Audit evidence in hours
A GRC evidence system replaced annual evidence hunting. Audit cycles dropped from weeks of collection to hours of sampling, with every control traceable to a current artefact.
Capability · Epcotec
Security that ships with audit-ready evidence.
AppSec review, OAuth/OIDC and IAM rollouts, hardening and audit-ready evidence for regulated environments. Delivered by named senior engineers, fixed scope, staging from week one.
Epcotec delivers security and compliance engineering for Australian regulated buyers: application security review, OAuth/OIDC and IAM implementation, infrastructure hardening, and audit-ready evidence packs. Controls are aligned to the ACSC Essential Eight and ISO 27001 practices, and our senior-led model, where named engineers own every change, answers procurement questions about accountability directly.
What we deliver
Checks and evidence.
Application security reviews
Structured review of application code, dependencies and cloud infrastructure against actual attack paths. Findings arrive ranked by exploitability and cost to fix.
OAuth, OIDC and CIAM rollouts
Design and rollout of token lifetimes, scopes, session policy and permission inheritance across customer identity platforms, with migration paths that move existing users without forced password resets.
IAM design with least privilege
Role structures, entitlement reviews and break-glass access designed around what each workload actually needs. Defaults deny; exceptions are named, owned and reviewed on a published cadence.
Baselines, MFA and secrets management
Hardening applied as reviewed baselines: enforced MFA, managed secrets, restricted network paths and logging that survives audits. Each change is reversible and lands through normal delivery pipelines.
GRC evidence systems
Controls mapped to the artefacts that prove them, collected continuously. Evidence lives where auditors can reach it, with named owners and clear freshness.
Responsible disclosure intake
A working disclosure channel: published policy, triage workflow, response times and reviewer communications, so every inbound report ends as a fixed issue.
Rough time estimate
Window: 2-6 weeks
Team: 1 security eng
Complexity: M
Indicative only. A fixed price follows a free scope review.
Get a fixed quoteDelivery process
How a review runs.
Threat model and scope
We map the estate, rank real threats and agree scope, so effort concentrates on the attack paths that matter most.
Review and hardening sprints
Findings and fixes move together in short sprints. Each sprint closes with re-verification, so risk falls sprint by sprint and every finding stays visible to its owner.
Evidence automation
Controls are wired to collectors that produce artefacts continuously, mapped to the frameworks your auditors expect, with owners and refresh intervals recorded alongside each control.
Audit dry-run
The audit is rehearsed before the auditors arrive: evidence sampled, gaps closed and responses rehearsed, so the real audit runs over evidence the team has already checked.
Handover
Runbooks, ownership maps and a walk-through leave your team able to operate the controls and extend the evidence system without us on call.
Benchmark deliveries
Findings that held up.
CIAM with zero data egress findings
A customer identity platform built with permission inheritance passed penetration testing with zero data-egress findings, holding its access boundary across every downstream integration from day one.
Scoped retrieval in a protected boundary
OAuth and OIDC scoped retrieval shipped inside a protected government boundary, issuing narrowly scoped tokens and recording every access decision for review without slowing authorised users.
More evidence in the delivery history and the complete 756-engagement register.
Standards & compliance
Audit-ready controls, on the record.
Operations and deliverables conform to the cross-cutting standards below, and this line is where the evidence lives: an information security management system aligned with ISO/IEC 27001, Essential Eight mitigation strategies in Australia, and SOC 2-aligned controls embedded in delivery.
ISO/IEC 27001-aligned information security management
Operations and deliverables run under a documented management system aligned with ISO/IEC 27001:2022. The controls shape scoping, review, change management and evidence capture on every engagement.
Australia: Governs every Australian engagement, including hosting decisions and data residency.
Canada: Governs every Canadian engagement, including hosting decisions and data residency.
ISO 9001-aligned quality management
Quality management aligned with ISO 9001 governs scoping, review gates, acceptance criteria and handover, so every deliverable passes the same documented checks.
Australia: Applies to delivery for Australian clients across all service lines.
Canada: Applies to delivery for Canadian clients across all service lines.
Privacy Act 1988 and Australian Privacy Principles
Personal information handled in Australian engagements is processed in line with the Australian Privacy Principles, with access controls and data-handling rules carried through every environment.
Australia: Applies to all Australian engagements and to data processed on behalf of Australian clients.
PIPEDA and provincial privacy law
Personal information handled in Canadian engagements is processed in line with PIPEDA and applicable provincial law, including Quebec Law 25 where relevant.
Canada: Applies to all Canadian engagements, with Quebec Law 25 obligations observed where data or operations touch Quebec.
SOC 2-aligned controls
SOC 2-aligned controls are embedded in delivery: change management, access control, monitoring and evidence capture run on every engagement.
Australia: Evidence packs are available to Australian clients under NDA.
Canada: Evidence packs are available to Canadian clients under NDA.
ISO/IEC 27001-aligned ISMS
The information security management system is aligned with ISO/IEC 27001:2022, with control mapping and documented evidence maintained per engagement.
Australia: Control mapping can be aligned to Australian government and enterprise frameworks on request.
Canada: Control mapping can be aligned to Canadian federal and provincial requirements on request.
Essential Eight (ASD)
The Australian Signals Directorate’s Essential Eight mitigation strategies are implemented across Australian environments.
Australia: Applies to Australian environments; self-assessment evidence is shared with clients under NDA.
Audit-ready evidence packs
Evidence packs (control mapping, change logs, access reviews and scan outputs) are prepared per engagement and released to clients under NDA.
Australia: Available to Australian clients throughout delivery.
Canada: Available to Canadian clients throughout delivery.
FAQ
What security teams ask.
Do you work to our existing frameworks?
Yes. We map controls to the standards your auditors already use, ISO 27001, Essential Eight, SOC 2 or internal policy, and build on the work you already have.
What does a typical engagement cost?
Most engagements run two to six weeks with one security engineer. Scope drives cost: a focused hardening sprint costs less than a full evidence system build.
Can you work alongside our developers?
Yes. We review, pair and hand over inside your delivery pipeline, so fixes land as normal pull requests and your team owns every control afterwards.
How do you handle confidential findings?
Findings go to named owners only, encrypted in transit and at rest. Nothing is disclosed externally without written instruction, and responsible disclosure runs through agreed channels.
References to standards describe alignment. Certification is claimed only where an accredited certificate is published on this page.