When working in certain industries like Defence, Finance, and Governments, there’s often rules that your business must adhere to in order to be considered for contacts. These compliance rules are generally more difficult to achieve the higher the sensitivity of the work being sought.

Using Australia as an example, for a business to be considered for contracts with defence, they are expected to be audited to a set of standards. Australia uses the Essential 8 as a capability maturity model and framework. Other countries have similar CMMs and frameworks. Regardless of the country, the industry, the CMMs and the frameworks, the point is always the same, meet these requirements and we’ll considering work with you. Sway from them and we may not work with you.

Our tools are focused on simplifying the path to compliance. We want your journey to be as painless as possible. We aim to make the tools simple and quick to install and to maintain, and with a licensing model that makes sense.

We don’t suggest for a moment that our tools (by themselves) will make your organisation compliant, just that they will contribute to the effort in a significant and meaningful way, and without the complexity and pain that you’d otherwise experience.

We know the path to compliance can include some significant hurdles. We’ve been there and understand.  We know there’s a better way, and that’s our inspiration.

• Australian Cyber Security Centre (ACSC) Essential Eight: The Essential Eight recommends application whitelisting as one of its top strategies for mitigating cybersecurity incidents. It specifies whitelisting of applications for all servers and workstations to prevent the execution of unauthorized software, which reduces the risk of malware attacks.
• NIST Cybersecurity Framework (CSF): Promote practices like application whitelisting under its Protect function. NIST Special Publication 800-167, Guide to Application Whitelisting, offers detailed guidance on implementing whitelisting as a preventive control.
• Centre for Internet Security (CIS) Controls: Application whitelisting is highly recommended to restrict unauthorized applications from running. This helps reduce the attack surface by allowing only vetted applications to operate on the network.
• ISO/IEC 27001: While ISO 27001 emphasizes access control and malware protection as part of its Annex A controls. Whitelisting applications can be a way to fulfill these controls, especially when combined with other access restrictions and malware defences.
• Federal Information Security Modernization Act (FISMA): FISMA requires U.S. federal agencies to implement stringent cybersecurity measures. Application whitelisting is often part of the compliance requirements for federal agencies to prevent unauthorized applications and reduce malware risks.
• Payment Card Industry Data Security Standard (PCI DSS): PCI DSS requires measures to restrict access to only trusted applications.

• Australian Cyber Security Centre (ACSC) Essential Eight: Part of the Essential Eight framework focuses on limiting administrative privileges and restricting internet access for accounts with administrative permissions. This is to prevent attackers from using admin accounts to download malware or communicate with command-and-control servers.
• NIST Cybersecurity Framework (CSF): NIST Special Publication 800-53 (Security and Privacy Controls for Information Systems and Organizations), which supports NIST CSF, includes controls on restricting internet access for privileged users. Control AC-6 (Least Privilege) and SC-7 (Boundary Protection) guide organizations to restrict high-privilege accounts from accessing unnecessary external services.
• Centre for Internet Security (CIS) Controls: CIS Control 4, “Controlled Use of Administrative Privileges,” recommends that administrative accounts be restricted from using internet services that are not essential for their function. The principle is to limit admin accounts to only necessary tasks and avoid web access that may introduce risks.
• ISO/IEC 27001: While ISO/IEC 27001 does not explicitly mandate internet access restrictions, its focus on access control and secure configurations under Annex A can be applied to restrict internet access for administrative accounts. Organizations following ISO 27001 often include administrative internet restrictions in their security policies to comply with these access and security requirements.
• Payment Card Industry Data Security Standard (PCI DSS): PCI DSS mandates that organizations with payment card data environments limit administrative privileges and monitor internet use for accounts with elevated access. While not explicit about restricting internet access entirely, PCI DSS does require strict access controls for administrative accounts, which can include blocking external connections to reduce risk exposure.
• Federal Information Security Management Act (FISMA): For U.S. federal agencies, FISMA compliance often involves aligning with NIST 800-53 controls, which as noted above, supports limiting internet access for administrative accounts to prevent the misuse of high-level privileges.