Two kinds of buyer, two kinds of page
A local business needing managed IT support searches for a service and a place. It wants someone who can fix problems, protect its data and explain costs in ordinary language. The decision is often made by an owner or office manager.
A government or defence-related buyer asks a different set of questions. It wants to know about security practices, standards, certifications and track record. The people reading your site may be security officers, contract managers or technical assessors, and they read carefully.
Trying to speak to both on the same page weakens each message. We usually separate small business IT pages from government and defence pages, and we make sure the second set is written with evidence rather than adjectives.
Terms you can use, and how to use them
Security terms are easy to misuse on a website. This table summarises what official sources say, so that copy stays accurate.
| Term | What official sources say | How a website should use it |
|---|---|---|
| ISM (Information Security Manual) | Published by the Australian Signals Directorate as a cybersecurity framework an organisation can apply | Say you align work to the ISM only if that is accurate, and describe what that means in practice |
| IRAP | An ASD program giving access to independent assessors; assessors do not accredit, certify or endorse systems for ASD, and an assessment does not by itself show compliance with every tested control | Do not say a system is IRAP certified; describe any assessment accurately and by whom it was done |
| IRAP assessor | ASD-endorsed professionals, listed by ASD | Say you employ an endorsed assessor only if the person is on that list |
| DISP | A Defence membership program with four levels, tied to security classifications | State your actual level and no higher |
| Cyber standards for DISP ICT networks | Defence names ASD Essential 8, ISO/IEC 27001/27002, NIST SP 800-171 or UK Def Stan 05-138 | Name the standard you actually meet and what evidence you hold |
Wording around IRAP
ASD describes IRAP as providing access to cyber security professionals who assess ICT systems, cloud services, gateways and GovLink, up to SECRET classification. Assessors are endorsed by ASD, and ASD publishes a list of them. ASD also notes that the Cloud Services Certification Program ceased on 2 March 2020.
In practice, phrases such as IRAP certified or IRAP approved are risky, because the program does not certify or endorse systems. We write what happened: who assessed what, at what scope, and when. If you are unsure, we leave the claim out until you can confirm the facts with the assessor.
What to send us so every security claim has evidence
We cannot judge your controls, so we rely on documents you can produce. The list below is what we ask for before writing any page that mentions a standard, program or assessment.
- Assessment scope and date. For any IRAP work, send the assessor's name, what was assessed and when, so the page can say exactly that and no more.
- Your DISP level. Defence ties each level to a classification, so we state the level you hold and leave out anything you are applying for.
- The standard you meet. Defence names four cyber standards for DISP networks. Tell us which one you meet and who confirmed it.
- What you align to in the ISM. ASD says organisations apply the ISM through their own risk management framework, so describe your scope instead of using the name as a badge.
- Staff we may feature. Send written agreement for every name, photo or qualification. Clearance details of individuals stay off the site unless you confirm otherwise.
Page types for an IT or cyber firm
Each card is a separate page or small group of pages.
Managed IT for small business
Support, backups, user accounts and device management, with how issues are reported and fixed.
Cyber security services
Assessments, hardening and incident response, each described by what the client receives.
Government and defence
Frameworks you work to, programs you belong to and sectors you serve, all evidenced.
Cloud and software
Migrations, hosting and development work, written for the person who must approve the project.
Industry specific
Pages for sectors you know, such as professional practices or not-for-profits, if you have real depth.
Careers and partners
For firms recruiting or teaming with primes, a page that states what you look for and how to apply.
Common problems on IT company sites
Technical firms often know their field well and still struggle online.
- Jargon without a reader in mind. Acronym-heavy copy loses the business owner and gives the specialist nothing new.
- One services page. Support, security and cloud sit together, so none is a strong match for a specific search.
- Claims with no evidence. Words such as secure, compliant or certified need to point to something a reader can check.
- Thin local signals. A listing that omits categories or service areas weakens searches that include a location. See our local SEO approach.
- Slow or broken technical basics. A security firm with a slow, insecure-looking site undermines its own message. Our technical SEO work covers this.
How an engagement runs
We start by learning who actually buys from you.
- Interview and inventoryWe list your services, memberships, standards and the buyers you most want, and mark which claims have evidence.
- Audit the siteA free SEO audit shows how your pages read to each buyer group.
- Write and restructureWe separate pages by audience and write them with you, so technical staff can check accuracy.
- Set up local and brand signalsWe align your listing, company details and name searches with what the website says.
- ReportMonthly notes cover enquiries, the pages behind them and what to adjust next.
What we do and do not do
A technical audience expects care.
We do
- Quote official definitions and avoid paraphrasing them into something stronger.
- Ask for evidence behind each security claim.
- Write for non-technical buyers where that is who decides.
- Leave a claim out when it cannot be verified.
We do not
- Describe a product or service as IRAP certified or approved.
- Claim a DISP level or clearance that the company does not hold.
- Publish the names or clearances of staff without their agreement.
- Offer security assessments or compliance advice ourselves.
Where this fits locally
Canberra IT firms sell across several districts, from agencies close to the centre to small businesses in town centres like Belconnen and Woden Valley. Pages that state the area you serve help local business buyers, while government-facing pages should lean on evidence and the buying routes covered on our page for government suppliers.
Cost depends on how many services and audiences need pages, plus how much technical review your staff can give. Results take months, and cyber purchases involve long approval chains. Our industries hub shows how other professions handle similar trust problems.
Frequently asked questions
Can we say our service is IRAP certified?
Not safely. ASD states that IRAP assessors do not accredit, certify or endorse systems for ASD, and an assessment does not by itself show compliance with every control. We write what was assessed, by whom and when, and we leave the claim out if you cannot confirm it.
Can we still say we are Cloud Services Certification Program certified?
Not as a current claim. ASD states that the Cloud Services Certification Program ceased on 2 March 2020. If a past listing is part of your history, we would describe it as historical and give the date. Where you are unsure, leave it out and cite your current assessment instead.
What is the ISM, and can we mention it?
The Information Security Manual is published by the Australian Signals Directorate as a framework an organisation can apply. You can say your work aligns with it if that is accurate. We ask you to describe what that means, rather than using the name as a badge.
Should we show our DISP membership?
If you hold it, yes, stated at your actual level. Defence describes four levels tied to security classifications. Do not imply a higher level. Personnel records and clearance levels of individuals are not published unless you confirm that is appropriate.
Do small businesses and government buyers need different pages?
Usually. A small business wants plain support and cost explanations, while a government or defence buyer wants evidence of standards and track record. Separate pages let each audience find what it needs without wading through the other's content.
How long does SEO take for an IT company?
Typically several months before enquiries change noticeably. Local service pages and a corrected listing can help first. Government-facing pages support checks rather than driving volume. No ranking or contract can be promised.
Do you handle our cyber security or compliance work?
No. We do SEO and content. We do not assess systems or give compliance advice. We rely on you to confirm technical facts, and we ask for evidence for any claim about standards, programs or assessments.
Sources and further reading
- Australian Signals Directorate: Information security manual: What the ISM is, who publishes it and who it is for
- Australian Signals Directorate: Infosec Registered Assessors Program (IRAP): Assessors, scope up to SECRET, no certification of systems, assessor list, CSCP ceased 2 March 2020
- Defence: Applying for DISP membership factsheet: DISP levels, eligibility and the four named cyber standards