Quokka Advisory
Governance & protection

Make the controls
hold up in practice.

Connect risk decisions to controls that people can enforce, explain and maintain.

See the approach
A risk decision is enforced at an access boundary and checked with positive and negative tests.Risk decision and accountable ownerVendor access is limited to the approved asset.Enforced boundaryIdentity, policy and access pathExpected access worksPositive testOther access is deniedNegative testKeep test results, exceptions and the next review together.

Swipe or use arrow keys to explore the diagram.

Read the diagram explanation
Agree the decision

Name the owner, intended access and exceptions.

Enforce the boundary

Carry the decision into identity, network and platform controls.

Test both sides

Prove required access works and other access is denied.

Keep the evidence

Record results, exceptions, ownership and review dates.

A policy needs evidence of its behaviour.

Trace the decision through the control to the tests. Keep the result and any exception with the person who owns the decision.

Follow the decision
through to evidence.

Agree the risk, choose an enforceable boundary and collect evidence that the control behaves as intended.

Define who owns the decision

Make responsibilities, exceptions and review points clear.

Put protection where it works

Integrate controls with identity, network and platform boundaries.

Check the behaviour over time

Test during maintenance, access changes and failures. Review exceptions as the environment evolves.

IEC 62443-3-3 Mapping Guide

A practical starting point for connecting system requirements to controls and evidence.

Explore the guide

Part of the same system.

Connect the design decisions across these areas.

Identity & access

Give people and systems the access their work needs.

Observability & awareness

Connect system signals to operational decisions.

In practice

All project stories
Security monitoring architecture

Monitor across government. Keep agency control.

A whole-of-government Microsoft Sentinel design combining central investigation with agency-owned security data and workspaces.

Tasmanian Government
GovernmentPilot design
Cloud security

Build cloud security into a connected environment.

Infrastructure as Code, cloud security and a successful migration, with Telstra Cloud Connect linking the wider network.

Fire Rescue Victoria
Emergency servicesDesign & delivery
Media & Entertainment

Connect the studios. Keep security in the path.

Routing, load sharing and network security across ALT VFX’s studios, data centres and AWS connections.

ALT VFX
Connectivity & network securityCase study
IT/OT network security review

Restructure network security across IT and OT.

A network security review that informed restructuring across IT and OT and substantial cost savings.

Urban Utilities
Water & wastewaterProject story

What needs to work better?

Start with the environment, the constraint and the change you need to make.

Talk to Quokka