Someone has sent you a form. An insurer's renewal questionnaire, a client's security review, an auditor's request for evidence. We work through it with you, and we make sure what goes on the page is true before it goes back.
Assessments, forms, evidence
You find out where you actually sit, control by control, against the Essential Eight from the Australian Cyber Security Centre (ACSC). Usually that is lower than people expect. From there you get a staged plan to maturity level one, then level two. The eight controls are set out on the Essential Eight page.
The renewal form has become a 40-page technical audit. We've answered enough of them to know what brokers actually want, which answers trigger follow-ups, and where "yes" is a lie that bites later. We fill them in with you, not for you.
Larger clients now audit their suppliers. If a prospect or an existing customer asks you to prove your controls, we hold the evidence and know the framework they're mapping to. We've been through our own ISO/IEC 27001:2022 audit, certified by BSI, so we know what the process actually asks for.
Frameworks and regulators
Nobody wants a self-assessment that says you're secure. An auditor, a broker or a large client's security team wants proof: a third-party attestation, not your word for it. We hold the setting itself, the policy that enforces it, and the log that shows exceptions being handled. We collect and maintain that evidence while we run the environment, not in a scramble every twelve months.
It's not just managed service providers who tick yes to get the form off their desk. Plenty of businesses do the same, because "no" invites more questions than "yes" does. But a false yes costs more than an accurate no, because the gap doesn't disappear. It waits for the audit, or the incident, whichever comes first. We're the ones on the phone either way, so we'd rather the answer be one that holds up.
Common questions
The qualifier
Seven questions, one moment of your time. We'd rather tell you now than three months in.
