Cyber Posture Review
A fixed-scope, one-off assessment of where your business is actually exposed, scored against the Australian Cyber Security Centre’s Essential Eight and sized for a small trade business rather than a government department. You get a document at the end: what was checked, how it scored, and what it would cost to fix, ranked by what actually matters.
Why you might be asked for this
Head contractors, insurers and larger builders are increasingly asking small subcontractors cyber questions before awarding work. A tradie who cannot answer is losing commercial jobs over it, not because the business is genuinely unsafe, but because there is nothing to hand over that says so. That is a sharper reason to get this done than fear of ransomware, and it is happening on commercial work more often each year.
What gets assessed
The Essential Eight, applied at a level proportionate to a business your size: multi-factor authentication, application patching, whether backups have actually been tested, application control, restricting admin privileges, and the rest of the framework, each checked against what you actually run rather than against a generic checklist.
How it is scored
Each control is scored against where you currently sit, not against a pass or fail line that does not fit a five-person business. The result is a plain-English rating per control and an overall picture, so you can see at a glance what is solid and what needs attention, without wading through a framework built for an audit committee.
What you get
A written report you own: the score, what it means, and a costed, ranked plan for closing the gaps that matter. It is built to be the document a head contractor or insurer will actually accept, which is different from a free self-assessment — this one has been checked rather than self-reported.
What it costs
A fixed price, agreed before anything starts. What moves it is how much there is to look at: how many computers and phones reach your systems, how many people have their own login, and how many platforms you run.
Most trade businesses land on one of these:
| Your setup | Price |
|---|---|
| One ute, a phone, one or two logins, the usual accounting-and-email | $869 |
| A few utes, a shed, someone doing the admin, three or four platforms | $1,375 |
| An office, a server, payroll, or more than one business | Quoted |
Prices include GST.
If you are between two of those, we will tell you which one you are closer to and why, before you commit to anything.
Doing it again next year costs less. The second one is a re-check rather than a first look: $429, or $649 for the larger setup. We book it around your insurance renewal or the builder’s pre-qualification, because that is when the question comes back.
What we do not do
This is an assessment, not an ongoing service. It does not fix what it finds. Fixing is quoted from the report, and you are free to take the list to anyone. We do not sell security monitoring, because what goes wrong in a business your size is caught by checking on a date, not by watching. Why, in more detail.
Who is asking you for this, and why
Usually one of three: a head contractor’s pre-qualification process, an insurer renewing a policy, or your own instinct that you are exposed and no way to prove it either way. All three want the same thing, which is evidence rather than an assurance.
Common questions
Is this the same as the free online cyber checks? No. A self-assessment tool is self-reported and not evidence of anything, which is fine for your own information but is not what a head contractor is actually asking for. This review is checked, not self-reported, which is what makes the document worth handing over.
What happens to the things it finds? You get a ranked, costed list. Nothing is fixed automatically and nothing is assumed — we quote remediation separately, and you are free to take the findings and the quote to anyone.
Is my business too small for this to matter? If you hold customer details, send invoices, or would be in real trouble losing system access for a week, it applies to you. It particularly applies if someone has already asked you the question and you did not have an answer.
How is this different to the Tech Health Check? The Tech Health Check is broader and lighter — a summary across everything technology touches in the business. This is narrower and deeper on cyber risk specifically, and it is the one built to be handed to someone else as evidence.
Next step
Get in touch and tell us three things: how many computers and phones reach your systems, how many people have their own login, and what platforms you run. That is enough for us to give you a scope and a price before anything is booked.