Checking authentication…

Need a Compliance Readiness Check?
Trust Delphitek.


Know where you stand on cyber security and compliance, and prove it. Automated, evidence-based readiness assessments across 40+ frameworks, with the Essential Eight and ASD Essentials included in every plan. For MSPs, IT Providers and Small Businesses.
If you care about security as much as we do, let's talk.

Request a Demo Talk to us
✓
Australian Compliance Essential Eight, ASD Essentials, APRA CPS 230, APRA CPS 234, SMB1001, SOCI Act, IRAP
✓
Cyber Security ISO/IEC 27001, NIST CSF 2.0, CIS Controls v8.1, NIST 800-53
✓
Compliance Standards SOC 1 Type II, SOC 2 Type II, PCI DSS v4.0.1, HIPAA
✓
Cloud & Government FedRAMP, CMMC 2.0, NIST SP 800-171
✓
Privacy & Data GDPR, Privacy Act, ISO 27701, ISO/IEC 27018
✓
Business Continuity ISO 22301, DORA, NIS2
✓
Management Systems ISO/IEC 42001, ISO 9001, ISO/IEC 20000-1
And more ...
See it in 30 seconds
Who It's For

Built for MSPs, IT providers and (Small) Businesses.

For MSPs and IT Providers
  • Manage one or multiple client tenants from one platform
  • Unlimited assessments, scheduled or on demand
  • Reports your clients understand, with prioritised fixes
  • Turn compliance readiness into a recurring service
Request a Demo Talk to us
For (Small) Businesses
  • Know where you stand against the Essential Eight and ASD Essentials
  • Read-only: we never change your settings
  • Plain-English reports, with what to fix first
  • Be ready when customers, tenders or insurers ask
Get in touch
Compliance Framework Library

40+ Frameworks. Single or Multi-tenant. One Platform.

Compliance frameworks your business needs.
Essential Eight and the three ASD Essentials frameworks are included in all platform tiers per tenant. Additional frameworks unlock via add-on purchase, applied at tenant level.
Included With Every Subscription — Tiers: Basic | Pro | Premium | Enterprise
ASD Essential Eight
ASD's Essential Eight maturity model (November 2023), the current Australian Government baseline. Maturity Level 0–3 scoring across all 8 mitigation strategies, automated from your tenant environment, plus a free ASD Essentials transition readiness report.
✓ Included in all tiers
8 strategies
3 maturity levels
ASD Essentials for Cloud
The cloud chapter for organisations running on Microsoft 365 and other cloud services, reported by ASD's domains and priority phases.
✓ Included in all tiers
8 domains
3 priority phases
ASD Essentials for Enterprise IT
The ASD Essentials chapter that succeeds the Essential Eight for organisations running their own infrastructure, with ASD's own action IDs, reported by domain and priority phase.
✓ Included in all tiers
8 domains
3 priority phases
ASD Essentials for Operational Technology
The ASD Essentials chapter for industrial control and safety systems, for critical infrastructure owners and operators.
✓ Included in all tiers
8 domains
3 priority phases
Add-ons

Access more frameworks.

Expand your compliance readiness posture.
Each individual or bundled add-on purchase unlocks new framework scan engines, control mappings and report suites.
APRA CPS 230
Australian Prudential Regulation Authority Operational Risk Management standard readiness assessment across 46 substantive paragraphs. For entities that are, or expect to become, APRA-regulated.
Add-on
APRA CPS 234
Australian Prudential Regulation Authority Information Security standard readiness assessment across all 24 substantive paragraphs. For entities that are, or expect to become, APRA-regulated.
Add-on
SOCI Act (CIRMP)
Security of Critical Infrastructure Act 2018 (CIRMP Rules) readiness assessment across 11 sections.
For responsible entities of critical infrastructure assets.
Add-on
Privacy Act Compliance
Australian Privacy Principles (13 APPs) readiness assessment.
Add-on
IRAP Readiness
Curated Australian Government ISM readiness/gap-analysis indicator across 165 controls.

Add-on
Australian Government ISM (full)
Broader Australian Government Information Security Manual readiness assessment across 174 controls, extending IRAP Readiness's curated subset.
Add-on
APRA CPS 220
Australian Prudential Regulation Authority Risk Management standard readiness assessment across 49 assessable items. For entities that are, or expect to become, APRA-regulated.
Add-on
AUSTRAC AML/CTF Program
AUSTRAC Anti-Money Laundering / Counter-Terrorism Financing Program readiness assessment across 41 assessable items spanning risk assessment, policies, governance and customer due diligence.
Add-on
Consumer Data Right (CDR)
Australian Consumer Data Right readiness assessment across all 13 Privacy Safeguards.
Add-on
ISO/IEC 27001:2022
International information security management standard. Annex A technological control evidence, collected automatically from your environment.
Add-on
ISO 22301 (BCMS)
Business Continuity Management System readiness assessment (ISO 22301:2019) across 26 sub-clauses, reusing the same clause-based structure as ISO/IEC 27001.
Add-on
ISO 27701 (PIMS)
Privacy Information Management System readiness assessment, extending ISO/IEC 27001 across 54 controls (Clause 5 + Annex A + Annex B, plus the requirements ISO/IEC 27701:2025 adds). Requires an active ISO 27001 add-on.
Add-on
ISO/IEC 27017
Cloud-specific security controls extending ISO/IEC 27001. Requires an active ISO 27001 add-on.
Add-on
ISO/IEC 27018
Protection of personally identifiable information (PII) in public clouds, extending ISO/IEC 27001. Requires an active ISO 27001 add-on.
Add-on
ISO/IEC 20000-1
IT Service Management System readiness assessment across the 7 management-system clauses.
Add-on
ISO 9001
Quality Management System readiness assessment across all 28 top-level sub-clauses, plus the requirements ISO 9001:2026 adds.
Add-on
ISO/IEC 42001
AI Management System readiness assessment across 9 Annex A control categories. For organisations developing, providing, or using AI systems.
Add-on
SOC 1 Type II
Internal control over financial reporting (ICFR) readiness assessment for service organisations. A readiness indicator only.
Add-on
SOC 2 Type II Readiness
Trust Services Criteria evidence gathering for security, availability, and confidentiality readiness assessments.

Add-on
CIS Controls v8.1
Center for Internet Security critical controls.
Automated evidence collection across Implementation Groups 1–3.
Add-on
NIST CSF 2.0
Automated evidence mapping across Govern, Identify, Protect, Detect, Respond, and Recover functions.

Add-on
CMMC 2.0 Level 1 (Foundational)
Cybersecurity Maturity Model Level 1, built on FAR 52.204-21's basic safeguarding requirements. A readiness indicator only.
Add-on
CMMC 2.0 Level 2
Cybersecurity Maturity Model Level 2, built on NIST SP 800-171 Rev 2's 110 security requirements. A readiness indicator only
Add-on
NIST SP 800-171
NIST Special Publication 800-171 Revision 3 readiness assessment. For organisations holding Controlled Unclassified Information (CUI), not only Defense Industrial Base contractors.
Add-on
NIST 800-53
NIST SP 800-53 full Moderate Impact Baseline readiness assessment across 287 controls.
Add-on
FedRAMP Readiness
NIST 800-53 baseline plus FedRAMP-specific process overlay readiness assessment across 291 controls.
Add-on
CJIS Security Policy
FBI CJIS Security Policy readiness assessment reusing NIST 800-53's structure across 291 controls. Not a CJIS Systems Agency compliance determination.
Add-on
HITRUST CSF
HITRUST Common Security Framework readiness assessment across all 19 domains. Not a real HITRUST e1/i1/r2 certification.
Add-on
GLBA Safeguards Rule
FTC Safeguards Rule (16 CFR Part 314) readiness assessment across all 10 lettered 314.4 elements. For financial institutions under FTC jurisdiction.
Add-on
NYDFS 23 NYCRR 500
New York Department of Financial Services Cybersecurity Requirements readiness assessment across 23 assessed sections. For entities covered by New York DFS regulation.
Add-on
GDPR
EU General Data Protection Regulation readiness assessment across 46 substantive Articles.
Add-on
DORA
EU Digital Operational Resilience Act readiness assessment across 24 entity-facing Articles. For financial entities with EU operations or EU clients.

Add-on
NIS2
EU NIS2 Directive readiness assessment across 13 entity-facing provisions. Assesses the EU-level Directive baseline only.
Add-on
HIPAA Security Rule
HIPAA Security Rule readiness assessment across all 22 standards.
Add-on
UK Cyber Essentials / Cyber Essentials Plus
UK NCSC/IASME Cyber Essentials readiness assessment across all 5 technical control themes. Not a real self-assessment questionnaire grading or Cyber Essentials Plus audit.
Add-on
EU Cyber Resilience Act (CRA)
EU CRA Annex I readiness assessment across 22 essential cybersecurity requirements. A forward-looking indicator only — essential requirements apply from 11 Dec 2027; Article 14 reporting obligations have applied since 11 Sep 2026.
Add-on
Canada PIPEDA
Canada Personal Information Protection and Electronic Documents Act readiness assessment across all 10 Fair Information Principles plus mandatory breach notification.
Add-on
Singapore PDPA / MAS TRM
Singapore Personal Data Protection Act readiness assessment (10 obligations in force) plus a 5-domain Monetary Authority of Singapore Technology Risk Management overlay.
Add-on
PCI DSS v4.0.1
Payment Card Industry Data Security Standard readiness assessment across all 12 official Requirements. A readiness indicator only.
Add-on
SMB1001 (Bronze to Diamond)
DSI SMB1001 readiness across all five tiers — Bronze assessed in full with automated and guided evidence, built for the technical environment most Australian SMBs already run on; Silver and Gold as indicative readiness; Platinum and Diamond as an audit-preparation checklist.
Add-on
Cyber Insurance Readiness
Readiness assessment against commonly-required cyber insurance underwriting controls across 25 items. Not insurance advice — does not guarantee coverage, premium impact, or claim payment.
Add-on
Vendor / Third-Party Risk Assessment
Vendor/supply-chain risk management program readiness assessment across 22 controls. Assesses your own vendor-risk program, not any specific third party.
Add-on
Ransomware Readiness Assessment
Readiness assessment against ransomware-specific prevention and response themes across 22 controls. Not a CISA-endorsed assessment — does not guarantee immunity from a ransomware attack.
Add-on
Unified Compliance Posture

Ongoing Compliance Readiness.
Every Framework.

See managed tenant compliance posture across all active frameworks from a single dashboard: identify gaps, track maturity, get notified of drift detection and prioritise remediation across every standard.
Compliance Readiness Overview
ASD Essential Eight
ML 2
Active
ISO/IEC 27001
74%
Add-on
CIS Controls v8.1
30%
Add-on
SOC 2 Readiness
—
Locked
NIST CSF 2.0
—
Locked
Platform Capabilities

Everything You Need, Built In.

From evidence collection to finished reports, Delphitek handles the whole compliance readiness lifecycle, for every framework.
Multi-Tenant Dashboard
Manage multiple customer tenants from a single MSP portal.
Evidence Collection
Read-only integration with your environment collects evidence.
Various Professional Reports
Reports generated for each framework assessed.
Add-ons
Add frameworks as your service offering grows. Each one unlocks its own assessments and report suite.
How It Works

Four Steps From Tenant to Report.

Compliance readiness, simplified. A repeatable workflow you can run for every tenant and every framework.
1
Add Tenant
2
Select Framework
3
Run Assessment
4
Deliver Reports
Platform Tiers

Plans for MSPs and Businesses.

Ongoing compliance readiness assessments.
Essential Eight and the three ASD Essentials frameworks are included in every plan. Framework add-ons unlock additional compliance frameworks.
Pricing is quoted per tenant, so it fits how you work: an MSP managing many client tenants, or a business with one Microsoft 365 tenant.
(Minimum 12-month commitment)
Basic

Included
✓ Essential Eight
✓ ASD Essentials for Cloud
✓ ASD Essentials for Enterprise IT
✓ ASD Essentials for Operational Technology

Health Check

  • ASD Essential Eight assessment
  • ASD Essentials assessments: enterprise IT, cloud and OT
  • Cloud scan (all 8 controls)
  • Cloud control gap findings
  • Core report suite

  • A cloud-only snapshot


    🎓 Delphitek Academy:
    ✓ Library Access

Enquire Now
Pro

Included
✓ Essential Eight
✓ ASD Essentials for Cloud
✓ ASD Essentials for Enterprise IT
✓ ASD Essentials for Operational Technology

Scaling Compliance Offering

  • Everything in Basic
  • Hybrid scan
    Cloud + Endpoint Agent
  • 3rd party integrations
  • Compliance drift alerts
  • Scan-to-scan comparison



  • 🎓 Delphitek Academy:
    ✓ Library Access
    ✓ Checks & Training Material

Enquire Now
Most Popular
Premium

Included
✓ Essential Eight
✓ ASD Essentials for Cloud
✓ ASD Essentials for Enterprise IT
✓ ASD Essentials for Operational Technology

Full Compliance Readiness Platform

  • Everything in Pro
  • Automated Scheduled Scan(s)
  • Additional reports
  • Remediation guidance
  • Maturity Trend Chart
  • Token-gated report sharing
  • Remediation Summary

  • 🎓 Delphitek Academy:
    ✓ Library Access
    ✓ Checks & Training Material
    ✓ Templates

Enquire Now
Enterprise

Included
✓ Essential Eight
✓ ASD Essentials for Cloud
✓ ASD Essentials for Enterprise IT
✓ ASD Essentials for Operational Technology

Enterprise Compliance Management

  • Everything in Premium
  • Custom branding & White-labelled reports
  • MSP-wide compliance summary
  • Self-service onboarding wizard
  • Engineering Runbook
  • Priority Onboarding


  • 🎓 Delphitek Academy:
    ✓ Library Access
    ✓ Checks & Training Material
    ✓ Templates
    ✓ Upload Custom Material

Enquire Now
Live Regulatory Feed

Stay Ahead of What's Changing

Pulled directly from the authorities behind the frameworks we assess — updated automatically, not curated by us.
ASD's ACSC — Alerts
  • Loading…
CISA — Known Exploited Vulnerabilities
  • Loading…
APRA — Publications
  • Loading…
Security and Data Handling

Your Data, Handled With Care.

This is how we look after your data.
Read-only access
We use read-only permissions. Assessments collect evidence and never change your settings.
Stored in Australia
Customer data is stored in Australia.
Encrypted
Data is encrypted in transit and at rest.
Controlled access
Sign-in, role-based access and audit logging, with network-level restrictions on the systems that hold your data.
Kept separate
Each IT provider's data, and each client's, is kept separate.
Retention you can see
Assessment results are kept for 365 days by default and can be deleted on request. A Data Processing Addendum is available.
More detail: Privacy Policy · Terms · Vulnerability disclosure
FAQ

Common Questions.

Does Delphitek change any of our settings?

No. Assessments are read-only: we collect evidence from your environment and never change your configuration.

What access does Delphitek need?

Read-only consent to your environment, approved by your administrator in a few minutes. On Pro plans and above, an optional endpoint agent adds device checks.

How quickly can we start?

As soon as access is approved. Your first assessment can run the same day, and the reports are ready when it finishes.

Is this a certification or an audit?

No. Delphitek gives you a point-in-time readiness assessment: where you stand, the gaps, and what to fix first. It helps you prepare for an audit or certification.

Does the Essential Eight still matter now that ASD Essentials is out?

Yes. The Essential Eight is still current while ASD manages the transition to ASD Essentials. Both ASD Essential Eight and ASD Essentials are included in every plan, along with a transition report that shows what carries forward.

Do I need an IT provider to use Delphitek?

No. Businesses can work with us directly. If you already have an IT provider, they can run Delphitek for you as a Delphitek partner.

How does pricing work?

Pricing is quoted per tenant, with a 12-month minimum, for MSPs managing client tenants and for businesses with their own tenant. The Essential Eight and ASD Essentials are included in every plan, and other frameworks are available as add-ons. Get in touch for a quote.

Which frameworks do you cover?

More than 40, from the Essential Eight, ASD Essentials and SMB1001 to ISO/IEC 27001, NIST CSF 2.0, SOC 2 and PCI DSS v4.0.1.
See the full list.

About Delphitek

Australian-built Compliance Readiness.

Delphitek helps businesses, and the IT providers who look after them, know where they stand on cyber security and compliance, and verify and prove it.
Delphitek is a trading name of
Base 60 Capital Pty Ltd
ABN 40 681 217 694
Sydney, Australia

Phone: 02 7249 3021
Email: info@delphitek.com
Evidence, not guesswork
Assessments are based on evidence collected from your environment, not just a questionnaire.
Read-only by design
We collect evidence without changing your settings.
Plain English
Reports written for business owners and boards, not just engineers, with what to fix first.
Built for IT providers
One platform for every client tenant, with the Essential Eight and ASD Essentials included in every plan.
Delphitek provides point-in-time compliance readiness assessments, not certifications or audits. The Essential Eight and ASD Essentials are published by the Australian Signals Directorate; Delphitek is not affiliated with or endorsed by ASD.
Contact

Let's talk.

Whether you want to know where your business stands, or you're an IT provider looking at a partnership, get in touch and we'll arrange the next step together.
Businesses
A one-off assessment, or ongoing compliance readiness. Tell us a little about your business and we'll take it from there.
Email us
IT providers and MSPs
Partnering with Delphitek, or seeing the platform with your own clients in mind.
Email us Book a demo
Existing customers
Help with the portal, an assessment or a report.
Email support

Ready to Know Where You Stand?

Book a demo, or get in touch and we'll arrange the next step together.

Request a Demo Talk to us