One engine. Load a framework catalogue and it assesses — the same spine powers every vertical, in every jurisdiction we ship packs for. The numbers below are read from the engine's own catalogue at build time, never typed in — and where a vertical isn't genuinely covered yet, its page says so.
CPS 230 operational resilience and CPS 234 information security posture from live evidence — board and regulator packs, material-supplier registers, no false green. The engine is the evidence layer; it does not replace an APRA-appointed tripartite reviewer.
Consultant-grade depthISM/IRAP assessment at the depth an IRAP assessor documents — the full ISM catalogue with SAR generation, Essential Eight across ML1–ML3, evidence mapped control by control. Australia's real moat.
Depth badged per laneEvery framework live on the engine, one book of work: per-engagement scoping, evidence freshness measured — not asserted — and reports carrying an Evidence Freshness Statement. IRAP-grade on ISM/E8, Tier-A breadth elsewhere.
Tier-A breadthMulti-jurisdiction AI governance from one evidence base — EU AI Act, ISO/IEC 42001, NIST AI RMF, plus every national instrument live on the catalogue, enumerated on the solutions page rather than promised. The one axis where our reach is already genuinely global.
Served via security lensOAIC breach duties and buyer security clauses served through ISO 27001, SOC 2, Essential Eight and third-party risk. Honest position: no dedicated health-sector catalogue on the engine today — we say that plainly rather than badge it green.
Served via existing lanesSOCI risk-management-program obligations served through Essential Eight maturity, ISM depth and third-party risk registers. Honest position: no dedicated SOCI catalogue yet — where an obligation is not covered, the posture says so.
Not a bank, not an agency, not a hospital? The engine is framework-driven, not industry-templated. If your obligations map to the frameworks live on the catalogue, the same machinery serves you — and if they don't, we say so and it goes on the roadmap, not on your report.
Plus the international instruments:
The engine is framework-driven, not industry-templated — if your obligations map to the frameworks live on the catalogue, the same machinery serves you. And if they don't, we say so and it goes on the roadmap, not on your report.