Security Compliance Audit

We assess against ASD Essential Eight (all eight controls at maturity levels 0-3), APRA CPS 234 (all obligations), ISO 27001 (Annex A controls), PCI DSS (all 12 requirements), SOC 2 Trust Services Criteria, and the Australian Privacy Act and Privacy Principles. One assessment can cover a single framework or several at once. We cross-map the findings, so you fix each gap once rather than once per framework.

A single-framework compliance assessment starts at $800 AUD. That covers technical testing, control assessment, framework-mapped reporting and guidance on the fixes. Adding frameworks costs less per framework: two frameworks from $1,400, three or more from $1,800. The saving comes from testing once and mapping the result to several frameworks. Contact us for a quote based on your scope and the frameworks you need.

A regular security audit finds technical weaknesses. A compliance audit goes further. It ties those weaknesses, and any gaps in your policies and processes, to named controls in your framework. Each one comes with a rating, a maturity score and a fix that traces back to the rule behind it. You get a report your risk, compliance or audit team can use as it stands. It is not a generic list of vulnerabilities that someone has to translate into compliance language.

A gap assessment can compare the agreed controls with evidence and identify work to complete before a certification audit. Your organisation owns implementation and the certification body determines the result. No verified first-time pass rate or certification guarantee is claimed.

Most likely, yes. CPS 234 extends to material service providers of APRA-regulated entities. Say you supply technology services, data processing, cloud hosting or outsourced operations to a bank, insurer or super fund. That client has a duty to make sure you manage information security risks in line with the services you provide. More and more APRA-regulated clients now ask for proof of CPS 234 compliance. Our assessment gives you that proof and shows you the gaps to close.

Both. We find the gaps, and the testing itself creates the evidence: penetration test reports, vulnerability scan results, control effectiveness assessments and maturity ratings. For frameworks such as Essential Eight and CPS 234, we hand over the exact records auditors and regulators expect to see. Where the assessment shows a policy or procedure is missing or too thin, we give you a template to build it from.

Once a year is the baseline. Run another one whenever something material changes, such as a new system, a restructure or a rule update. APRA CPS 234 requires control testing to be performed at least annually and after material changes. ISO 27001 requires annual surveillance audits with a full recertification every three years. PCI DSS requires annual validation. Our quarterly monitoring service ($200/quarter) keeps an eye on the technical side between formal assessments.

Yes, and it is one of our main advantages. Many controls satisfy several frameworks at once. Multi-factor authentication, for instance, is required by Essential Eight (ML2+), CPS 234, ISO 27001 (A.8.5) and PCI DSS (Req. 8). We test the control once and map it to every framework it touches. We also flag where one fix closes gaps in several areas at the same time. That is far quicker than running a separate assessment for each framework.

Plenty of our clients start with little or no formal documentation, smaller businesses most of all. That is a finding, not a barrier. We look at both your technical controls and how far your documentation has come. Where a policy is missing, we give you a template and show you how to fill it in. The report itself counts as your first piece of compliance evidence, and it gives you a base to build on step by step.

We offer both. The one-off assessment tells you where you stand today. Our quarterly monitoring service ($200/quarter) watches the technical side between assessments. If you are building a compliance programme from scratch, we can work alongside you for 3-12 months on policy, control implementation and audit preparation. Contact us to talk through the right level of ongoing support.

Our method is built for organisations spread across sites and clouds. We assess cloud infrastructure (AWS, Azure, GCP) through external scanning and a review of the cloud settings themselves. Every location gets the same testing, and the findings come back as one compliance view. We test remote access closely, because it so often connects the systems compliance cares about most. Wherever a control is hosted, we assess it.

An assessment report can record the agreed scope, evidence, limitations and remediation items for your internal review. A regulator, insurer or certification body decides what evidence it accepts. The report is not a certification of legal compliance, and acceptance in a tender or formal audit is not guaranteed.