Security and privacy assessment
Establish the current position, evidence gaps and implementation priorities for the selected activities.
Explore assessmentsPractical safeguards backed by evidence
Cybersecurity and privacy consulting for Australian businesses.
A customer questionnaire or security incident can reveal a gap between documented controls and their operation. CyberVantage360 helps Australian organisations assess that gap, prioritise improvements and prepare accurate assurance evidence. Build the programme around your service, information and operating constraints.
Start with the business decision
Define the problem before selecting a framework.
Start with the business trigger: a new contract, a system change, a control weakness or a management concern. Identify the affected service and the evidence needed to make the next decision.
We can scope assessment, technical testing and implementation around those needs. An evidence-based plan should distinguish missing safeguards from missing records and identify which changes depend on suppliers or management decisions.
Market context
Check applicability and use guidance in its intended context.
OAIC guidance explains that Privacy Act coverage needs assessment and that some small businesses are covered despite the general exemption. Do not infer the legal position from size alone.
Australian government Essential Eight guidance recommends a risk-based approach. It is a useful security reference within its intended scope, not a universal certificate or complete answer to every privacy, operational-technology or customer assurance question.
Choose the relevant workstream
Connect the assessment with practical implementation.
Choose services that address the identified boundary and business objective.
Technical testing
Agree authorised targets, methods and conditions, then use actionable findings and retesting to guide remediation.
Explore VAPTInformation security management
Build an ISMS around risk decisions, operating controls and evidence for independent certification preparation.
Explore ISO 27001 supportCustomer assurance readiness
Prepare the service scope and control evidence for an independent SOC 2 examination when that is the required outcome.
Explore SOC 2 readinessMarket-specific services
Explore support for your market.
Agree the outputs
Give management a clear view of the work ahead.
Scope and evidence assessment
Document the services, relevant obligations and available evidence, including supplier dependencies and limitations.
Prioritised remediation plan
Assign actions, owners and dependencies, with a practical way to verify that changes address the finding.
Operating and assurance handover
Organise maintained evidence and accurate scope statements for management and customer discussions.
A practical engagement
Test a control through its actual operating cycle.
Select an important control such as privileged access or restoration and examine how it works from approval to review. Compare the procedure with current configuration and evidence.
Use the result to plan proportionate improvements rather than relying on a checklist score alone. Where formal assurance is required, confirm its scope and independent route before promising a report or certificate.
Illustrative operating decisions
Two Australian security decisions.
Hypothetical examples, not client case studies or evidence of completed engagements.
A software vendor faces a larger customer review
A hypothetical Australian vendor receives a detailed assurance request after expanding its cloud service. Existing answers cover a smaller product and omit a new support provider.
The assessment establishes the current boundary and checks the evidence behind each commitment. The implementation plan addresses the material gaps and keeps the customer-facing scope accurate.
A multi-site business reviews recovery and access
A hypothetical business has tested backups but has not checked whether an alternative team can obtain authorised access during an outage. Technology and operating assumptions have drifted apart.
The review follows the recovery workflow through access, validation and service restoration. Findings become assigned changes and a repeatable test, with realistic limits recorded for management.
Know the outcome
Keep improvement evidence separate from universal promises.
A technical test reports on the agreed scope and conditions. An ISO certificate assesses a defined management system, while SOC 2 reporting involves an independent CPA examination. None should be described as a guarantee that all threats or legal obligations have been resolved.
Agree specialist input, delivery arrangements and responsibility for implementing findings. Where a customer requests a specific assessment, confirm the required form and scope of evidence early.
Before you commission the work
Before you commission Australian security work.
Are all small businesses outside the Privacy Act?
No. OAIC guidance identifies circumstances where small businesses are covered. Assess the actual activities and applicable provisions.
Does the Essential Eight cover every security risk?
No. Use the guidance in its intended context and assess additional controls needed for your environment and objectives.
Can technical testing replace a management-system programme?
It provides specific evidence but does not replace governance, risk decisions or ongoing operation of controls.
Can existing supplier reports help?
Yes, where their scope and period fit the service. Check responsibilities retained by your organisation and any evidence limitations.
What should we bring to scoping?
The business objective, systems and suppliers in question, current evidence and the customer or management decision date.
Reference basis
Sources and applicability
OAIC: small-business Privacy Act coverage; Australian government: Essential Eight maturity model; ISO: independent certification; AICPA: SOC Suite of Services.
Official context checked 13 October 2026. Examples and implementation suggestions are practical recommendations. Confirm applicability, delivery arrangements and any specialist legal or independent assurance role for the engagement.
Make the next decision clear
Build a practical plan from the evidence you have.
Share the service and the questions that need resolving. We can define focused assessment and implementation work with clear deliverables.