Know your risk. Be ready to recover.
Boards are asking harder questions about cyber risk, and regulators expect clear answers. We help you understand where you are exposed, fix what matters most and prove you can recover when something goes wrong.
We have decades of experience protecting highly sensitive information, including health and identity data, and we bring the same discipline to disaster recovery and business continuity.
Sound familiar?
- No clear answer when the board asks how exposed you are
- Essential Eight maturity that is assumed rather than tested
- A disaster recovery plan that has never been tested end to end
- Suppliers with access to your systems and data, but no security oversight
- New AI tools being used before anyone has assessed the privacy risk
What we do
Cyber risk assessment
Where you are exposed and what to fix first.
Essential Eight maturity
Assessment and uplift against the ACSC framework.
Disaster recovery planning and DR testing
Plans, runbooks and managed tests that prove recovery works.
Business continuity
Continuity planning for the services that matter most.
Supplier security
Third-party risk reviews and contract security requirements.
Privacy and AI risk
Privacy impact assessments and security guardrails for AI tools.
Board reporting
Plain-language cyber risk reporting for directors.
Partners for this work
How an engagement runs
Baseline
Assess controls, recovery capability and supplier risk.
Prioritise
A remediation plan ranked by risk and effort.
Test
Exercise DR and incident response for real.
Report
Regular, clear reporting to the executive and board.
What you get
- A clear, defensible view of cyber risk for the board
- Recovery tested and proven, not assumed
- Measured progress against Essential Eight
- Suppliers held to your security standards
Questions clients ask
Do you provide a managed security service?
No. We're an advisory and delivery partner, not a managed service provider. We help you choose, contract and oversee security providers, and we assess and test your controls.
How often should we test disaster recovery?
At least once a year for critical systems, and after any major change. We can plan and manage the test so it causes as little disruption as possible.
Are you an ACSC partner?
Yes. TMC Group is an Australian Cyber Security Centre (ACSC) Partner, giving us access to cybersecurity guidance, threat intelligence and resources that help inform our advice and strengthen our clients' security posture.