We've been asked to complete a principal contractor's security questionnaire. Can you help?

Yes. We have done enough of them for mining services firms to know which questions actually decide the outcome. Usually multi-factor authentication, endpoint detection and response, patching, backups, offboarding, incident response and cyber insurance. We answer with evidence, and where the answer is 'not yet', you get a plan to close the gap, with dates the principal will accept.

Our field laptops go between remote sites, home, and the office. How do we keep them safe?

Treat every laptop as if the network it is on is hostile, rather than trusting it because it is behind the office firewall. Full-disk encryption, identity-based access to your cloud platforms, endpoint detection and response running all the time, and no shared logins. Site rules then apply at the platform level, not by which physical network the laptop happens to be on. We set this up once and it holds as the fleet grows.

We run drone and LiDAR survey work. The data is enormous. Where should we store it?

It depends on the restrictions in your contracts and on who your customers are. We will help you pick a storage pattern that meets the data sovereignty terms you have signed. It also has to stay affordable as the raw-data library grows, and work with the analysis tools your team already uses. We don't sell the storage, so we'll tell you which product fits your setup, not whichever one pays us the most.

Do you cover 24/7 incident response? Our operations run around the clock.

On Managed IT Complete, a critical incident is handled by our Australia-based team, with agreed response times outside business hours. We are not a 24/7 security operations centre. If that is genuinely what you need, we will say so and help you choose one. For most mining services firms, monitoring that never stops, a written incident response plan and a local team is the right combination. Where it isn't, you will hear that from us early.

We work with overseas principals and offshore contractors. Does that create problems?

It creates work, not problems. Cross-border data flow, export control on geospatial data in some countries, linking staff logins to an overseas parent's systems, vendor risk assessments for offshore subcontractors. We have set this up for firms operating across Australia, South-East Asia and Africa. It is detail work, and it is much cheaper done properly the first time.

IT and cybersecurity for the firms that serve the mines.

Drone surveyors, engineering consultancies, geotech specialists, environmental and safety auditors. The 20 to 250-person firms that do the work the majors actually depend on, with the security questionnaires to match. Based in Welshpool WA, working with mining services firms across Australia.

What compliance asks of you See if we're a fit

What's actually different

Mining services IT has to pass the majors' security check.

You work between a principal contractor that runs like a fortress and a field environment that changes every week. The site network belongs to somebody else. Your data is valuable and often restricted by contract. And the security questionnaire that decides whether you keep the work was written by someone who has never seen your laptop.

Most of the fix is unglamorous, and we have been doing it for firms in this space for years. Connectivity that survives a bad day on site. Identity and endpoint controls that meet principal contractor asks without making your people hate their laptops. Backup and recovery that covers your survey and operational data properly. And an incident response that starts with a phone call to someone who knows your setup, rather than a Google search at 9 PM.

We don't work with the mining companies themselves. Panel procurement and the paperwork around it are a bad fit for how we work. The firms that serve them are a different matter, and 20 to 250 staff is the size we are built for.

Live right now

The 2026 pressure points we're actively working on with clients.

The specific asks, deadlines and enforcement actions shaping 2026 conversations in your sector.

Mining prime-contractor security packs, pushed down the chain

Every major miner (BHP, Rio, FMG, Roy Hill and the rest) now assesses your security before onboarding you to a site or a platform. The pack arrives as a PDF, or as a questionnaire in a procurement portal. Multi-factor authentication, endpoint detection and response, patching cadence, Essential Eight maturity, cyber insurance, an incident response plan, backup testing. Answer it badly and you come off the prequalification list. Overstate an answer and it shows up after an incident, which is the expensive way to find out.

Site connectivity that can't afford to drop

Drone surveying, geospatial analysis, automated drilling, environmental telemetry. Every one of them depends on a link between a remote site and either head office or a cloud platform. A single 4G dongle taped to a Pelican case is cheap until the day it fails. The data pipeline everyone talks about needs managed mobile broadband with real failover. It also needs a router on a service level agreement that means something.

Mandatory ransomware payment reporting, 72 hours

Under the Cyber Security Act, a business turning over more than $3 million has to report a ransomware payment within 72 hours. It goes to the Australian Signals Directorate, and the rule started on 30 May 2025. Most mid-size mining services firms are over that threshold. The clock starts the moment the payment is made, so your incident response plan needs to know the reporting path before you need it.

Frameworks and regulators

Industry frameworks, regulations and audit standards for mining services in Australia.

Prime-contractor security questionnaires: The wording changes with each principal, but the content barely does. Essential Eight self-attestation, multi-factor authentication, endpoint detection and response, patching service levels, staff training records, a documented incident response, a named security contact. We keep a crib of the common asks, so your next prequalification response takes a morning instead of a fortnight.
Essential Eight: The Australian Cyber Security Centre baseline that cyber insurers and most principals reference. We move you up the maturity levels without stopping billable work, and we keep the evidence so the self-attestation holds up if anyone checks.
Privacy Act 1988 and the Australian Privacy Principles: Any personal data you hold on contractors is covered, including photos, rosters, certifications and licence details. Turn over more than $3 million and the full obligations apply, including the Notifiable Data Breaches scheme.
Site-specific operating procedures: Every principal has its own site rules. What can connect to the site network, and what data may leave it. How a visiting laptop is treated, and whether a personal device can touch any of it. We configure the endpoint and identity setup so your people can comply without the workarounds that defeat the policy.
Data sovereignty for geospatial and operational data: Drone imagery, LiDAR laser scans, tailings-dam monitoring, environmental telemetry. Much of it comes with contractual restrictions on where it can be stored and who can see it. The cloud platforms you already use can be configured to respect those restrictions, and we set them up that way. You get evidence you can produce on request.

Where firms usually start

Compliance and IT starting points for mining services in Australia.

Common questions

The things mining services clients ask us first.

We've been asked to complete a principal contractor's security questionnaire. Can you help?: Yes. We have done enough of them for mining services firms to know which questions actually decide the outcome. Usually multi-factor authentication, endpoint detection and response, patching, backups, offboarding, incident response and cyber insurance. We answer with evidence, and where the answer is 'not yet', you get a plan to close the gap, with dates the principal will accept.

Our field laptops go between remote sites, home, and the office. How do we keep them safe?: Treat every laptop as if the network it is on is hostile, rather than trusting it because it is behind the office firewall. Full-disk encryption, identity-based access to your cloud platforms, endpoint detection and response running all the time, and no shared logins. Site rules then apply at the platform level, not by which physical network the laptop happens to be on. We set this up once and it holds as the fleet grows.

We run drone and LiDAR survey work. The data is enormous. Where should we store it?: It depends on the restrictions in your contracts and on who your customers are. We will help you pick a storage pattern that meets the data sovereignty terms you have signed. It also has to stay affordable as the raw-data library grows, and work with the analysis tools your team already uses. We don't sell the storage, so we'll tell you which product fits your setup, not whichever one pays us the most.

Do you cover 24/7 incident response? Our operations run around the clock.: On Managed IT Complete, a critical incident is handled by our Australia-based team, with agreed response times outside business hours. We are not a 24/7 security operations centre. If that is genuinely what you need, we will say so and help you choose one. For most mining services firms, monitoring that never stops, a written incident response plan and a local team is the right combination. Where it isn't, you will hear that from us early.

We work with overseas principals and offshore contractors. Does that create problems?: It creates work, not problems. Cross-border data flow, export control on geospatial data in some countries, linking staff logins to an overseas parent's systems, vendor risk assessments for offshore subcontractors. We have set this up for firms operating across Australia, South-East Asia and Africa. It is detail work, and it is much cheaper done properly the first time.

The qualifier

Let's see if we're a fit.

Seven questions, one moment of your time. We'd rather tell you now than three months in.