An endorsed IRAP assessor, engaged directly
Registered with the Australian Signals Directorate to independently assess the systems Australia depends on — and available to yours, without an account team in between.
ASD-endorsed IRAP · ISM · Essential Eight · PSPF
Cyber security for
Australian Defence,
Government & beyond
Threats don't announce themselves. We assess and secure mission-critical systems to the highest assurance standards set by the Australian Signals Directorate — and bring that same defence-grade rigour to enterprise, industry and communities across Australia.
Why Secure Blue
Forged in Defence's hardest environments
Fifteen-plus years of military cyber security engineering — from cutting-edge aviation systems to classified networks, capability authorisations and national cyber policy.
Cleared and proven where it matters most
Security cleared and trusted in highly classified and sensitive environments, assuring the most critical Australian capabilities.
Capabilities
Eight disciplines.
One accountable expert.
Click any capability for the full picture.
IRAP Security Assessments
Independent ISM assessments by an ASD-endorsed assessor — OFFICIAL through to classified.
Details →IRAP Security Assessments
Engage an ASD-endorsed IRAP assessor directly. From the scoping call to the final security assessment report, your engagement is delivered end-to-end by the assessor you first spoke to — for systems at OFFICIAL through to classified environments.
Because the same person scopes, assesses and writes, nothing is lost in handover — and your report says what an authorising officer actually needs to hear.
- New system authorisations
- Reassessments & annual reviews
- Cloud service assessments
- Gap analysis before formal assessment
- Remediation roadmaps that survive contact with ASD
Governance, Risk & Compliance
Strategy, policy and governance built around the ISM, PSPF and Essential Eight.
Details →Governance, Risk & Compliance
Security strategy, policy and governance frameworks built around the ISM, PSPF and Essential Eight — shaped to your organisation rather than lifted from a template.
Includes ongoing advisory that keeps you aligned as the frameworks evolve, without hiring a full-time security executive. Governance that boards understand and practitioners can actually follow.
Talk governanceThreat & Risk Assessment
TRAs and risk plans that tie cyber risk to mission risk.
Details →Threat & Risk Assessment
Threat and risk assessments and Security Risk Management Plans that tie cyber risk to mission risk — so investment decisions get made on evidence, and residual risk is owned deliberately rather than discovered later.
Grounded in the threat environment your system actually faces, not a generic risk register.
Scope a TRASecurity Testing & Assurance
Essential Eight maturity, control validation and technical assurance.
Details →Security Testing & Assurance
Essential Eight maturity evaluations, control validation and technical assurance that verify your safeguards work as documented — not just as intended.
Findings arrive with fixes, not just severity ratings, prioritised by what would actually stop an attacker in your environment.
Test your controlsCloud Security & Compliance
Secure-by-design AWS and Azure, assessed against the ISM's cloud controls.
Details →Cloud Security & Compliance
Secure-by-design AWS and Azure architectures, assessed and documented against the ISM's cloud controls and ACSC guidance — so your cloud uplift lands authorised, not stalled at assessment.
From landing-zone design reviews to full cloud service assessments for systems heading into government environments.
Secure your cloudSecurity Documentation & Architecture
SSPs, SRMPs and artefacts written to pass assessment the first time.
Details →Security Documentation & Architecture
System Security Plans, SRMPs, incident response plans and architecture artefacts written to pass assessment the first time — by someone who has sat on the other side of the table and assessed hundreds of them.
Documentation that reads as evidence, not paperwork: every claim traceable, every control mapped, nothing left for an assessor to guess at.
Get assessment-readyTraining & Education
Tailored programs for everyone — board briefings to hands-on workshops.
Details →Training & Education
Training tailored for your organisation — boards and executives, engineers and operators, government and private. Designed and delivered by a qualified military instructor who has taught at the Air Force Officers' Training School and presented at Australia's major security conferences.
In person in Canberra, or live online anywhere in Australia.
- Executive & board cyber-risk briefings
- ISM, PSPF & Essential Eight practitioner training
- Preparing your team for IRAP assessment
- Whole-of-organisation security awareness
Advisory & Uplift Partnership
A senior security partner on call — CISO continuity, scaled to fit.
Details →Advisory & Uplift Partnership
A senior security partner on call — periodic posture reviews, roadmap ownership and board-ready reporting. The continuity of an in-house CISO, scaled to what your organisation actually needs.
Ideal after an assessment: the findings become a roadmap, and the roadmap gets owned rather than shelved.
Start a partnershipIRAP, demystified
What an IRAP assessor actually does.
The Infosec Registered Assessors Program is run by the Australian Signals Directorate. Endorsed assessors independently examine how well a system implements the Information Security Manual — then hand your decision-makers the evidence to authorise it with confidence.
-
01
Plan & scope
Agree the system boundary, classification and the ISM controls in play — before a single control is examined.
-
02
Assess
Evidence, interviews and technical verification: are the controls implemented, and are they actually effective?
-
03
Report
A security assessment report that states what stands up, what doesn't, and what to fix first — in plain language.
-
04
Authorise
Your authorising officer makes the call — backed by independent evidence instead of self-assessment.
“Endorsed IRAP assessors assist in securing your systems and data by independently assessing your cyber security posture, identifying security risks and suggesting mitigation measures.”
— Australian Signals Directorate
Not just for government
The same assessment discipline works anywhere assurance matters: Essential Eight maturity reviews, cloud security assessments, supplier and supply-chain assurance, and independent security reviews for private organisations.
Read ASD's IRAP consumer guide ↗Deliberately boutique
The expert you meet is the expert who does the work.
The big firms bring an account team. Secure Blue brings the principal — a senior Air Force cyber security engineering officer turned consultant, whose career runs from avionics software engineering on cutting-edge aviation systems, through building classified cyber capability, to leading the team that assessed and authorised hundreds of Defence networks.
That experience shaped national policy too: security controls and guidance developed through the Australian Cyber Security Centre for the ISM and Essential Eight, and strategic input into Australia's cyber security strategies for government and Defence.
Every engagement is scoped, delivered and stood behind by that same person. No juniors learning on your budget. No handoffs. Advice contextualised to your system, your threat environment and your mission.
Secure Blue on LinkedIn ↗- 15+years in Defence & national security
- 12+certifications held personally
- Direct access One accountable senior assessor, start to finish
- Security cleared Vetted for classified and sensitive environments
- Assessor's eye Advice from someone who has assessed hundreds of systems
- Canberra-based On-site across the ACT · online Australia-wide
Credentials
Certified across every discipline we practise.
Every credential below is held personally by the principal consultant — not spread across a bench of juniors.
ASD-endorsedIRAP Assessor
- CISSPISC2 — information security leadership
- SABSAChartered Information Security Architect
- GIAC ×5GCED · GCCC · GCIH · GSNA · GSDA
- ISO 27001& ISO 9001 management-system auditor
- CISAISACA — information systems auditor
- CISMISACA — security management
- CRISCISACA — risk & information systems control
- M.CyberSecMasters — digital forensics
- MBAMasters of Business Administration
- Clearedfor classified engagements
Education & Training
Training tailored for your organisation.
Everyone gets trained here — boards and executives, engineers and operators, government and private, from a two-hour briefing to a full program. Designed and delivered by a qualified military instructor who has taught at the Air Force Officers' Training School and presented at Australia's major security conferences.
No off-the-shelf slide decks: every session is built around your systems, your threat profile and your people — in person in Canberra, or live online anywhere in Australia.
- Executive & board cyber-risk briefings
- ISM, PSPF & Essential Eight practitioner training
- Preparing your team for IRAP assessment
- Secure-by-design workshops for engineering teams
- Whole-of-organisation security awareness
Software & Solutions
Security software, tailored to your environment.
Custom security software built for automation and improvement — taking the manual drudgery out of compliance, evidence collection, reporting and security operations, using leading technologies shaped to how you actually work.
Not another generic platform: tooling custom-made for your environment and your frameworks — Australian government standards or your own — designed by someone who has lived inside the workflows it automates.
Start a software conversationWho we work with
Built for Defence.
Available beyond it.
Defence & National Security
Our home ground — cyberworthiness, classified systems and capability assurance
Specialty
Federal Government
ISM, PSPF and authorisation support across the APS
Defence Industry
DISP-aligned uplift for primes and SMEs in the supply chain
State & Local Government
Pragmatic security uplift mapped to your obligations
Critical Infrastructure
Assurance for operators with SOCI obligations
Enterprise & SMB
Senior advice scaled to fit — without big-firm overhead
Communities & Education
Security awareness and practical help for schools, not-for-profits and local communities
Contact
Engage a cyber
specialist directly.
An assessment, an uplift program, tailored training, a piece of software — or just a conversation about where to start. You'll be talking to the person who does the work.
Send business enquiries to
- Secure Blue on LinkedIn
- Canberra, Australia — online engagements Australia-wide