Skip to content
ISO 27001 certified
Client portal
Menu

Cyber security compliance in Perth

Compliance you can actually show someone.

The Privacy Act, the Essential Eight, ASIC expectations and cyber insurance forms all end up asking the same thing: can you prove it? We set your IT up properly, then write down the evidence, so the answer is yes.

Book a free compliance review Call an engineer
  • Every review Evidence refreshed, not written once and forgotten
  • Plain English Policies your staff will actually read
  • 0% Offshored. Data questions answered in Perth
ISO/IEC 27001:2022 certified by BSI, certificate IS 840964

ISO/IEC 27001:2022 certified by BSI Check BSI's register for certificate IS 840964

A navy ring binder, a pen and blank pages on an office desk beside a closed laptop.
Example evidence pack Up to date
MFA on every account
Enforced
Backups
Validated
Incident response plan
Signed off
Staff phishing training
Logged

Proving compliance to insurers and clients

Same question. Very different week.

An insurer, a licensee or a big client asks how you protect their data. Here’s what that looks like with and without the groundwork done. Pick a situation.

Your cyber insurance renewal arrives with a long security questionnaire.

Scrambling for answers

  1. Forward it to ITThey reply with questions of their own.
  2. Guess the answers“Do we have MFA on everything?” Probably.
  3. Tick yes to be safeAnd hope nobody checks.
  4. Claim at riskA wrong answer can give the insurer grounds to decline.

Premium paid. Cover uncertain.

With CCP

  1. Send it to usWe answer from what’s actually configured.
  2. Evidence attachedReports and screenshots, not guesses.
  3. Gaps flagged plainlyIf an answer is no, we tell you, and how to fix it.
  4. Back within daysSigned off by you, with nothing to hide.

Every answer true.

A staff mailbox is compromised and client data may be exposed.

Scrambling for answers

  1. Noticed lateA client asks about a strange invoice email.
  2. No planWho do we call? What do we check?
  3. Unsure what leakedLogs weren’t kept long enough to tell.
  4. Guessing about the OAICIs it notifiable? Nobody knows.

Days of panic.

With CCP

  1. Contained quicklyAccount locked, sessions revoked, mail rules checked.
  2. Plan followedYour incident response plan says who does what.
  3. Scope confirmedSign-in and mailbox logs show what was accessed.
  4. Assessment documentedThe facts you need to decide on notifying the Office of the Australian Information Commissioner (OAIC) and clients.

Handled, and on record.

A major client sends a supplier security questionnaire.

Scrambling for answers

  1. Stuck in an inboxNobody’s sure who owns it.
  2. No policies to attachOr a template from 2017.
  3. Deadline slipsThe client starts asking questions.
  4. Work at riskSecurity becomes the reason you lose the contract.

Lost on paperwork.

With CCP

  1. We draft the answersFrom your documented setup and policies.
  2. Policies ready to attachCurrent, signed off and specific to you.
  3. You review and sendPlain English, no overclaiming.
  4. Kept for next timeAnswers filed in your evidence pack.

Sent on time, and true.

Your licensee asks for evidence of cyber risk controls.

Scrambling for answers

  1. Hunt for documentsOld policies in someone’s personal drive.
  2. Ask the IT providerThey send a server list. Not what was asked.
  3. Answers don’t matchThe policy says MFA. Half the accounts don’t have it.
  4. Findings to fixNow with a deadline.

Findings, and a deadline.

With CCP

  1. Evidence pack readyControls, policies and reports in one place.
  2. Matches realityBecause we configured it, and we check it.
  3. We attendAn engineer answers the technical questions.
  4. Improvements plannedAnything outstanding has an owner and a date.

Reviewed without drama.

Cyber security compliance standards in Australia

One set of controls. Every framework.

Most frameworks ask for the same things: multi-factor authentication (MFA), patching, backups, access control and a response plan. We build them once, then map them to each obligation that applies to you.

  • Privacy Act & Notifiable Data Breaches

    Reasonable steps to protect personal information, and a tested process to assess and report an eligible data breach.

  • Essential Eight

    The Australian Signals Directorate’s (ASD) baseline controls, assessed against the maturity model and uplifted in a practical order.

  • ASIC cyber resilience

    Since ASIC v RI Advice (2022), Australian financial services licensees are expected to manage cyber risk adequately. We give you the controls and records to show it.

  • Tax practitioner obligations

    ATO security requirements for online services, and the client-data handling expected of registered tax agents.

  • Cyber insurance

    Questionnaires answered accurately from what’s configured, so a claim isn’t undone by a wrong tick.

  • Client & supplier due diligence

    Security questionnaires from larger clients, answered with evidence rather than optimism.

What’s included in compliance and governance

Governance, without hiring a compliance department.

Practical, documented and kept current. The + Compliance and Complete plans include staff training, vendor reviews and, from 30 seats, the Technology Success Program. Policy and evidence work is quoted as a fixed fee after a free review.

A card access reader beside a glass office door, with a visitor sign-in tablet on a stand in the entry.

  • Gap assessment

    Where you stand against the obligations that apply to you, in plain English.

  • Policies written for you

    Information security, acceptable use, access control and incident response. Specific to you, not templates.

  • Incident response plan

    Who does what in the first hour, day and week, including data breach assessment steps.

  • Evidence pack

    Reports and screenshots showing controls are in place, refreshed at every review.

  • Access reviews

    Who can see what, checked regularly. Leavers removed the day they go.

  • Staff training records

    Phishing simulations and awareness training, reported so you can show an auditor.

  • Compliance tracking

    Obligations from your licensee, insurer and clients tracked in regular Technology Success meetings.

  • Questionnaire support

    Insurance, licensee and client forms drafted from real configuration.

  • Partner & board reporting

    A short, readable summary of your security posture for decision-makers.

  • Password & MFA hygiene

    A managed password manager, and MFA on every account that supports it.

  • Vendor risk checks

    Key software and cloud suppliers reviewed for how they handle your data.

  • Controls, not just paperwork

    Policies only count if the settings match. Our security team does the technical work.

    See our cybersecurity services

Client reviews of our compliance work

Law firms trust us with client confidentiality.

“Tim identified and rectified the issues straight away… I highly recommend CCP for their knowledge and prompt support.”

MA Monique Atkinson · CGL Legal

How a compliance gap assessment works

From “are we compliant?” to “here’s the proof.”

No 200-page report. A clear list of what to fix, in the order that matters.

  1. Step 1 · Free

    A compliance conversation

    45 minutes on which obligations apply to you, and a light-touch check of the controls behind them.

  2. Step 2 · Within a week

    Gap report and fixed quote

    What’s in place, what’s missing and what matters most, in priority order and plain English.

  3. Step 3 · Ongoing

    Build, evidence, review

    We close the gaps, write it down and refresh your evidence at every review.

Cyber security compliance questions

Straight answers.

Or skip the reading: call (08) 9467 2269 and ask an engineer.
Does the Privacy Act apply to my business?
Most businesses with annual turnover over $3 million are covered, and some smaller ones are too, such as health service providers. Anyone handling tax file numbers must follow the TFN Rule regardless of size. We’ll help you confirm where you stand.
Do we need Essential Eight Maturity Level Three?
Rarely. For most professional firms, Maturity Level One or Two is the realistic, defensible target. We recommend a level based on your risk, not our invoice.
Can you guarantee we’re compliant?
No provider can. What we do is put the controls in place, document them and keep the evidence current, so you can show reasonable steps were taken.
Do you replace our compliance manager or lawyer?
No. We handle the IT and security side and work alongside your compliance team, licensee or legal adviser.
How much does compliance support cost?
Policy and evidence work is quoted as a fixed fee after the free review, based on the obligations that apply to you. The + Compliance and Complete plans add security training, application control, vulnerability scanning, centralised logging and vendor reviews, plus the Technology Success Program from 30 seats. Rates are on the pricing page.

Know where you stand before someone asks.

Book a free 45-minute compliance review with a Perth engineer. You get a plain-English summary of which obligations apply, what’s in place and what’s missing. It’s yours to keep either way.

Or call (08) 9467 2269

What’s bugging you
Staff

A Perth engineer, not a salesperson, replies within one business day.

We hold ISO/IEC 27001:2022 certification from BSI, certificate IS 840964.

Call an engineer Free review