Industries · Government & suppliers
For the public sector, and everyone who supplies it.
Councils and government suppliers get asked the same hard questions. We get you ready to answer them with evidence.
Councils carry government security expectations without an enterprise security team. Businesses supplying government inherit those expectations through tender questionnaires: Essential Eight maturity, incident readiness, and evidence for every claim.
Essential Eight uplift, testing and vCISO
We bring Essential Eight uplift, penetration testing, a standing vCISO seat and secure builds.
What you carry, and what we do about it.
Essential Eight maturity is the default yardstick: agencies are assessed against it, and suppliers are increasingly asked for it.
An Essential Eight uplift: your current maturity rating across all eight strategies, an uplift plan to the target level, and an evidence trail for each mitigation.
Essential Eight upliftTender security questionnaires demand specific answers with evidence, and a blank row can cost the bid.
A posture assessment maps where you stand against recognised controls, and a vCISO gives you a named security lead to stand behind the answers.
vCISO & posture assessmentIncident reporting expectations: government buyers want a response path that has been rehearsed.
A review of your logging and alerting coverage, an incident response playbook your team can run, and a tabletop exercise to pressure-test it.
Detection & response advisoryLegacy systems predate the expectations now applied to them, and they still run the service.
We penetration-test the systems you run and hand back a ranked fix list. Where a system cannot be defended, we design and build its replacement secure by design.
Penetration testing & secure builds
The obligations in play
- ASD Essential Eight
- ASD Information Security Manual
- Privacy regimes
- Procurement security requirements
What each obligation asks
- ASD Essential Eight
- The baseline mitigation strategies Australian government bodies are assessed against, and increasingly expect their suppliers to address.
- ASD Information Security Manual
- The control framework for systems handling government information.
- Privacy regimes
- Councils sit under state information-privacy statutes; suppliers handle personal information under the Privacy Act 1988.
- Procurement security requirements
- Tenders carry their own mandated controls, insurances, and evidence obligations, set contract by contract.
Not legal advice; your advisers own the interpretation.
Procurement asks for the entity, the certification and the insurance.
The capability statement and the certification are public; only the insurance certificates come on request.
- Legal entity
- Black Shard Pty Ltd · ABN 66 696 910 773
- Certification
- SMB1001:2026 Gold (Level 3), issued by CyberCert on director attestation and listed on the public registry.Verify on the CyberCert registry ↗
- Insurance
- Professional indemnity, public liability, cyber and workers’ compensation insurance held. Certificates of currency on request.
- Ownership
- Australian-owned and operated, headquartered in Brisbane, Queensland.
- Capability statement
- Ready for your evaluation pack.Download the capability statement (PDF) ↓
If you are running procurement, ask for the capability statement; we answer security questionnaires as part of the job.
Responsible security lead.
Kane Roberts
Director and Chief Information Security Officer
Leads security and engineering at Black Shard. Master of Cyber Security, Graduate Diploma of Legal Studies, and Exemplar Global Certified Lead Auditor for ISO/IEC 27001:2022.