ProtectSMB GRC turns the ISM, Essential Eight, ASD Essentials, NIST CSF, ISO 27001 and SOC 2 into a matrix you can actually work through. Keep a real risk register, audit yourself clause by clause, and see one honest score for how you would fare if the auditor arrived tomorrow — then hand over the reports and documentation they ask for.
This is the guided demo as it runs inside the product: a real action from the catalogue scored honestly, the evidence behind that score and what it does not cover, the gap that follows, the risk it creates scored before and after treatment, the remediation task with an owner and a due date, and the board report the whole chain lands in.
Step 1 of 6 · Assessment action scored
Acme scored the anchor action at the first intermediate level, which is what tells the platform there is work to do here.
Recorded in the product, captioned step by step — there is no sound to miss. The demo uses sample data for a fictional manufacturer and is kept entirely separate from a workspace's own assessment.
A look inside
Dense where it needs to be, plain where it matters. These are the screens you will spend your time in.
ASD Essentials
Enterprise IT, operational technology and cloud, each assessed in its own right. The Enterprise IT chapter comes straight from ASD's published catalogue — every principle with its statement, every action with its domains, and ASD's Indicators of Good Practice open beside the score so you can check your call against what ASD says good looks like. Cloud is answered by who is responsible for what; OT asks the hard questions about vital systems, what cannot be patched and whether you could actually run isolated.
Essential Eight maturity
The 123 ISM controls ASD itself maps to the Essential Eight, laid out the way the model is graded: one column per strategy, ML3 on top and ML1 at the base. Each cell is coloured on how many of its applicable controls are genuinely effective, each level carries its own score, and the badge says achieved or not — because ACSC grades a level all or nothing. Click a cell to score the controls behind it, work the checklist for the level you are chasing with a target date on every item, and if you already assess the ISM your answers carry straight across.
The control matrix
Work through ISM, Essential Eight, ASD Essentials, NIST CSF, ISO 27001 or SOC 2 control by control. Mark what applies, how effective it is and its maturity from 0 to 5. Filter, search and group by section, with the control reference pinned as you scroll.
Posture at a glance
A live posture score and average maturity, broken down by domain, with your gaps and out-of-scope controls counted honestly rather than hidden.
Certification readiness
How you would fare if the auditor walked in tomorrow, built from the things they actually check: scope decided, controls assessed, controls genuinely working, evidence on file, your Statement of Applicability, the state of your risk register and your internal audit findings. It names what is costing you the most points and records the score daily, so you can see the line move.
Risk register
Every risk with an owner, how likely it is and how much it would hurt — scored before treatment and again afterwards — the treatment you have chosen, and the controls doing the treating. Start from the risks nearly every small business carries rather than a blank page, score them on a 3×3, a 5×5 or a grid of your own wording, and set the appetite the board is actually willing to tolerate: anything above it is flagged, and accepting one anyway needs a name and a date against the decision.
Common risks
A blank risk register is the reason most never get written. Tick off the risks nearly every small business carries — a staff member deceived by a phishing email, a customer payment redirected, ransomware stopping you trading, an account protected by a password alone, backups that fail when you need them, a departed employee who still has access — and they go on your register unscored, in plain English, with the controls that treat them already linked. How likely and how damaging stays your judgement.
Audit programme
Clause 9.2 asks for an audit programme, not a one-off audit. Choose a monthly, quarterly or half-yearly cycle, assign each period a slice of the system with an owner and a date, and watch the coverage bar until the whole thing is accounted for. Owners get an email 14 days and 3 days before their slice is due, so it happens without you chasing it.
Internal audit
The clause-by-clause checklist an ISO 27001 auditor works through — management system clauses 4 to 10 plus all 93 Annex A controls — each with the question they will ask and what good looks like. Record conforming, an observation, or a minor or major nonconformity, note what you saw, then raise a risk or a remediation task straight from the finding. Hand over the whole thing as a Word report.
Notes and evidence
Write a short "how we meet this" statement against any control, starting from suggested wording or your own saved snippets, and attach the files that prove it to the evidence vault.
Reporting
A compliance certificate, an executive summary and a one-page board snapshot — each with a print-friendly version — plus CSV export for your own analysis.
Documentation pack
Word templates for the documentation you are expected to hold — the shared policy set plus the documents your framework expects, from the Essential Eight maturity plan to the SOC 2 criteria matrix. Prefilled from your own assessment: org details, posture, maturity, gaps, notes and linked evidence.
Guided demo
'Try Demo' walks one real control from your chosen framework all the way through: an honest score, the evidence behind it and what that evidence does not cover, the gap that follows, the risk it creates scored before and after treatment, the remediation task with an owner and a due date, and the board report it all lands in. Each step highlights the part of the screen it describes. It is sample data for a fictional manufacturer, kept separate from your own work and cleared when you leave.
DISP membership
Defence Industry Security Programme membership asks you to hold a risk register covering particular ground. Yours is measured against that expectation area by area: what each reference asks for, which of your own risks already answers it, and what is still a gap. Raise a gap and the risk and its remediation task are written for you, worded for that area and linked to the reference. Export the lot as a spreadsheet for your working or a Word document for the pack you hand over.
Versions and approval
Publish numbered versions against a named approver with a review date, compare any two versions line by line, and get a warning before a document is due for review.
Multiple networks
Assess each network, site or environment separately, copy a finished one to a new site as a starting point, and compare two networks control by control to see exactly where they differ.
Everything included
No modules to buy one at a time. The list below is the product.
Frameworks and documentation
Every framework below is fully assessable, and each one comes with its own documentation: the shared policy set plus the documents that framework expects — the Essential Eight maturity plan and procedures, the ISO 27001 Statement of Applicability, NIST CSF profiles, the SOC 2 system description and criteria matrix.
ISM
Information Security Manual (ACSC)
assessment · available
documents · available now
Essential Eight
Essential Eight Maturity Model
assessment · available
documents · available now
ASD Essentials
ASD Essentials — Enterprise IT, OT and cloud (ASD)
assessment · available
documents · available now
NIST CSF
NIST Cyber Security Framework
assessment · available
documents · available now
ISO 27001
ISO/IEC 27001 Annex A
assessment · available
documents · available now
SOC 2
Trust Services Criteria (AICPA)
assessment · available
documents · available now
ASD Essentials
The Essential Eight stops at eight technical strategies. ASD Essentials goes wider — governance, people, process, plant and cloud — and we carry all three chapters, scored in ASD's own levels and reported chapter by chapter or as one posture across the lot. Included from the Enterprise plan up, and a $1,000 a year add-on below it.
Imported straight from ASD's published catalogue — every principle with its statement, every action with the domains it protects, and ASD's Indicators of Good Practice open beside the score so your call is judged against ASD's words, not your impression of them.
The questions a plant actually turns on: which systems you cannot run safely without, what cannot be patched and what protects it instead, whether break-glass has been tested, and whether you could keep producing while isolated from everything else.
Answered by who is responsible for what. What you own is scored outright, what the provider supplies has to be enabled, configured and actually used, and what they perform stands on assurance evidence whose scope covers the services you really consume.
Half an hour, screen shared, on your own situation: which chapters apply to you, what the Essential Eight work you have already done carries across, and what the honest size of the gap looks like.
One annual price per workspace, with every user included — no per-seat billing on the first three tiers. Essentials covers the Essential Eight; Professional covers one framework of your choosing, set when you start; Enterprise covers all five. ASD Essentials — the Enterprise IT, operational technology and cloud chapters — is included from Enterprise up, and is a $1,000 a year add-on on Essentials and Professional.
Essential Eight or ASD Essentials? See which one you needAUD $500
per year, per workspace, ex GST
The Essential Eight, scored properly. For a small business that needs to know where it stands.
+ ASD Essentials $1,000 a year
AUD $1,000
per year, per workspace, ex GST
One framework of your choosing, with remediation tracking and posture history. For a business working towards a single standard.
+ ASD Essentials $1,000 a year
AUD $30,000
per year, per workspace, ex GST
All five frameworks at once, plus ASD Essentials included, assessor sharing, audit log, documentation packs, backups and extra networks.
Talk to us
priced per engagement, ex GST
All features, including everything in Enterprise. Every feature in the platform, run your way — your own brand, your own mailbox, and a self-hosted or sovereign install if you need one. Priced per engagement.
Talk to us
priced on application
All features, including everything in Enterprise. Your own instance of the platform on Australian infrastructure: a dedicated database, your own domain, audit forwarding to your SIEM, and an air-gapped install if you need one. Nothing shared with anyone else.
| What you get | EssentialsAUD $500 | ProfessionalAUD $1,000 | EnterpriseAUD $30,000 | Custom / MSP / Self-hostedcoming soon | Sovereign — dedicated instanceTalk to us |
|---|---|---|---|---|---|
| Frameworks coveredEssential Eight, ISM, ISO 27001, NIST CSF and SOC 2 — ASD Essentials is included from Enterprise up | Essential Eight · ASD Essentials add-on | One of your choosing · ASD Essentials add-on | All five + ASD Essentials | All five + ASD Essentials | All five + ASD Essentials |
| Assessment matrixScore controls, maturity and applicability | |||||
| Evidence vaultAttach and store evidence files | |||||
| Report PDFsCertificate, executive summary and board snapshot | |||||
| All frameworksEvery framework at once, rather than one | $4,000 | ||||
| ASD EssentialsThe Enterprise IT, operational technology and cloud chapters | add-on $1,000 | add-on $1,000 | |||
| Cross-framework coverageAnswer once, see and apply it across frameworks | $4,000 | ||||
| Live framework fetchPull the latest published control sets | |||||
| Custom framework importUpload a control set or IRAP worksheet | |||||
| Remediation tasksAssign, track and chase remediation work | |||||
| Trends and snapshotsPosture history and trend charts | |||||
| Assessor sharingShare a read-only assessment with an assessor | $4,000 | ||||
| Audit logFull activity history for the workspace | $4,000 | ||||
| Security alertsEmail alerts on sensitive account activity | $4,000 | ||||
| AI implementation advicePer-control implementation guidance | |||||
| AI connectorConnect the workspace's own AI provider key | |||||
| User managementInvite users and manage roles | |||||
| Single sign-onGoogle SSO | |||||
| SCIM provisioningDirectory-driven user provisioning | |||||
| Backup exportDownload a JSON backup | |||||
| Backup restoreRestore a workspace from a JSON backup | $4,000 | ||||
| Extra networksAssess up to six networks instead of three | $4,000 | ||||
| Documentation packsWord templates for required documentation, prefilled from the assessment | $4,000 |
Enterprise adds 8 things to Professional. Take any of them on their own for $4,000 a year each — and if you end up wanting all 8, Enterprise at $29,000 costs less than buying them one by one, so that is what you pay.
Your workspace admin picks the elements under Compliance → Add to your plan, with a running total as they go. Choose the lot and we move you to Enterprise at the flat $29,000 instead.
Prices are in AUD and exclude GST. Every tier includes unlimited users, AI implementation advice using your own provider key, single sign-on and SCIM provisioning. The Custom / MSP / Self-hosted tier is switched on feature by feature for your engagement. The Sovereign option is the same platform, deployed as a dedicated instance in Australia for you alone — on Azure, on your own Linux host, or on your own Windows Server estate. Talk to us about hosting, air-gapped installs and SIEM forwarding. Our trust and security page answers the questions a security questionnaire usually asks.
Selling or managing this for other businesses?
Managed service providers run a portfolio of client networks from their own console — ten client networks are included with the MSP licence and further networks come in packs of five at a flat AUD 5,000 a year per pack, which no discount touches. A client always invites you in and approves it themselves before you can accept. Resellers sell the licence and leave the client to run it, at a discount agreed with us. Both can register a prospect's domain so the licence is attributed automatically when they sign up, and both can download a statement of their whole book. Tell us which you are and we will set you up.
Get in touch
Pick a time that suits you and we will walk you through the matrix for your framework, the reporting and the documentation pack — against your situation, not a canned demo.
Already a customer? Sign in and use Help → User Guide.
We use essential cookies only — one to keep you signed in and to protect your session. No advertising or third-party tracking. Read the Privacy Policy.