Cybersecurity, compliance assurance and AI security advisory for Defence, Federal Government and critical infrastructure. ISM, PSPF, NIST SP 800-53, SOCI Act and ISO 42001.https://www.muhammad-anwar.com/https://www.muhammad-anwar.com/blog/iso-27001-internal-audit-guide/https://www.muhammad-anwar.com/blog/iso-27001-internal-audit-guide/How to plan and run an ISO 27001 internal audit: scope, audit programme, clauses 4 to 10, Annex A sampling, grading findings and closing corrective actions.Sun, 11 Oct 2026 00:00:00 GMTISO 27001Internal AuditISMShttps://www.muhammad-anwar.com/blog/cmmc-2-explained/https://www.muhammad-anwar.com/blog/cmmc-2-explained/CMMC 2.0 explained: the three levels, 110 NIST SP 800-171 requirements, SPRS scoring, POA&M rules and what it means for Australian suppliers.Sat, 10 Oct 2026 00:00:00 GMTCMMCNIST SP 800-171Defencehttps://www.muhammad-anwar.com/blog/cyber-security-risk-assessment/https://www.muhammad-anwar.com/blog/cyber-security-risk-assessment/How to conduct a cyber security risk assessment step by step: scope, threats, vulnerabilities, a 5x5 risk matrix, appetite and NIST SP 800-53 treatment.Fri, 09 Oct 2026 00:00:00 GMTCyber Security Risk AssessmentRisk ManagementNIST SP 800-30https://www.muhammad-anwar.com/blog/ism-compliance-guide/https://www.muhammad-anwar.com/blog/ism-compliance-guide/What ISM compliance really means, how the risk-based approach works, and the practical steps to apply the Australian Government Information Security Manual…Thu, 08 Oct 2026 00:00:00 GMTISMGovernment SecurityPSPFhttps://www.muhammad-anwar.com/blog/third-party-risk-management-guide/https://www.muhammad-anwar.com/blog/third-party-risk-management-guide/A practical guide to third-party risk management: tiering vendors, security questionnaires, evidence, scoring, contracts, monitoring and AI questions.Thu, 08 Oct 2026 00:00:00 GMTThird-Party Risk ManagementVendor RiskTPRMhttps://www.muhammad-anwar.com/blog/nist-csf-2-explained/https://www.muhammad-anwar.com/blog/nist-csf-2-explained/NIST CSF 2.0 explained: the new Govern function, all six functions, categories, profiles and tiers, and how Australian organisations can use it with the ISM.Wed, 07 Oct 2026 00:00:00 GMTNIST CSF 2.0NISTCyber Governancehttps://www.muhammad-anwar.com/blog/iso-42001-guide-for-boards/https://www.muhammad-anwar.com/blog/iso-42001-guide-for-boards/AI governance is moving from principles to auditable systems. Here is what ISO 42001 means in practice — and the five questions every Board should be asking…Tue, 06 Oct 2026 00:00:00 GMTISO 42001AI GovernanceBoard Advisoryhttps://www.muhammad-anwar.com/blog/pspf-annual-reporting-guide/https://www.muhammad-anwar.com/blog/pspf-annual-reporting-guide/A practical guide to the PSPF annual self-assessment: how maturity is judged, the evidence that matters, and how to turn PSPF reporting into genuine…Sat, 03 Oct 2026 00:00:00 GMTPSPFGovernment SecurityISMhttps://www.muhammad-anwar.com/blog/nist-800-53-ism-mapping/https://www.muhammad-anwar.com/blog/nist-800-53-ism-mapping/How to map NIST SP 800-53 to the Australian ISM, where the frameworks align and differ, and how a unified control set cuts compliance effort for global and…Tue, 29 Sep 2026 00:00:00 GMTNIST SP 800-53ISMControl Mappinghttps://www.muhammad-anwar.com/blog/system-security-plan-guide/https://www.muhammad-anwar.com/blog/system-security-plan-guide/A practical guide to writing a System Security Plan (SSP): structure, what assessors look for, common mistakes and how the SSP, SRMP and Statement of…Thu, 24 Sep 2026 00:00:00 GMTSystem Security PlanISMIRAPhttps://www.muhammad-anwar.com/blog/essential-eight-age-ai-agents/https://www.muhammad-anwar.com/blog/essential-eight-age-ai-agents/AI agents run code, hold credentials and act on our behalf. Here is how the Essential Eight still applies — and where assessors should be looking harder.Tue, 22 Sep 2026 00:00:00 GMTEssential EightAI SecurityACSChttps://www.muhammad-anwar.com/blog/irap-assessment-readiness/https://www.muhammad-anwar.com/blog/irap-assessment-readiness/Preparing for an IRAP assessment? Ten practical readiness steps — from system boundary and SSP quality to evidence and cloud responsibilities — that save…Thu, 17 Sep 2026 00:00:00 GMTIRAPISMCloud Securityhttps://www.muhammad-anwar.com/blog/soci-act-cirmp-guide/https://www.muhammad-anwar.com/blog/soci-act-cirmp-guide/A practical guide to the SOCI Act Critical Infrastructure Risk Management Program (CIRMP): the four hazard domains, cyber framework alignment, and preparing…Thu, 10 Sep 2026 00:00:00 GMTSOCI ActCIRMPCritical Infrastructurehttps://www.muhammad-anwar.com/blog/ai-supply-chain-risk/https://www.muhammad-anwar.com/blog/ai-supply-chain-risk/Your suppliers are shipping AI features whether you asked for them or not. A practical approach to AI supply chain risk and third-party AI governance for…Tue, 08 Sep 2026 00:00:00 GMTThird-Party RiskAI SecuritySOCI Acthttps://www.muhammad-anwar.com/blog/ai-security-risks-for-boards/https://www.muhammad-anwar.com/blog/ai-security-risks-for-boards/The AI security risks that matter most to Boards and executives — prompt injection, sensitive data leakage, excessive agency and supply chain risk — and the…Thu, 03 Sep 2026 00:00:00 GMTAI SecurityAI GovernanceBoard Advisoryhttps://www.muhammad-anwar.com/blog/cyber-risk-reporting-for-boards/https://www.muhammad-anwar.com/blog/cyber-risk-reporting-for-boards/How to design cyber risk reporting that Boards use: choosing key risk indicators (KRIs) and key control indicators (KCIs), setting thresholds and telling a…Thu, 27 Aug 2026 00:00:00 GMTBoard AdvisoryRisk ManagementGRChttps://www.muhammad-anwar.com/blog/zero-trust-australian-organisations/https://www.muhammad-anwar.com/blog/zero-trust-australian-organisations/A practical take on zero trust for Australian government and regulated organisations — the core principles, how they align with the ISM, and a realistic…Thu, 20 Aug 2026 00:00:00 GMTZero TrustISMIdentity Securityhttps://www.muhammad-anwar.com/blog/defence-supply-chain-security/https://www.muhammad-anwar.com/blog/defence-supply-chain-security/A practical guide for small and medium businesses entering the Defence supply chain: governance, personnel, physical and cyber security expectations, and…Thu, 13 Aug 2026 00:00:00 GMTDefenceSupply ChainGovernment Security