Microsoft 365 and Azure, built for PROTECTED. Documented. Delivered. Audit ready.
ACT Cyber is the specialist consultancy that designs, deploys and documents Microsoft cloud environments to the Australian Government ISM PROTECTED standard — so when your independent IRAP assessor arrives, the work is already done.
An Australian specialist firm.
- 100%Australian owned and operated. AGSVA-cleared team.
- M365
AzureDesigned, built and documented to ISM & Essential 8 — up to PROTECTED. - HybridPROTECTED extends from cloud to on-premises — no weak links.
- ISMSGRC consulting and complete custom ISMSs aligned to ISO/IEC 27001.
- ArchCyber security architecture for cloud, hybrid and regulated environments.
- AdvisoryIndependent technical and strategic cyber advisory.
- IRAPWe prepare you for assessment. The assessor stays independent.
Anyone can say they "deliver secure M365." We design in what assessors look for — so you don't waste months fixing gaps later.
ACT Cyber is an Australian-owned consultancy with a deliberately narrow practice: Microsoft 365, Azure and hybrid environments, engineered to the ISM PROTECTED control baseline and the Essential Eight. We produce the full accreditation package alongside the build — SSP, SRMP, SoA, risk register and control evidence — in the formats IRAP assessors expect.
No retrofit, no rewrite, no surprises when the assessor arrives.
Frameworks we build to.
ISM
Australian Government Information Security Manual — every configuration traces back to an ISM control.
E8
ACSC Essential Eight Maturity Model — implemented by platform configuration, not documentation alone.
PSPF
Protective Security Policy Framework — informs information handling and governance patterns.
ISO 27001
International information security management standard — our ISMS designs are ISO/IEC 27001 conformant.
NIST
NIST Cybersecurity Framework — used where hybrid or US-aligned control mapping is required.
Why ACT Cyber.
Built for the assessor in the room.
Every artefact is produced in the format IRAP assessors expect — SSP, SRMP, SoA — concurrently with build, not retrofitted afterwards.
Controls satisfied by the platform.
ISM and Essential Eight controls met by Microsoft platform configuration and operational practice — not documentation alone.
AGSVA-cleared, end to end.
Australian-owned, AGSVA-cleared consultants operating under Australian jurisdiction. No offshore touch, no outsourced accountability.
Cloud to on-premises, one baseline.
We extend PROTECTED compliance from Azure and M365 into your on-prem estate — no weak links between cloud and legacy.
The Microsoft stack — configured for regulated workloads.
We work across the full Microsoft security and productivity stack, configured to the ISM control baseline.
Audit pressure mounting?
Talk to a cleared PROTECTED specialist. Fast compliance, cost-effective delivery, zero audit surprises.
Schedule of services.
Nine service lines covering the complete lifecycle of a PROTECTED-aligned Microsoft environment — from initial assessment through to handover or managed operations.
Ready to scope an engagement?
A 30-minute discovery call to understand where you are, what PROTECTED means for your workloads, and a realistic view of the path to accreditation.
Accreditation built in. Not bolted on. From day one.
A structured programme for organisations that need a Microsoft 365 and Azure environment capable of supporting workloads classified up to PROTECTED — delivered ready for IRAP assessment, with the artefacts and evidence already in the formats an independent assessor expects.
Deliver a Microsoft cloud and hybrid environment capable of supporting workloads up to PROTECTED — with accreditation artefacts, control evidence and operational readiness produced as part of delivery.
The programme is structured so that the same team who designs the environment also produces the SSP, SRMP, SoA and supporting evidence. That single team, working against a single control baseline, is what makes the difference between an 18-month accreditation ordeal and an 8–12 month delivery.
Scope boundary: the IRAP assessment itself is conducted by an independent, IRAP-endorsed assessor of your choosing. ACT Cyber's role ends at the point your environment and evidence are ready for assessment. We maintain that separation deliberately — it preserves assessor independence.
The four phases.
How it fits together.
A simplified view of the environment we design for clients. Every component is mapped to ISM controls, with evidence produced from configuration — not narrative.
Identity Backbone
Zero Trust identity is the spine. PIM, Conditional Access, MFA enforcement — the ISM controls every other layer relies on.
M365 Collaboration
Sensitivity labels, DLP, Teams governance and SharePoint architecture — within ISM data handling boundaries.
Azure Platform
ISM-aligned landing zone, hub-and-spoke architecture, private endpoints, Sentinel-based SIEM. Built right the first time.
Endpoints & Hybrid
Intune + Defender XDR + ACSC baselines on the device side. Hybrid identity and secure connectivity on the on-prem side.
Concurrent, not sequential.
Most PROTECTED programmes run 18–24 months because accreditation is treated as a separate workstream. Ours run shorter because the artefacts are produced during build.
Indicative. Timelines depend on existing estate, tenant maturity and internal governance cadence.
Audit pressure mounting?
Fast compliance. Cost effective. Zero audit surprises. Talk to a cleared PROTECTED specialist about your programme.
Bidding on Commonwealth work? Already won it? Be ready, fast.
For industry organisations bidding on, or already delivering, Commonwealth contracts — ACT Cyber is the sovereign Microsoft cloud and PROTECTED-readiness partner that gets your team to Commonwealth security standards (ISM, PSPF, Essential 8, ISMS) fast.
Why partner with ACT Cyber.
Commonwealth contracts come with security obligations few industry teams have in-house. Whether you're bidding for the work or scrambling to meet the standards after winning it — ACT Cyber is built to lift you to Commonwealth-ready, fast.
Our team has spent careers delivering into Australian Government and regulated environments. We don't compete with our partners — we specialise in what most industry teams don't have in-house: deep PROTECTED-aligned Microsoft cloud delivery, ISM and Essential Eight uplift, ISMS design and IRAP readiness acceleration. The kind of capability tender evaluators recognise and contract sponsors trust.
Sovereign and cleared.
100% Australian owned, AGSVA-cleared personnel, no FOCI risk. Passes probity without caveats.
Deep technical credibility.
PROTECTED-aligned M365 and Azure delivery with ISM and Essential Eight as the baseline. Operational, not theoretical.
Accreditation acceleration.
The ACT Cyber Method produces SSP, SRMP and SoA artefacts concurrently with build — a credible differentiator in any tender evaluation.
Microsoft specialisation.
Azure, M365, Entra ID, Intune, Defender, Purview and Sentinel — the platforms most Commonwealth programmes are moving to.
Tender-ready pack.
CVs, case studies and capability statements ready to insert once a partnering agreement is established.
Tenders move fast. Contract clocks tick faster. Our partner pack is ready for both.
Most Commonwealth tenders give industry days — not weeks — to lock in their delivery team. And once you've won, the security clock starts running. ACT Cyber maintains a continuously updated Partner Pack and is ready to mobilise on either side of contract award — at the speed your tender or contract demands.
What's in the partner pack.
Six artefacts, ready to insert into your tender response — or to demonstrate capability uplift to a contract sponsor post-award.
Team CVs
Cleared personnel CVs formatted for Commonwealth tender submission.
- Clearance level stated
- Programme experience highlighted
- Microsoft certifications
Sanitised case studies
Outcome-focused case studies from regulated programme delivery.
- PROTECTED cloud delivery
- IRAP readiness outcomes
- Quantified metrics
Capability statement
Concise capability statement covering core offerings and sovereign credentials.
- Two-page and one-page formats
- ISM, IRAP, Essential 8
- Microsoft credentials
Commercial rate card
Labour categories and indicative rates structured to map to common Commonwealth panel formats.
- Role-based categories
- Day rate & fixed-price
- Cleared role variants
Past performance register
Structured register of relevant programme experience for tender past performance requirements.
- Categorised by capability
- Classification indicated
- Referee contacts on request
Corporate credentials
Insurance certificates, ABN, Microsoft Partner ID and personnel clearances packaged for tender submission.
- Professional Indemnity ($10M / $20M)
- Public & Products Liability ($20M)
- Microsoft AI Cloud Partner
Case study snapshots.
A taste of recent engagements. Detailed, sanitised versions live in the Partner Pack — released once a partnering agreement is in place.
PROTECTED M365 readiness
Microsoft 365 tenant designed and documented to ISM PROTECTED. Conditional Access, PIM, Purview DLP and sensitivity labels — all artefacts produced concurrently with build.
Sovereign Azure landing zone
ISM-aligned Azure landing zone, hub-and-spoke architecture, identity-first security model and full governance framework stood up alongside the build.
Zero Trust identity — Entra ID & Essential 8
Complete Entra ID zero trust architecture — Conditional Access, PIM, MFA enforcement and device compliance. Essential 8 Maturity Level 2 achieved.
Note: case studies above are illustrative pending real engagement data. Real anonymised outcomes will replace these as engagements complete.
How the partnering process works.
Make contact
Reach out to discuss the opportunity, capability fit and commercial structure.
Agree to partner
A teaming or partnering agreement is put in place — protecting both parties.
Pack dispatched
CVs, case studies, capability statement and commercial rates provided promptly.
We deliver
Bid wins or contract is in place — ACT Cyber mobilises as scoped, cleared, capable and ready from day one.
Bidding for, or delivering, a Commonwealth contract?
Get in touch early — partnering agreements are quick to establish, the pack is ready to go, and we can mobilise to lift your team to ISM, PSPF and Essential 8 standards before the contract clock makes it expensive.
Australian. Cleared. Specialist.
ACT Cyber is an Australian-owned cyber consultancy with a deliberately narrow practice — Microsoft 365, Azure and hybrid environments delivered to the ISM PROTECTED standard. Founded and led by practitioners who build for audit, not around it.
Most PROTECTED programmes take too long, cost too much, and arrive at IRAP with gaps that should never have been there. We exist to change that.
Our mandate is narrow on purpose. We do not try to be everything to everyone. We focus on Microsoft cloud and hybrid environments, ISM PROTECTED aligned, because that is where deep specialist knowledge saves clients months of effort and tens of thousands of dollars.
Every engagement is led by senior consultants. Every artefact is written by the same team that built the environment. Every configuration traces back to a control, and every control is mapped to evidence that an IRAP assessor will accept.
Principles that shape the work.
Build for the assessor in the room.
Every design decision, every artefact, every configuration is produced knowing an IRAP assessor will read it. If it won't pass scrutiny, we don't ship it.
Platform over paperwork.
ISM controls satisfied by Microsoft platform configuration beat controls satisfied only by documentation. Prove it in the tenancy, not just the SSP.
Specialist, not generalist.
We don't try to be everything. PROTECTED Microsoft environments are the brief — that's where depth matters, and depth is where clients save time and cost.
Sovereignty, end-to-end.
Australian-owned, Australian-staffed, Australian-delivered. Clearances, data, decisions and contracts all stay onshore.
The firm in six lines.
Want to know how we'd approach your programme?
A short conversation is the fastest way to find out whether ACT Cyber is a good fit for your PROTECTED pathway.
Credentials, in writing.
The certifications, insurances and corporate facts our consultants and clients lean on. All credentials are held by ACT Cyber consultants — verification copies and certificates of currency are available on request as part of due-diligence or tender responses.
Strategic depth.
Senior credentials in governance, risk and security leadership.
Microsoft cloud, at the architect tier.
Senior individual Microsoft certifications held by ACT Cyber consultants — covering the platforms we build to PROTECTED.
Independent frameworks, applied with discipline.
Architecture and ISMS standards that underpin our designs and governance practice.
The procurement-ready facts.
Corporate, insurance and partner details for tenders and due-diligence reviews.
On request: certificates of currency for both insurances, certification copies for any of the credentials above, and tender-format CVs for cleared consultants — typically returned within one business day.
Need credentials in tender format?
We maintain capability statements, insurance certificates and CVs ready to insert into tender responses. Get in touch and we'll send what you need.
Talk to a cleared PROTECTED specialist.
Whether you're scoping a programme, responding to audit pressure, or comparing delivery options — we'll give you a direct, technical answer within one business day.