Straight answers before you ask.

ISO 27001 is the international standard for managing information security. It is a proven way to organise how your business protects its information, and a way to prove to customers, tenders and investors that you do it properly. An independent certification body audits you and issues the certificate.

Certification is voluntary, but customers, tenders and partners may require it. If security questionnaires keep stalling your deals, it is usually worth considering.

For ISO advisory work, the specialist who scopes your engagement delivers it. There are no handoffs and no rotating account teams. VicByte Advisory is led by its two founders, Deepak Varma and Yusuf Ali Khan.

Engagements are fixed-fee and scoped up front, with no hourly billing and no scope creep. The ISO 27001 Gap Assessment is $2,000 AUD. An Internal Audit is $2,000 to $5,000 AUD depending on the size of your ISMS. ISMS Implementation is scoped after your gap assessment. Testing engagements are scoped in a written agreement before any work begins.

The fixed-fee model is built for exactly this. You know the cost before work starts, so there are no surprise invoices. Our case study client, Raidar Software, is a fully remote healthcare SaaS team of about five people.

Yes. VicByte is based in Melbourne and works with organisations in Australia and around the world. Our Raidar Software engagement was delivered fully remotely.

It starts with a free 15-minute call. If it is a fit, we agree the scope and fees in writing. Work does not commence until that agreement is signed, and any change to scope needs written approval from both sides.

We treat all client information as confidential and do not disclose it to third parties without your written consent, except where the law requires it. As an ISO 27001 advisory firm, we apply information security controls to the data we hold. Our Privacy Policy and Terms of Service set this out in full.

It is a scored review of your current controls against ISO 27001:2022, including all 93 Annex A controls. Every requirement is rated CONFORMANT, PARTIAL or GAP against real evidence, and an Annex A control that does not apply to your scope is marked N/A, so you see exactly where you stand rather than relying on assumptions.

Delivery takes about one week. The steps are a discovery call, agreement, evidence review, gap analysis, and then a written report with a roadmap.

During the evidence review you share your policies, records and other evidence, and each item is reviewed against the standard. You do not need to have everything ready. Anything that does not exist yet is simply reflected in your scored results.

A written report with your scored results across every requirement and control, and a prioritised remediation roadmap showing what to fix first.

No. It shows where you stand and what to do next. Certification decisions sit with an independent accredited certification body, and VicByte cannot guarantee a certification outcome.

It is typically 6 to 12 weeks, depending on your starting point. We scope it after your gap assessment, so the plan is based on your real findings.

No. Certification decisions sit with an independent accredited certification body, as they should. We prepare you to go into your audit ready.

ISO 27001 Clause 9.2 requires internal audits of your ISMS, and certification bodies expect to see one before your Stage 2 audit. Ours is independent: the auditor had no role in your implementation, so findings and nonconformities surface before your certification body finds them.

Yes. Once you have paid in full, you own the deliverables produced specifically for your engagement, such as policies, procedures, risk registers and reports. VicByte keeps ownership of its methodologies, templates and know-how.

Penetration testing is an authorised, simulated attack on your applications and infrastructure that shows what an attacker would find before one does. AI red teaming does the same for AI systems, covering areas such as prompt injection, jailbreaks and data exfiltration.

Scope, deliverables, timelines and fees are defined in a written agreement before any testing begins. Book a free call and we will talk through what you want tested.

Dates and pricing are not announced yet. The courses are coming soon, and anyone who registers interest hears first when they open.

The AI Red Teaming course is for pentesters, red teamers, application security and product security engineers, SOC and threat hunting teams, AI and ML teams, and security consultants. The ISO 27001 Lead Auditor course is for people who want to run audits, not just pass one.

No. Your results appear instantly with no email required. The only optional step is asking us to email you a copy of a result.

The tools calculate your results in your browser, and your answers are not stored by us unless you choose to email yourself a result.

No. It is a self-assessment for guidance only. For a full scored review against all 93 Annex A controls, you would book a gap assessment.