Overview
- Built an entry-level GRC pack for Koala Freight Pty Ltd, a fictional 40-person freight-tech company in Sydney (synthetic data only — no employer or client data)
- Wrote and own Information Security Policy KF-POL-001 with 13 policy statements, covering access, privileged access, MFA, classification, remote work, patching to Essential Eight ML1 timeframes, cloud hardening, vendors, backups, incidents, awareness, retention and exceptions
- Completed a 5×5 likelihood × impact risk assessment of 8 risks (3 High, 4 Medium, 1 Low) with treatments and owners; High risks are MFA gaps, patch lag and untested backup restores
- Mapped the company against the six NIST CSF 2.0 Functions (Govern → Recover), naming the biggest gap and next control for each, with cross-references to ISO/IEC 27001:2022 Annex A and the ACSC Essential Eight
- Ties to the companion Powerpipe / Steampipe compliance dashboard on the same fictional estate, so policy and risk statements can be checked weekly with JSON/CSV evidence
What's in the pack
| Document | What it shows |
|---|---|
| Information Security Policy (PDF) | KF-POL-001 v1.0 — purpose, scope, roles, 13 statements, exceptions, review |
| Risk assessment (PDF) | 8 scored risks, rating key, treatments and owners |
| NIST CSF 2.0 gap (PDF) | One page across all six Functions, with ISO and Essential Eight overlaps |
Frameworks
- NIST CSF 2.0 — guide for organising the gap work
- ISO/IEC 27001:2022 — Annex A control references the policy and gap page point to (not a certification claim)
- ACSC Essential Eight — ML1 patching timeframes and the High risks that matter most for ransomware
- Privacy Act 1988 / NDB — called out in policy scope for consignee personal information
How to talk about it
- Policy ownership: wrote and own the policy — scope, roles, 13 statements, exception process and annual review; added remote work, vendor security and retention because a hybrid freight company sharing data with carriers needs them
- Risk scoring: three High risks also map to Essential Eight strategies that matter most for ransomware, so the first-quarter treatment plan is clear
- Framework literacy: NIST CSF is the guide, ISO 27001 is the certification path, Essential Eight is the baseline Australian customers ask about — one control (for example backup restore testing) can count toward all three
Important disclaimer
This is a personal portfolio self-assessment on a fictional company and synthetic data. It is not an audit, a certification, a penetration test or legal advice. Koala Freight Pty Ltd does not exist.