Book a vCISO annual plan before Christmas and get GRC platform for FREE. Claim the offer
Expert insights, guides, and updates on cybersecurity compliance and best practices.
What is the CyberNinja knowledge base?
The CyberNinja knowledge base is a free library of practical articles and framework guides on cybersecurity compliance, covering ISO 27001, ISO 42001, SOC 2, PCI DSS, HIPAA, IRAP, Essential 8 and NIST CSF. Each guide explains what the standard requires, who needs it, and how to achieve it, written in plain language for Australian and New Zealand businesses.
A control-by-control guide to moving from Essential Eight Maturity Level 1 to Level 2, what it genuinely costs, and why the Essentials series announcement is not a reason to stop.
51 future-dated PCI DSS v4.x requirements became mandatory on 31 March 2025. Here is what they ask for, where Australian merchants get caught, and how PCI sits with the Privacy Act.
New APP 1.7 to 1.9 obligations start 10 December 2026. If software helps make decisions about people, your privacy policy must say so.
A working ISO 27001 internal audit checklist that covers your whole ISMS before the certification audit, so nothing surprises you on the day.
Your ISO 27001 Statement of Applicability must judge all 93 Annex A controls. How to decide what applies to you and justify every exclusion.
ISO 27001 clause 5.3 wants a named owner on every Annex A control that you apply. How to assign roles your auditor accepts the first time.
The Cyber Security Act 2024 introduced mandatory ransomware payment reporting, smart device standards and new incident review powers.
A plain-English guide to the Essential Eight maturity levels, which controls to prioritise first, and realistic costs for small business.
The ISO 27001 2013 to 2022 transition closed on 31 October 2025 and every 2013 certificate has expired. What to do now if yours lapsed.
Already hold ISO 27001? You're closer to ISO 42001 than you think. How the two standards compare, where they overlap, and which you need.
AI is transforming penetration testing on both sides: how attackers exploit vulnerabilities and how testers find them.
What the ISO 27001 certification cost covers in Australia in 2026, from gap analysis to surveillance audits, so you can budget with confidence.
SOC 2, ISO 27001, or both? The answer depends on where your customers are and what assurance they ask for. Here's how to decide.
Your IRAP questions answered: gap assessments, remediation, documentation and assessor coordination, and what readiness looks like.
Companies with diverse leadership teams see stronger financial returns. In cybersecurity, diversity is a strategic imperative. Here's why.
ISO 42001 is more than a certification: it's a commitment to ethical, responsible AI. What the standard requires and how to implement it.
As businesses move to the cloud, protecting personal data is critical. ISO 27018 gives you a privacy framework for public clouds.
A vCISO gives you seasoned cybersecurity leadership without the cost of a full-time CISO. How it pays off for startups and small businesses.
ISO 27001 audit preparation from the consultant's side of the table. What to gather, what to rehearse and what your auditor asks you first.
Internal audits are one of the most effective ways to assess your organisation's cybersecurity posture. Here's why regular audits matter.
ISO 27001 implementation done properly, by a consultant who cleans up the failures. The practices that work and the pitfalls that cost you.
Your ISO 27001 certification body shapes the next three years of audits. The accreditation, scope and cost questions to ask before you sign.
What the ISO 27001 2022 requirements ask of you, whether you are certifying for the first time or renewing. Controls, evidence and timing.
ISO 27001 clause 4.4 is where your ISMS stops being a folder of policies. How to establish, implement, maintain and improve it with proof.
Your ISO 27001 risk assessment lives or dies in the review minutes. How to run the meeting, who to invite and what to record as evidence.
ISO 27001 clause 4.1 wants the internal and external issues shaping your ISMS. Here is the context overview auditors accept, on one page.
ISO 27001 clause 7.4 asks what your ISMS communicates, when, to whom and how. Build the plan and the evidence trail auditors ask you for.
ISO 27001 clause 4.3 sets your ISMS boundaries, and a loose scope costs you at stage 1. How to define, document and approve yours properly.