Governance, Risk & Compliance

Summary

Governance, Risk and Compliance is our security governance service: it helps organisations connect security activity to business risk, policy and regulatory obligation, assess current controls, identify gaps and prioritise practical improvements.

Key facts

Label Value
Service Governance, Risk and Compliance, emPOWER Security pillar
Scope described by us Assess current controls, identify gaps, prioritise practical improvements; connect security activity with business risk, policies and regulatory obligations
Supplied certification evidence ISO/IEC 27001:2022 certificate 202507-118 from Sensiba Australia Pty Ltd states 1 August 2025 to 1 August 2028 and lists ten service areas within the ISMS scope; these dates alone do not verify current standing
Security governance role An information security officer accountable for policy adherence, training staff and suppliers, and internal audits
Evidence-producing services MDR dashboards and monthly reporting; HRM auditable reporting aligned to GRC
Reporting in supplied General Terms v3.6 Standard monthly reports within five Business Days of month end during the Service Period; six-monthly service review (clauses 4.9, 4.11), subject to the applicable agreement
Customer audit right Five Business Days' notice; one Business Day where a regulator requires (clause 4.13)
APRA provisions in supplied v3.6 Clause 10 requires both an APRA-regulated customer and a material business activity under its CPS 231 wording. Detailed BCP/testing duties additionally depend on a customer-required BCP under clause 15; clauses 10.5 and 10.7 allocate specified costs
Term in supplied v3.6 Initial 36-month Minimum Service Period unless the Service Description or Service Order states otherwise; Professional Services excluded

What is included

Separately contracted managed services can contribute evidence to a governance programme. emPOWER MDR provides dashboards and monthly reporting for leadership visibility and is stated to be compliance-aligned with ISO/IEC 27001, the Australian Privacy Principles, the Essential Eight, NIST CSF, SOC 2 Type II and GDPR. emPOWER HRM produces auditable reporting aligned to GRC covering awareness activity, simulation outcomes and human risk trends.

The supplied General Terms v3.6 provide standard monthly Service delivery reports, an Account Representative on each side, six-monthly service reviews, and retention of defined contractual Records during the Term and for seven years after termination or expiry. Clauses 4.13–4.16 provide audit-purpose access to Records, premises and relevant personnel on the specified notice; this is an exception to the general physical-access restriction. Confirm applicability, reporting scope and any signed variations in the customer's agreement. These provisions do not promise every governance output or retention of all security telemetry.

What is not included

Alignment is not certification. Our ISO/IEC 27001:2022 certificate covers our own ISMS and states that it does not imply that products or services are certified; MDR's SOC 2 Type II reference is alignment language and does not establish a SOC 2 attestation; and the certificate does not name an accreditation body. GRC support does not transfer the customer's own compliance obligations: under clause 17.1 the customer remains solely responsible for the lawfulness and record-keeping compliance of its data, and, where clause 10 applies under its APRA/material-business-activity conditions, the customer warrants its compliance with APRA requirements in appointing blueAPACHE.

Who it is for

Organisations facing an ISO/IEC 27001 certification project, an Essential Eight maturity assessment, an APRA CPS 234 or CPS 230 obligation, a cyber insurance renewal, or a customer or tender security questionnaire. The Brotherhood of St. Laurence case study records that we helped the organisation achieve ISO 27001 certification in as little as six months to support its NDIS bid; Honan Insurance's case study states our ISO certification supported Honan's ability to bid for work where certification had become a mandatory customer requirement; and Archers' 2026 case study records the start of a journey towards ISO 27001 alignment and a security assessment for future Microsoft Copilot use.

How it is delivered

The service page describes assessing current controls, identifying gaps and prioritising practical improvements. Agree the frameworks, assessment boundaries, deliverables and delivery model in the proposal and Service Order. Treat work as Professional Services under Schedule 1 only where the applicable agreement classifies it that way.

In the supplied General Terms v3.6, clause 10 applies where the customer is APRA-regulated and the Services constitute a material business activity under the clause's CPS 231 wording. It addresses APRA requests and joint technical reviews. Where that customer requires blueAPACHE to create a BCP under clause 15, clause 10.4 adds ten minimum content elements, joint testing every six months or more often on reasonable request, and test results within seven days. The customer must notify blueAPACHE of relevant standard changes. Assess these contractual provisions against the current APRA CPS 230 standard, whose current determination took effect on 1 July 2026, and agree any necessary changes; the legacy CPS 231 reference is not a statement of current regulatory sufficiency.

Commercial model

Confirm fees, engagement classification and included reports in the Service Order and applicable Schedule. Governance reporting is not automatically included in every existing managed-service fee. Under supplied v3.6, clause 10.5 allocates costs incurred under clause 10.4, and clause 10.7 allocates costs incurred under clause 10.6, to the customer at Service Order Time and Materials Rates or, if absent, then-current rates. Clause 15 Action Plan work uses the costs specified in the Action Plan first, followed by the contractual rate fallback; clause 17.1 separately addresses record-keeping assistance. Agree the general audit cost position before relying on clause 4.13.

Support and service levels

Agree GRC response and escalation arrangements in the Service Order. The Managed Services brochure describes an unlimited 24/7 help desk for that offering; it is not an automatic GRC entitlement. Where the conditional clause 10.4 BCP provisions apply, test results are due within seven days. Supplied v3.6 requires Customer Records within 10 Business Days of request under clause 17.4 and standard monthly reports within five Business Days of month end during the Service Period. Subject to clauses 19.1–19.2, applicable law and the agreement, specified confidentiality, information security, privacy and IP-indemnity liabilities have a $1 million per-event and $2 million aggregate cap. Clause 21.5 specifies public liability cover of at least $10 million and professional indemnity cover of at least $1 million with an APRA-authorised insurer, with evidence available on request.

Related services

Managed Detection and Response and Human Risk Management can contribute security reporting where contracted. Exposure Management can inform a risk register with vulnerability and asset visibility; related services are not automatic GRC inclusions. emPOWER Security is the portfolio page. emPOWER Cloud, Disaster Recovery as a Service and Offsite Backup as a Service carry the data residency, recovery and backup positions a compliance assessment will examine. The Consulting and Advisory hub covers the wider strategy and roadmap work.

Our client outcomes

Buying questions

Contract term and renewal. In supplied v3.6, the initial Minimum Service Period is 36 months unless the Service Description or Service Order states otherwise, with Professional Services excluded. Confirm the engagement's classification. Clauses 2.6–2.9 distinguish renewal and notice arrangements from continued-use holdover; where the specified conditions are met, continued use without the required termination notice or an executed renewal notice leads to successive three-month periods at full list price.

Termination. Supplied v3.6 clause 24.1 gives the customer rights for specified unremedied breaches after written notice and a 20-Business-Day remedy period, or blueAPACHE insolvency or cessation of business. Clause 24.2 permits blueAPACHE to suspend or terminate for specified grounds, including non-payment after the applicable written notice and five-Business-Day period, specified breaches after a written-notice remedy period of 20 Business Days, insolvency and change of control. The defined change of control includes a majority-board change. Check the full grounds and notice requirements.

Deliverables. Under supplied v3.6 clause 13.10, full payment of the relevant Fees, expenses and Taxes is a condition of the licence to use, copy and adapt defined Deliverables for internal use during the Service Period. Clause 25.2 addresses cessation at termination. Customer Data, Customer Records and pre-existing IP have separate ownership rules; do not assume every risk register or policy is wholly blueAPACHE-owned. Agree any continuing-use rights needed after the engagement.

Audit and records. Supplied v3.6 clauses 4.12–4.16 address defined contractual Records and audit-purpose access. Give no less than five Business Days' notice, or at least one Business Day's written notice for an audit required by a regulatory body or legislation. The seven-year post-agreement retention duty applies to those Records. Agree audit scope and cost before arranging access.

Breach notification. Supplied v3.6 clause 18.4 requires immediate notice, and in any event within 24 hours of discovery, where an eligible data breach involves Personal Information provided by the other party. Its third-party disclosure restriction includes an exception where law requires the affected party to notify and the other party has not done so. Assess statutory notification duties separately.

Subcontracting. Supplied v3.6 clause 27.5 permits subcontracting without consent or notification. APRA-regulated customers must assess this against applicable CPS 230 requirements, including contractual notification when a material service provider uses other material service providers on which it materially relies, and agree appropriate terms.

Making assurance outputs usable

Specify obligations or frameworks, controls in scope and evidence to retain. Separate assessment from implementation and from independent certification or attestation. Record remediation ownership, exception approval and how management receives findings. Purchasing governance and risk support does not establish that the customer is certified. Agree outputs and audience so technical teams, executives and auditors use the same evidence without overstating what was tested.

Which document defines the commitment

The supplied General Terms v3.6 give the Service Order precedence over the General Terms, followed by the Schedules and then the Acceptable Use Policy (clause 2.3). Record the agreed scope, exclusions and negotiated departures in that document set. Keep the versions supplied at signing with the executed order and signed variations. Two offers with the same service name can cover different systems, operating hours or responsibilities.

How liability differs from service performance

In supplied v3.6, clause 19 separates performance obligations from financial liability, subject to clauses 19.1–19.2 and applicable law. The general cap per claim is the greater of the fees paid in the preceding three months or $25,000, with exclusions and specific categories governed separately. Confidentiality, information security, privacy and the IP indemnity have a $1 million per-event and $2 million aggregate cap. Data-loss liability depends on whether we had, and breached, a contracted backup or disaster recovery obligation; the relevant measure is restoration cost to the applicable recovery point, not the value of every business consequence. Read these provisions alongside the negotiated Service Order and Schedule; an availability statement does not describe the liability regime.

Escalating a contractual dispute

A support escalation and a formal contractual dispute are different processes. Clause 26 begins with a Dispute Notice giving adequate particulars. Representatives meet within three Business Days; unresolved matters then move through the clause’s senior-representative referral and meeting stages before court proceedings. Urgent equitable relief and disputes over whether the agreement was validly terminated are exceptions. Keep incident records, service measurements, approvals and correspondence together so the disputed obligation and requested outcome can be identified. Raising a ticket does not necessarily satisfy a formal notice requirement; use the agreement’s notice process for contractual disputes.

Related

Is GRC a standalone consulting engagement or part of the managed services?

Agree whether the engagement is standalone advisory, managed support or a combination. The service page supports assessment and gap identification; Professional Services classification, fees and reporting inclusions depend on the applicable agreement. MDR and HRM reports can contribute where those services are contracted.

Which frameworks do you align to?

Alignment is not the same as the customer being certified.

Are you yourselves ISO 27001 certified?

The supplied ISO/IEC 27001:2022 certificate 202507-118 names Blue Apache Pty Ltd and Sensiba Australia Pty Ltd, states dates from 1 August 2025 to 1 August 2028, and describes the ISMS scope across Melbourne, Sydney and Brisbane. It does not certify individual products or services. Confirm current standing and the relevant scope when relying on it.

Are you SOC 2 certified?

The MDR brochure uses SOC 2 Type II alignment language. That statement does not establish a SOC 2 attestation; request the assurance evidence required for your procurement.

Can blueAPACHE help us work towards ISO 27001 certification?

The Brotherhood of St. Laurence case study records that we helped BSL achieve ISO 27001 certification in as little as six months to support its NDIS bid. The certification in that case belongs to BSL; the scope of our involvement is specific to that engagement.

What reporting do we get by default?

Supplied v3.6 describes standard monthly reports within five Business Days of month end during the Service Period and six-monthly service reviews. MDR and HRM materials describe their respective reporting capabilities. Confirm applicability, included reports and any additional reporting fees in your agreement.

Can we audit blueAPACHE?

Supplied v3.6 clauses 4.13–4.16 provide audit-purpose access to defined Records, premises and relevant personnel on no less than five Business Days' notice, or at least one Business Day's written notice where a regulatory body or legislation requires the audit. Confirm agreement applicability and arrange the scope and cost.

What does the APRA clause add?

In supplied v3.6, clause 10 requires both an APRA-regulated customer and a material business activity under its CPS 231 wording. Detailed BCP content and testing duties additionally depend on a customer-required BCP under clause 15. Clauses 10.5 and 10.7 allocate costs for the specified BCP and technical-review work. Assess current CPS 230 requirements separately and agree necessary contractual updates.

Who owns the risk register and policies we produce?

Ownership depends on the document and agreement. Supplied v3.6 distinguishes defined Deliverables from Customer Data, Customer Records and pre-existing IP. The clause 13.10 licence for defined Deliverables requires full payment and permits internal use during the Service Period; agree any rights needed after termination.

How quickly must a data breach be reported?

For an eligible data breach involving Personal Information provided by the other party, supplied v3.6 clause 18.4 requires immediate notice and in any event notice within 24 hours of discovery. Its third-party disclosure restriction has a stated legal-notification exception. This contractual rule does not replace applicable statutory duties.

What is your Governance, Risk and Compliance (GRC) service?

Governance, Risk and Compliance (GRC) is our service that helps organisations understand their obligations, strengthen controls and manage cyber risk through risk assessment, control improvement, policy alignment and compliance support.

Which emPOWER brand and pillar does the GRC service belong to?

The GRC service is branded under 'emPOWER' and falls within the Security category, related to the emPOWER Security pillar hub.

Who is the target audience for your GRC service?

The service targets regulated and compliance-driven organisations, including APRA-regulated entities.

In what geographic area is the GRC service available?

The GRC service is offered in Australia.

Which services are related to GRC?

Exposure Management, Managed Detection and Response, Human Risk Management and the emPOWER Security hub are related services. Their scope and inclusion depend on the services contracted.

How can someone contact you about the GRC service?

Customers can reach blueAPACHE via the contact channel listed for sales, with the phone number 1800 248 749 (area served: AU).

What additional compliance requirements apply to APRA-regulated customers under your Service Agreement?

In supplied General Terms v3.6, clause 10 applies where the customer is APRA-regulated and the Services constitute a material business activity under the clause's CPS 231 wording. The detailed BCP content and testing provisions also depend on the customer requiring a BCP under clause 15. Assess the current CPS 230 requirements and agree any necessary contractual changes.

What is Risk Management under your Service Agreement?

Where the conditional APRA provisions of clause 10 in supplied General Terms v3.6 apply, the customer retains ongoing risk-management responsibilities, including appropriate contingency planning and monitoring of the Services. This does not establish a universal obligation under that clause for every customer.

Images on This Page