Security assurance · internal audits with sovereign AI
Find the gaps first. Keep it in Australia.
We audit your security against the standards that apply to you — ISO 27001, SOC 2, ASD Essentials, APRA CPS and ISO 42001 — and hand back the evidence and the gaps to close, before the certifier or the regulator does. The AI that works alongside our auditors runs on open-weight models hosted in Australia by SCX.ai, so what we learn about your controls stays in the country.
Audit stackOnshore
How it works
Four steps, one fixed price.
Our security assurance methodology, end to end — from scoping the standards to keeping you audit-ready between reviews. People lead every engagement; the model does the reading, cross-referencing and drafting, all on Australian infrastructure.
Step 01
Scope & plan
Using our framework, we map your controls across the standards in scope and hand you a project plan, a timeline and a fixed price.
No surprises on the invoice
Step 02
Assess
Our auditors test each control against the standard, one by one, and gather the evidence — with a sovereign model working through the volume beside them.
People lead, AI assists
Step 03
Report
Every gap is rated and written up with the evidence, the fix and a remediation plan — in the format your certifier or board expects.
Findings you can act on
Step 04
Assure
Once the gaps are closed, we re-check them and keep the evidence current, so you stay audit-ready between reviews — not just at audit time.
Audit-ready, not just once
Services
Internal audits, mapped to the standards that apply to you.
Independent internal audits and readiness assessments against the frameworks Australian organisations are measured on. Penetration testing is delivered by BugXHunter.
ISO 27001
Information security
An internal audit of your ISMS against ISO 27001 — controls, evidence, and the gaps to close before the certification body arrives.
SOC 2
Trust services criteria
Readiness for a SOC 2 Type I or II, with the security, availability and confidentiality controls tested the way an auditor will test them.
ASD Essentials
ASD Essentials
A maturity assessment against the ASD Essentials mitigation strategies, with the evidence each level needs and a path to your target maturity.
APRA
CPS 234 & CPS 230
Information security and operational resilience mapped to your controls, for APRA-regulated entities and the providers they rely on.
ISO 42001
AI management system
Governance for the AI you build or buy, audited against ISO 42001 — the management-system standard for responsible AI.
Pen testing
Penetration testing
Hands-on web, network, API, cloud, red team and AI/LLM testing — delivered by BugXHunter.
bugxhunter.com →
Guides
Plain-language guides to the standards that matter.
Free to read on CISO AI — the frameworks above, and how AI changes what each one asks of you.
AI agents
Securing AI agents
Controls for AI agents that act on your systems, mapped to the ISM.
Read →
Regulation
Australia's AI guardrails
AI obligations in Australia for 2026, the AI6 practices and the Privacy Act's automated-decision duty.
Read →
ASD
ASD Essentials and AI
What the Essential Eight's replacement says about AI in enterprise IT, cloud and OT.
Read →
ISO 42001
ISO 42001 for AI
How to govern the AI you build or buy under the ISO 42001 management-system standard.
Read →
APRA
APRA CPS 220, 230 & 234
What APRA's risk, resilience and information-security standards require of regulated entities.
Read →
APRA & AI
AI under CPS 230 & 234
APRA's prudential standards applied to AI, requirement by requirement.
Read →
Framework
Integrated governance framework
Run ISO 27001, ISO 42001, ASD Essentials and APRA as one programme, with a crosswalk and checklist.
Read →
All guides
Browse every guide
Plain-language briefings on security and AI governance, free on CISO AI.
cisoai.au/guides →
Sovereign AI
Built elsewhere. Run here. Working for Australia.
Cintelis runs its audits with sovereign AI inference from SCX.ai, an Australian provider. SCX.ai runs open-weight models such as GLM-5.3 on infrastructure hosted in Australia.
Open weights mean the model itself is published. Nobody has to take a vendor's word for what it is, and it can be run wherever its operator chooses. For this work, that place is onshore.
If the Privacy Act, APRA CPS 234 or the SOCI Act apply to you, where your data is processed is a question you will have to answer. This gives you a short one.
GLM-5.3 is an open-weight model published by Z AI. SCX.ai states that it does not train on customer data and that its controls are IRAP-aligned. Details are at scx.ai.
Know where you stand, before the certifier does.
Tell us which standard and what's in scope. We will come back with a scope, a timeline and a fixed price.
Read continuously
AI risk & tooling watch
We put agents into live processes, so we follow how they fail in everyone else's. Autonomous agents exceeding their authority, prompt injection, and the governance catching up with both — updated through the day from CISO AI, our own security intelligence feed.
Reading the feed…
Get in touch
Tell us where the week goes.
Name the process that eats the most time and we will tell you what an assessment of it looks like — fixed scope, fixed fee, no pressure and no lock-in.
- Emailhello@cintelis.ai
- Phone1300 786 040
- LinkedInCintelis
- BasedBrisbane, Queensland