CEZANNE

Security and governance consulting

Security you can show your clients, insurers and auditors.

Cezanne Consulting helps businesses meet the security expectations put on them: cyber security and AI governance, ISO 27001 and ISO 42001 readiness, organisation-wide security programs, and physical site assessments. One senior consultant, start to finish.

Book a 30-minute call See the services
  • CISSP
  • ISO 27001 Lead Auditor
  • Eight years in defence-industry security
  • Associate member, Australian Computer Society
  • ABN 81 384 710 332

Services

Four areas of practice

Each engagement starts with an assessment of where you are, and ends with documents you keep and can act on without me.

Cyber and AI

Cyber security and AI governance

For businesses that need to show the security basics are in place, and to control how staff use AI tools with client data.

  • Risk and gap assessmentAgainst ASD's Essential Eight or the new ASD Essentials, plus the risks your AI use adds.
  • Uplift planThe gaps in priority order, with the effort for each.
  • AI policies and approvalsA plain-English AI use policy and a process for approving new tools.
  • Staff guidanceWhat can and can't go into an AI tool, with examples from your own work.

Management systems

ISO 27001 and ISO 42001 readiness

For businesses heading towards certification in information security (ISO/IEC 27001) or AI management (ISO/IEC 42001), often because a client or tender requires it.

  • Gap assessmentYour current controls compared against the standard, clause by clause.
  • Statement of ApplicabilityWhich controls apply to you, why, and how each is met.
  • Risk registerYour information security and AI risks, rated, owned and treated.
  • Readiness report and implementationWhat's left before a certification audit, and hands-on help to close it.

Security programs

Universal Industry Security Program (UISP)

For businesses outside Defence that supply larger organisations and need to show a security program across governance, people, sites and systems.

  • Assessment across four domainsGovernance, personnel, physical, and information and cyber, plus supply chain and incident response.
  • Target tierA level of assurance chosen to match what your clients expect.
  • Evidence and risk registerWhat an assessor would expect to see, what you hold, and the risks behind each gap.
  • ReportMapped to ISO 27001, NIST and CMMC, so it reads across to the frameworks your clients use.

UISP is Cezanne Consulting's own program. It is not a government scheme and is not affiliated with Defence or DISP.

Physical security

Outside Australia only

Physical security site assessment

For non-government sites: offices, warehouses and other commercial premises.

  • Site walkPerimeter, entries, access control, alarms, video and how people actually use the site.
  • Controls assessmentWhat's in place against recognised physical security standards.
  • Risks foundEach one rated, with where and why it matters.
  • Costed improvementsWhat to fix, in priority order, with indicative costs.

Not currently offered in Australia.

Where to start

Common reasons people get in touch

Approach

How an engagement runs

  1. Scoping call

    30 minutes to understand what's driving the work and which service fits. Use the form below and I'll reply with times.

  2. Written scope

    What I'll assess, what you'll receive and what it costs, agreed before any work starts. [Confirm: fixed quote per engagement]

  3. Assessment and handover

    I do the work myself and hand over every report, register and policy, so you're not tied to me afterwards.

About

Geoffrey Whitworth, Principal Consultant

I spent eight years as a security consultant in Australia's defence industry, working on security audits, risk assessments, policy, incident response and compliance against the ISM, the Essential Eight and ISO 27001.

I also build AI systems, so my advice on AI governance comes from someone who writes the code as well as the policy.

Cezanne Consulting is a one-person practice. The person on the first call is the person who does the work.

  • CISSP
  • ISO 27001 Lead Auditor
  • Associate member, Australian Computer Society
  • Speaker, CyberCon 2023

Read the full bio

FAQ

Common questions

How much does it cost?

[PRICING: add an indicative range per service, or say "a fixed quote after the scoping call"]

Is the first call free?

[CONFIRM: yes or no, and how long]

Can you certify us to ISO 27001 or ISO 42001?

No. Certification audits are done by an accredited certification body, and a consultant who helped you prepare can't also certify you. I get you ready for that audit. As an ISO 27001 Lead Auditor, I know what the auditor will ask for.

Is UISP a government program?

No. The Universal Industry Security Program is my own program, built on public standards (ISO 27001, NIST and CMMC). It isn't run by, or affiliated with, Defence or the Defence Industry Security Program (DISP). Meeting a UISP tier doesn't grant DISP membership or CMMC certification.

Why aren't physical site assessments offered in Australia?

In Queensland, giving security advice for reward needs a licence under the Security Providers Act 1993. Until I hold the relevant licence, I only take physical site work outside Australia.

What happened to the Essential Eight?

On 15 October 2026 the Australian Signals Directorate released ASD Essentials, which builds on the Essential Eight. Instead of one Maturity Level from Zero to Three, it reports security area by area, such as identity or internet-facing systems, with effectiveness ratings backed by evidence like testing.

ASD hasn't set a date for when it becomes mandatory, and the Essential Eight stays in place for now. Work you've done on the Essential Eight carries across, but ASD advises checking your controls against the new framework rather than assuming they're equivalent. I can assess against either.

Source: ASD, ASD Essentials: evolving our approach to cyber security resilience

Do you work remotely?

Yes. Cyber, AI, ISO and UISP work is done over video call and shared documents. Physical site assessments need a site visit. [CONFIRM: where you can travel for site work]

Do you sell software or take commissions?

No. I provide advice and hands-on help only, so any product I recommend is on its merits.

Book a call

Tell me what you need

Send a few lines about your business and what's driving the work. I'll reply with times for a 30-minute scoping call within [RESPONSE TIME, e.g. one business day].

Phone
+61 414 664 624

For example: a client or tender requirement, an insurer's questions, or a recent incident. Please don't include passwords or client records.

I'll use these details only to reply to you about your enquiry. [Privacy policy link]