How we work

How we run an engagement

Assess, design, deploy, operate — one model across the build and the run, so nothing gets handed over to nobody and the knowledge does not leave when the project closes.

Book an assessment See our services

The pattern we keep finding

Most environments are not broken. They are unattended.

The failures we are called in to fix are rarely exotic. They are the things that quietly stopped having an owner — and they are entirely preventable by someone whose job it is to watch them.

The fleet nobody owns

An MDM stood up for a rollout years ago. Policies inherited from a consultant who left. A device count that never quite matches the licence count.

Expiry as an outage

An APNs certificate, a VPP token or a DEP server certificate lapses on a Friday. Nobody was tracking it, and enrolment stops for everyone.

Compliance you cannot evidence

An Essential Eight score assembled by hand the week before it is due, from a mobile estate that was never really in scope.

Four vendors, no owner

The platform vendor, the carrier, the hardware supplier and the identity team each hold a piece. The user in the middle waits.

One team, one agreement, one accountable point of contact. That is the whole proposition.

The engagement model

Assess · Design · Deploy · Operate

Most managed service relationships fail at the join between the project and the run. We use one model across both so nothing is handed over to nobody.

Assess

A written picture of what you actually have, before anybody proposes anything.

We start with a fixed-scope assessment rather than a contract. Two to four weeks, depending on size, spent building an evidenced picture of the environment: what is enrolled, what is patched, what is licensed, what is exposed and what nobody has owned for a while.

The output is written, and it is yours whether or not you engage us further. We would rather lose a deal at this stage than win one on a misunderstanding of the environment.

What you receive

Device, identity and infrastructure inventory
Essential Eight maturity scoring against the ACSC model
Risk register ranked by exploitability, not by control number
A clear statement of what is working and should be left alone

Design

A costed, sequenced plan — including the parts you should not do yet.

Findings become a roadmap with money and time attached. We sequence by risk reduction per dollar rather than by what is easiest to sell, and we are explicit about which items can safely wait until the next budget cycle.

Where a design decision has a trade-off, it is written down with the alternative, so the decision belongs to you and survives the person who made it.

What you receive

Target-state architecture, documented
Sequenced remediation and uplift roadmap with costs
Migration and cutover plan where platforms are changing
Service definition — scope, response targets and reporting

Deploy

Transition and uplift, staged by cohort, with a way back at every step.

Implementation runs in waves against the agreed plan. Pilot cohorts first, then staged rollout, with a documented rollback position at each gate — because the fastest migration is not the one with no plan for the day it goes sideways.

For platform migrations we use low user impact tooling wherever it exists. Devices are moved, not wiped, and users are told what to expect before it happens rather than after.

What you receive

Built and tested target environment
Staged migration by cohort with rollback gates
End-user communications and enrolment support
As-built documentation and knowledge transfer

Operate

Steady-state service with named engineers and reporting that drives the next quarter.

The environment moves into managed service: monitoring, patching, enrolment support, vendor case management and a 24×7 desk, with named engineers who know the configuration rather than a rotating pool.

Every quarter we review posture, service performance and the remaining backlog, and agree what to fix next. The roadmap keeps moving instead of ageing on a shared drive.

What you receive

24×7 service desk with agreed response targets
Monthly service and security posture reporting
Quarterly service review and roadmap refresh
Named technical account contact who knows your environment

Cleared delivery

Security-cleared people, onshore

Working in Australian government and defence environments is not only a technical question. It is a question of who is in the room, where the work is performed and where the data lives.

CDTS is an Australian-owned company based in Canberra. Our work is performed onshore by Australian-based staff, and we maintain security-cleared personnel for engagements that require cleared resources.

Clearance levels and personnel requirements are confirmed per engagement. Talk to us about the specific requirement in your contract or security plan.

Australian-owned and Australian-operated, headquartered in Canberra
Security-cleared personnel available for engagements that require them
Delivery performed onshore — no offshore service desk or remote administration
Data residency mapped per service, before you commit to anything
Vetted, named engineers assigned to your environment rather than a rotating pool

Principles

How we behave when it is inconvenient

These are the commitments that cost us something. That is the only reason they are worth publishing.

Assessment before contract

We would rather lose an engagement at the assessment stage than win one on a misunderstanding of the environment. The report is yours either way.

Sequenced by risk, not by ease

Remediation is ordered by risk reduction per dollar. Where something can safely wait a budget cycle, we say so rather than bundling it in.

Named engineers

You get people who know your configuration, not a rotating pool. The person on the escalation is the person who built it.

Written down

Designs, decisions and trade-offs are documented as we go. The knowledge stays with you when the engagement ends.

Rollback at every gate

Migrations run in cohorts with a documented way back at each stage. Speed is worth nothing without a plan for the day it goes sideways.

Reviewed every quarter

Steady state is not static. Every quarter we review posture, performance and the backlog, and agree what gets fixed next.

Service levels

What “managed” actually commits us to

Indicative response targets for a standard managed service agreement. Targets are agreed per contract — these are the defaults we work from.

Priority	Definition	Response target	Coverage
P1	Critical — service down, or a security incident in progress	30 minutes	24×7
P2	High — major degradation, or a group of users unable to work	2 business hours	24×7
P3	Medium — single user affected, workaround available	4 business hours	Business hours
P4	Low — request, query or scheduled change	1 business day	Business hours

Response target is the time to a human engaged on the issue, not an automated acknowledgement. Resolution targets and service credits are agreed per engagement.

2010

Delivering for Australian government since

30+

Years of combined mobility & security experience

4×

Ivanti / MobileIron Partner of the Year

24×7

Australian-based managed support

Next step

Let’s talk about your environment

Tell us what you are running today and where it hurts. We will give you a straight answer on whether we are the right fit, and what we would look at first.

Start a conversation See our services +61 408 788 671