and formal assessment.

Not sure where to start?

Book a free call and we'll walk through what's actually being asked of you, by an insurer, a client, or a tender, and tell you honestly which framework applies, rather than selling you all three.

Book a free call