Cyber Security & Compliance
Compliance and auditing
Evidence prepared before the audit, not during it. That single change removes most of the scramble and nearly all of the risk of a finding.
What we keep current
- Asset and licence register, maintained rather than reconstructed
- Access reviews — who has what, including administrative and vendor access
- Joiner-mover-leaver records, so a departure is demonstrably closed out
- Patch and vulnerability status across endpoints, servers and network devices
- Backup and restore test results, with dates
- Incident and change records, written up at the time
- Essential Eight posture and remediation progress — see Essential Eight
- Training completion — see awareness training
Where this lands hardest
Aged care and community-controlled health carry accreditation cycles where technology evidence is examined directly. Clubs carry gaming-licence and financial obligations, and increasingly insurer questionnaires that ask the same questions in different words.
In all three, the failure mode is identical: the controls were fine, but nobody could produce the evidence within the timeframe, so it was recorded as a gap.
The boundary, stated plainly
We prepare and maintain technology evidence. We are not accreditation consultants, auditors of record, or legal advisers, and the regulatory obligation sits with your licence rather than with your IT provider. Our director is an ISO 27001 Qualified Auditor, which informs how we structure evidence — it does not make us your certification body.
Common questions
Can you sit in on our audit?
Yes, for the technology sections, and it is usually worth it. Answering a technical question accurately in the room is faster than three rounds of follow-up correspondence.
Related
Book a Technology Review.
One to two hours onsite, across support, cyber posture, backup and recovery, infrastructure, Microsoft 365 and where the organisation is heading. You receive a written findings report within five days — prioritised risks, quick wins and gaps, in writing.
$1,500 including GST. Credited in full against your engagement if you proceed.
The report is yours to keep regardless of what you decide to do next.
The 90-day guarantee. Give us 90 days. If you're not satisfied with our service in that time, cancel and we'll refund our fees. You keep the audit, the report and every improvement we've made. Third-party hardware, licences and subscriptions purchased on your behalf are excluded. Full terms