Skip to content
Book a demo

GRC for Australian regulated firms

GRC,simplified.

One GRC platform for smaller banks, credit unions, insurers and super funds regulated by APRA and ASIC.

Book a demoExplore the platform
Screens show a sample organisation. Some are in preview.A two-minute film with music and on-screen titles, no narration. Separate tools for risk, compliance, internal audit, cyber security, data protection, finance and HR come together into one platform: Sastrum. It then shows onboarding an organisation, built-in GRC packs, a policy drafted in one click, dashboards for each leadership role, one enterprise view with each function's data kept separate, and Lumina suggesting actions with their sources, reviewed and accepted by a person.

Who it is for

Same regulations. Smaller teams. Smaller budgets.

  • Mutual banks and credit unions
  • Superannuation funds
  • General and life insurers
  • Insurance brokers
  1. APRA's CPS 230 asks every regulated entity to map critical operations, set tolerances and manage material service providers.
  2. CPS 234 expects tested information security controls and notice to APRA within 72 hours of a material incident.
  3. Privacy Act penalties for serious interference now reach A$50 million or more, and the first civil penalty has been ordered.

Same APRA standards. Same OAIC scrutiny. Same penalties.

A fraction of the team and budget.

Our aim Affordable, easy-to-use, enterprise-grade GRC for every small and mid-size firm.

Industry content packs

Packs for the industries we serve in Australia.

A pack is the regulations, controls, risks, policies and audit tests for one industry, mapped before you start. Banking and finance ships today; the rest follow.

  • Available

    Banking and finance

    Mutual banks, credit unions, super funds, insurers and brokers

    Maps to CPS 234, CPS 230, Privacy Act, ASIC

  • Coming

    IT and ITES

    Managed service providers and software firms serving regulated clients

    Maps to Essential Eight, ISO 27001, SOC 2, Privacy Act

  • Coming

    Telecom

    Carriers and carriage service providers

    Maps to SOCI, Telecommunications Act security obligations, Privacy Act

  • Coming

    Manufacturing

    Food, defence and process manufacturers

    Maps to SOCI where designated, ISO 27001, IEC 62443

  • Coming

    Energy and utilities

    Generators, networks and retailers

    Maps to SOCI risk management program, AESCSF, ISO 27001

Why this matters now

GRC failures now cost real money, not just audit points.

Australian figures, each linked to its source.

What makes it different

Same breadth as the global suites. Built for smaller firms.

One control library that every framework maps to, with six things the global suites do not give a smaller firm.

  1. Your regulator, already inside.

    CPS 234, CPS 230, the Privacy Act and SOCI are in the product, alongside ISO 27001, NIST CSF and PCI DSS.

    See the frameworks

  2. Live in minutes.

    Describe your organisation. Sastrum scopes your risk universe, suggests your controls and drafts your first policies, the same day.

    See risk scoping

  3. AI a regulator can audit.

    Lumina suggests and drafts, and shows the clauses it relied on. A named person approves every decision, and every AI action is logged.

    Lumina drafts. People sign.

    How Lumina works

  4. One record, separate lanes.

    Risk, compliance and audit share the same controls and evidence. Each keeps its own data and approvals. The board sees one view across three lines of defence.

    Explore the platform

  5. One licence.

    Governance, compliance, audit and incidents under one licence. In our cloud, your private cloud or on your premises, with the same features.

    Security and deployment

  6. Platform plus people.

    With the product come our services: virtual CISO, managed GRC and security testing.

    Talk to us

Our experience, built into the product

20years of GRC advisory and regulatory audits

We did not start from a blank page. Every lesson from those years has gone into the product, so you buy the learning with the software.

  • GRC advisory
  • Regulatory audits
  • Learning, built in

Built with a national bank against 300 tendered requirements.

What we are working on now

This is just the start.

  • Board

    Board-level risk simulation

    Coming soon

  • Chief Risk Officer

    Risk quantification and predictive risk

    Coming soon

  • Chief Compliance Officer

    Continuous compliance and regulation-change impact simulation

    Coming soon · Q4 2026

  • CISO

    Continuous control monitoring and quantum computing impact simulation

    Coming soon

  • Chief Internal Auditor

    Automatic work papers

    Coming soon

  • Data Protection Officer

    Continuous data protection

    Coming soon

Build the next chapter with us.

See Sastrum run on your own regulators, help shape it for your sector, or join as a founding customer.

  • See it running

    Thirty minutes, opened on a risk universe already scoped to your sector and regulators.

    Book a demo

  • Partners

    Design partners shape the content for their sector or country. Consultants, integrators and regulatory experts take Sastrum to each launch market.

    Become a partner

  • Founding customers

    Founding-customer terms and a seat on our product council.

    Claim the early-bird offer

Born in India. Built for the world.