Frameworks we support

No. Constant is a compliance management platform that helps you organise evidence, track capability, and prepare for assurance. APRA assesses regulated entities directly; Constant supports your internal program and assessor-led reviews.

CPS 234 applies to APRA-regulated entities including authorised deposit-taking institutions, general insurers, life insurers, and registrable superannuation entity licensees. Your obligations depend on your APRA prudential framework.

Dashboards and exports summarise control status, open gaps, and remediation progress so risk committees and boards receive a consistent view of information security capability.

Yes. Many customers use Constant for CPS 234 alongside Essential Eight, ISO 27001 readiness, or internal risk programs within the same tenant structure.

Essential Eight compliance software helps organisations track their maturity against the Australian Cyber Security Centre Essential Eight mitigation strategies. It centralises evidence, maps controls to maturity levels, and supports audit readiness between formal assessments.

Constant tracks your position across all eight strategies at Maturity Level 1, 2, and 3. The platform surfaces gaps, assigns remediation tasks, and records evidence so assessors can validate your real maturity position - not just documentation.

Yes. Constant is designed, owned, and operated in Australia with onshore data residency. This matters for DISP onboarding, government tenders, and any customer who needs a clear answer about where compliance evidence is stored and who can access it.

Many customers use Constant alongside certified assessor reviews. The platform provides ongoing visibility between audits; assessors validate outcomes and provide independent judgement that automated tools alone cannot replace.

General compliance tools are not built around the ACSC Essential Eight maturity model. Constant is purpose-built for Australian Essential Eight tracking, evidence collection, and assessor-led validation.

Yes. MSP partners use Constant to scale Essential Eight assessments across client portfolios with consistent methodology, centralised reporting, and independent maturity tracking.

No. Certification is issued by accredited certification bodies. Constant helps you organise your ISMS, evidence, and gap remediation to prepare for certification audits.

Yes. Assessments are structured around Annex A control themes so you can track implementation status and evidence for each control area.

Constant links controls, evidence, remediation tasks, and assessor findings in one workflow - not just file storage. You see posture at a glance rather than hunting through folders.

Yes. Many Australian organisations run Essential Eight and ISO 27001 programs together. Constant supports multiple frameworks in one tenant.

NIST CSF is voluntary for most Australian organisations but widely used as a common language for cybersecurity programs, customer assessments, and international alignment.

Assessments are organised by CSF functions and categories. Controls, evidence, and remediation tasks roll up to function-level dashboards for reporting.

Yes. Track assessment versions and remediation progress so you can demonstrate improvement between review cycles.

You can scope assessments to the outcomes your organisation prioritises, aligning with profile-based implementation of the framework.

NIST CSF 2.0 is a broad outcomes-based framework covering governance through recovery. Essential Eight is a specific Australian mitigation and maturity model. Organisations can use both, with NIST CSF providing the broader program view and Essential Eight providing detailed maturity requirements for eight mitigation strategies.

No. SOC 2 reports are issued by independent audit firms. Constant helps you organise controls and evidence to prepare for SOC 2 audits.

Yes. Use readiness assessments for Type I design review, then maintain recurring evidence and control monitoring for Type II observation periods.

You can scope assessments to the criteria in your audit scope - commonly Security, and optionally Availability, Processing Integrity, Confidentiality, and Privacy.

Many Australian SaaS and technology companies pursue SOC 2 to meet enterprise customer and international market expectations, even when headquartered in Australia.

SOC 2 is an independent attestation report against scoped Trust Services Criteria for a service organisation. ISO 27001 is certification of an information security management system by an accredited certification body. Australian SaaS companies may pursue either or both depending on customer and market requirements.

The 5×5 Risk Matrix is included with every Constant plan. It sits with Essential Eight, ISO 27001, CPS 234, and the other frameworks so control gaps can be connected to business risk.

Assessments use structured scoring criteria so ratings stay consistent. Your organisation defines the scales and risk appetite that drive matrix placement.

Constant structures assessment and tracking workflows. Risk identification still requires your team judgement; the platform makes scoring, treatment, and reporting consistent.

Yes. Generate summaries of top risks, treatments, and residual positions for risk committee and board reporting.

Set a recurring review cadence and reassess when material systems, threats, controls, suppliers, or business impacts change. The appropriate frequency depends on the organisation and risk, so the platform records the chosen cadence rather than prescribing one universal interval.