The EDGE Framework
The same four-stage framework for every sector, built to hold up under audit.
Click a stage to see it mapped by sector
Evidence Mapping
A scored gap assessment against your standard - not a checklist.
Design for Compliance
Workflows designed against controls, not retrofitted after a finding.
Governed Automation
Explainable, authorised, disclosure-ready by default.
Execution & Assurance
Evidence and monitoring stay current as cycles change.
The same framework, different deliverables
EDGE is one consistent method - not identical work. Click a stage above, or scroll - the row you're reading stays highlighted.
| Stage | Shared principle | Cyber deliverable | RTO deliverable | Human review | Customer outcome |
|---|---|---|---|---|---|
| E - Evidence Mapping | Evidence mapped to your standard | Essential Eight control-to-evidence map | Evidence inventory vs. 2025 Standards | Reviewer confirms scope | A scored, defensible position |
| D - Design for Compliance | Evidence capture built into workflows | Control uplift + pen-test remediation | Built into enrolment-to-completion flow | Human checkpoints flagged pre-launch | Proof, not a scramble |
| G - Governed Automation | Every decision stays explainable | Authorised, logged, audit-trailed testing | Privacy + assessment-integrity safeguards | Person authorises every AI decision | Reduces audit risk |
| E - Execution & Assurance | Evidence stays current, always | Continuous monitoring + remediation tracking | Currency monitoring + self-assurance cycle | Scheduled review before each cycle | Always ready, not ready once |
The standards and testing scope live on each programme page
The frameworks, deliverables, and testing scope differ by sector. See the specific programme page for detail.
What Execution & Assurance actually hands you
A branded audit report
An executive dashboard, maturity gauge, framework-by-framework bars, gap donut, and remediation roadmap - not a raw findings dump.
Clear scope and assurance boundaries
A Passive Assessment Agreement upfront, and a Rules of Engagement before any active testing runs - auto-generated, not an afterthought.
Evidence kept current
CISA KEV, CVE/EPSS, MITRE ATT&CK/ATLAS and ACSC advisories for cyber clients; ASQA Standards and regulatory updates for RTOs - so your maturity claim doesn't quietly go stale.
From diagnostic to ongoing assurance
Regulatory Risk Diagnostic
A short, no-obligation call to confirm the standard governing you and where a sprint would focus.
Evidence & Automation Sprint
A fixed-scope, typically 4–6 week engagement covering Evidence Mapping through Governed Automation.
Assurance Retainer
An optional ongoing service that keeps Execution & Assurance running between audit cycles.