Compliance
Show the auditor where the data is, and what you did about it
Most frameworks start with the same questions. What sensitive information do you hold? Where is it? Who can reach it, and how is it protected? Ligurian is built to help you answer them for every customer, with evidence.
Privacy Act 1988 and the Notifiable Data Breaches scheme
First release
What it asks
Take reasonable steps to protect the personal information you hold (APP 11). When a breach is suspected, assess it within 30 days and notify affected people and the OAIC if it's likely to cause serious harm.
How Ligurian helps
- A register of the personal information each customer holds and where it sits
- Breach scoping: pick a mailbox, site or user and a time window, and see what personal information was involved
- Less to report in the first place, because sensitive data is coached or stopped on its way out
ISO/IEC 27001:2022
First release, with evidence packs later
What it asks
Annex A expects an inventory of information (5.9), classification (5.12) and labelling (5.13), protection of personal information (5.34) and data leakage prevention (8.12), with evidence that the controls operate.
How Ligurian helps
- Classification and labels applied consistently across files, mail, laptops and AI tools
- Data leakage prevention with coaching, blocking and a record of every decision
- An audit trail of what was found, who was told and what was fixed
- Evidence packs mapped to Annex A controls, to follow
APRA CPS 234
First release, with evidence packs later
What it asks
Classify information assets by criticality and sensitivity, including those managed by third parties, and notify APRA of material information security incidents within 72 hours of becoming aware of them.
How Ligurian helps
- Sensitivity classification across Microsoft 365, laptops and cloud storage
- Breach scoping that tells you quickly what sensitive data an incident touched, with the 72-hour clock in view
- Evidence packs for CPS 234, to follow
ASD Essential Eight
Alongside your Essential Eight program
What it asks
Eight baseline mitigation strategies, from patching and multi-factor authentication to restricting administrative privileges and backups, assessed against a maturity model.
How Ligurian helps
- The Essential Eight hardens systems against attack. It doesn't cover knowing where sensitive data is or stopping it leaking, and Ligurian sits alongside it to cover that
- Visibility of which apps, service accounts and agents hold access to sensitive data, to support restricting privileges
- Ligurian isn't an Essential Eight control and won't move your maturity level on its own
PCI DSS
First release
What it asks
Protect stored cardholder data and keep it inside a defined, controlled environment.
How Ligurian helps
- Find card numbers that have strayed outside where they belong: spreadsheets, mailboxes, shared folders and chats
- Stop card numbers being pasted or uploaded where they shouldn't go
Health information
First release
What it asks
Health information is sensitive information under the Privacy Act, with stricter expectations on how it's handled and shared.
How Ligurian helps
- Recognises health information alongside other personal and sensitive information
- The same register, coaching and breach scoping, applied to health records
Ligurian helps you produce evidence and reduce risk. It doesn't make an organisation compliant on its own, and it isn't a certification. Your auditor or assessor decides what counts.
Be first in the hive
We're building Ligurian with a small group of MSPs.