Compliance
Cyber security compliance without the box-ticking
Practical help navigating SMB1001 and Essential Eight requirements, built into your existing operations rather than bolted on as a separate compliance exercise.
Book Your Free Security Gap CheckCompliance is a moving target for most Australian SMBs, and it keeps mattering more as insurers, customers and government contracts all start asking for proof of a baseline security posture. DJC helps you work out which standards actually apply to your business, then builds a practical path to meeting them.
The two frameworks we see most often are SMB1001, the certification standard built specifically for Australian small and medium businesses, and the Essential Eight, the Australian Signals Directorate's baseline mitigation strategies. We are certified at SMB1001 Diamond, the highest tier the standard offers, and hold ISO 27001 and ISO 9001 as well, so the standards we advise you on are ones we have already met.
Compliance is not a one-off project. It draws on the same work as our security audits and risk assessments, and ties into data protection and access management, since strong evidence for compliance is really just good security practice, documented properly.
What our compliance service covers
Essential Eight maturity assessment
Benchmarking your current maturity level against the ASD Essential Eight and building a practical plan to lift it.
SMB1001 certification support
Guidance through all five tiers of SMB1001, Bronze through Diamond, matched to what your business and industry realistically need. See our SMB1001 certification page for the full program.
Policy and process alignment
Translating framework requirements into policies and day-to-day processes your team will actually follow.
Compliance evidence and documentation
Building the audit trails and documentation frameworks require, drawing on our access management and data protection work.
Ongoing review
Revisiting your compliance position as standards update and your business changes, so certification does not lapse quietly.
If IT is your responsibility
An owner, not an account manager
You deal with Daniel or Julian Church directly. We keep the client list deliberately short so the people who answer already know your environment.
Numbers you can defend
Every engagement starts with a costed IT roadmap: what technology should cost this year and next, in business terms you can take to a board or a budget meeting.
See what managed IT typically costsWorking alongside internal IT
If you already have an IT manager or a small team, we are not here to replace them. Co-managed IT adds tooling, escalation and after-hours cover around them.
How co-managed IT worksWhy DJC
- We have done it ourselves. DJC is SMB1001 Diamond certified, the top tier, and holds ISO 27001 and ISO 9001, so our compliance advice comes from direct experience, not a sales brochure.
- Compliance built on real security work. Our recommendations are grounded in the same security audits and risk assessments we run for clients, not a generic checklist.
- Practical over exhaustive. We aim for compliance that fits how your business actually operates, not a paperwork exercise that gets ignored the week after the audit.
- Insurance and contract benefits. Lifting your SMB1001 tier and Essential Eight maturity often supports better cyber insurance terms and satisfies the security requirements larger customers now ask for.
Quick answers
What is SMB1001 and does DJC support it?
SMB1001 is a cyber security standard built specifically for Australian small and medium businesses, with five tiers: Bronze, Silver, Gold, Platinum and Diamond. DJC helps clients assess which tier suits their risk profile and industry, then builds the practical steps to get there, backed by our own SMB1001 Diamond certification, the highest tier, plus ISO 27001 and ISO 9001.
What changed in the SMB1001:2026 update?
The SMB1001:2026 edition raised the bar at the Gold tier, now requiring email authentication controls, endpoint detection and response (EDR), cyber insurance, and a documented responsible AI use policy. DJC can help assess your current position against these updated Gold requirements as part of a compliance review.
What is the Essential Eight and how does it relate to SMB1001?
The Essential Eight is the Australian Signals Directorate's baseline set of mitigation strategies against common cyber threats. SMB1001 draws on similar principles but is structured specifically for SMBs with tiered certification levels. DJC assesses your business against both where relevant, since they reinforce rather than duplicate each other.
Do we need a formal compliance certification, or just good practices?
It depends on your industry and customers. Some businesses need formal certification like SMB1001 for contracts or insurance; others simply need to demonstrate solid practices. DJC starts with a security audit to establish where you stand, then advises honestly on whether formal certification is worth pursuing.