Cybersecurity & Compliance

We help NSW small and medium businesses put in place the security controls their clients expect. That usually means a documented control statement, tested backups, multi-factor authentication, and a quarterly access review.

What we do

• Produce a written control statement aligned to APRA CPS 234 expectations, for businesses whose clients are regulated.
• Implement multi-factor authentication for every user, on every system that supports it.
• Endpoint detection and response on workstations and servers.
• Email protection to stop phishing and business email compromise.
• Quarterly access reviews so former employees do not retain access.

What we do not do

We do not sell you a 50-page security policy you will never read. We write the three-to-five page control statement your clients will actually ask for, and we implement the four controls that usually matter: MFA, tested backup, access review, and email protection.

What the ACSC small-business secure baseline actually asks for

The Australian Signals Directorate publishes a list of eight essential controls. For a small NSW business, the practical version of that list is much shorter:

• Multi-factor authentication on every email, cloud and remote access account.
• Regular patching of operating systems and applications.
• Endpoint protection on every workstation and server.
• A backup that has been restored in the last quarter.
• User accounts reviewed when staff leave.
• Email protection to block phishing and business email compromise.

If you have those six, you are ahead of 80 percent of small businesses in Australia. We do not over-engineer it. We implement the six, document them, and produce the one-page control statement your clients will ask for.

What CPS 234 means for a small business

CPS 234 applies to APRA-regulated entities. Most NSW small businesses are not APRA-regulated. But if your client is a bank, a superannuation fund or a large financial services firm, they will ask you to demonstrate that you meet CPS 234-equivalent controls. We produce a control statement that maps your existing controls to the CPS 234 expectations, and we close the gaps. You do not need a CISO. You need a documented set of controls that actually work.

Business email compromise

The most common successful attack on NSW small businesses is not a sophisticated piece of malware. It is an email that looks like it came from the CEO, asking the accounts person to pay a new supplier. We implement email authentication (SPF, DKIM, DMARC), an email protection gateway, and a verbal verification rule for payment changes. The rule costs nothing. It stops the attack.