Essential Eight
Australia · All Australian organisations
ASD's eight strategies. Vigil supports the human side of your Essential Eight programme.
See Essential Eightcoverage →Compliance frameworks
One programme. Evidence mapped to the frameworks that matter.
Vigil runs phishing simulation, awareness training and human-risk scoring once. The same evidence then maps to whichever framework your assessor, auditor or insurer references, including Essential Eight, ISO 27001, SOC 2, APRA CPS 234 and ASIC cyber resilience.
Frameworks Vigil supports
APRA CPS 234
Australia · APRA-regulated entities
Evidence for the roles (paragraphs 13-14), policy (19) and testing (27-31) expectations, plus the awareness-training guidance that sits in CPG 234.
See APRA CPS 234coverage →ISO 27001
Global · Pursuing or maintaining an ISMS
Annex A.6.3 awareness, education and training evidence for Stage 1 and Stage 2 audits.
See ISO 27001coverage →SOC 2
USA / Global · Service organisations
Common Criteria CC1.4, CC2.2, CC6.6 and CC7.2 awareness evidence for Type I and Type II.
See SOC 2coverage →ASIC Cyber Resilience
Australia · AFSL holders, dealer groups
REP 716 and REP 776 alignment, with PI-insurer-ready reports for AFSL holders.
See ASIC Cyber Resiliencecoverage →Common questions
How does one platform map to several frameworks?
Most frameworks share the same human-layer expectations, ongoing awareness training, role-based content, phishing simulation, and evidence the programme is operating. Vigil runs the underlying programme once and maps the evidence to each framework's specific control IDs. One programme, multiple compliance outputs.
Can I prioritise one framework over another?
Yes. Pin a primary framework in the dashboard and Vigil weights content, simulation cadence and evidence emphasis to match. For dual-track work (e.g. SOC 2 plus ISO 27001) you can pin two without losing detail.
Do I need separate evidence packs for each framework or one combined?
Both options. Generate one combined evidence pack with cross-references, or generate framework-specific packs for audits where the assessor wants a single-framework view.
Which framework should an Australian SMB start with?
Essential Eight for most SMBs. APRA-regulated entities start with CPS 234. AFSL holders start with the ASIC cyber resilience track. ISO 27001 and SOC 2 are typically driven by customer or vendor-due-diligence requirements.
Are more framework mappings on the roadmap?
Yes. Additional framework mappings are on the roadmap. Contact us if you need a specific framework on a particular timeline and we will tell you where it currently sits.
One programme. Mapped evidence. Day-one records.
14-day free trial. No credit card. Pick your primary framework and Vigil generates the programme.