We help Australian organisations identify and prioritise risk, apply the right controls and verify they work, and meet the standards customers and regulators expect: ISO 27001, PCI DSS and practical maturity improvement.
years testing for government and enterprise
CREST-accredited through CREST ANZ
dotSec is a PCI QSA Company, a PCI DSS-compliant service provider and ISO 27001 certified.
Our advice comes from implementing and maintaining these standards ourselves, not just assessing others.
From certification to a maturity roadmap, our GRC work is practical, evidence-driven and scoped to your risk.
Gap analysis, ISMS implementation and certification support, with fixed or capped pricing.
QSA-led ROCs, gap analysis and SAQ preparation, with a focus on reducing your compliance scope.
A structured view of control effectiveness, governance and risk, with a prioritised improvement roadmap.
Understand which risks matter most, based on operational realities, compliance requirements and business goals.
Turn risk decisions into practical, risk-based controls aligned with your business.
Confirm through testing and assessment that your controls work as intended.
Independent, senior and practical, from a team that has been operating for more than 25 years.
Our consultants bring deep technical and governance knowledge from more than 25 years of hands-on security work.
Our advice and services focus on risk, outcomes and evidence, not product sales.
We work with technical and business stakeholders to deliver realistic, sustainable improvements, and we are happy to complement your in-house team.
We understand the regulatory, threat and industry landscape Australian organisations operate in.
Yes. We work across technical security and governance, risk and compliance. We are ISO 27001 certified and a PCI DSS-compliant service provider, and our team includes PCI QSA, ISO 27001 assessor and implementer certifications.
Yes. ISO 27001, the Essential Eight, APRA CPS 234 and PCI DSS overlap substantially, and running them as one engagement avoids duplicating evidence collection and control testing.
Yes, through workshops, executive briefings, technical knowledge transfer and awareness activities, aligned to real-world threats and your compliance requirements.
Yes. For PCI DSS, for example, we can run the gap analysis and remediation and hand a remediation-complete environment to your chosen QSA for the formal ROC.
Need certification, a compliance gap analysis or a clear maturity roadmap? We will scope the work around your risks, timeline and budget.
Fixed or capped pricing is available, and we will reduce your scope wherever we legitimately can.
