--- title: "Cyber Security Compliance and Governance in Perth | CCP" description: "Cyber security compliance for Perth businesses: Privacy Act, Essential Eight, ASIC and cyber insurance evidence, with controls set up and records kept current." url: "https://ccp.com.au/services/compliance/" --- # Cyber security compliance in Perth ## Compliance you can actually show someone. The Privacy Act, the Essential Eight, ASIC expectations and cyber insurance forms all end up asking the same thing: can you prove it? We set your IT up properly, then write down the evidence, so the answer is yes. - **Every review** Evidence refreshed, not written once and forgotten - **Plain English** Policies your staff will actually read - **0%** Offshored. Data questions answered in Perth Example evidence pack Up to date MFA on every account Enforced Backups Validated Incident response plan Signed off Staff phishing training Logged ## Proving compliance to insurers and clients ### Same question. Very different week. An insurer, a licensee or a big client asks how you protect their data. Here’s what that looks like with and without the groundwork done. Pick a situation. #### Your cyber insurance renewal arrives with a long security questionnaire. Scrambling for answers 1. Forward it to IT They reply with questions of their own. 2. Guess the answers “Do we have MFA on everything?” Probably. 3. Tick yes to be safe And hope nobody checks. 4. Claim at risk A wrong answer can give the insurer grounds to decline. Premium paid. Cover uncertain. With CCP 1. Send it to us We answer from what’s actually configured. 2. Evidence attached Reports and screenshots, not guesses. 3. Gaps flagged plainly If an answer is no, we tell you, and how to fix it. 4. Back within days Signed off by you, with nothing to hide. Every answer true. #### A staff mailbox is compromised and client data may be exposed. Scrambling for answers 1. Noticed late A client asks about a strange invoice email. 2. No plan Who do we call? What do we check? 3. Unsure what leaked Logs weren’t kept long enough to tell. 4. Guessing about the OAIC Is it notifiable? Nobody knows. Days of panic. With CCP 1. Contained quickly Account locked, sessions revoked, mail rules checked. 2. Plan followed Your incident response plan says who does what. 3. Scope confirmed Sign-in and mailbox logs show what was accessed. 4. Assessment documented The facts you need to decide on notifying the Office of the Australian Information Commissioner (OAIC) and clients. Handled, and on record. #### A major client sends a supplier security questionnaire. Scrambling for answers 1. Stuck in an inbox Nobody’s sure who owns it. 2. No policies to attach Or a template from 2017. 3. Deadline slips The client starts asking questions. 4. Work at risk Security becomes the reason you lose the contract. Lost on paperwork. With CCP 1. We draft the answers From your documented setup and policies. 2. Policies ready to attach Current, signed off and specific to you. 3. You review and send Plain English, no overclaiming. 4. Kept for next time Answers filed in your evidence pack. Sent on time, and true. #### Your licensee asks for evidence of cyber risk controls. Scrambling for answers 1. Hunt for documents Old policies in someone’s personal drive. 2. Ask the IT provider They send a server list. Not what was asked. 3. Answers don’t match The policy says MFA. Half the accounts don’t have it. 4. Findings to fix Now with a deadline. Findings, and a deadline. With CCP 1. Evidence pack ready Controls, policies and reports in one place. 2. Matches reality Because we configured it, and we check it. 3. We attend An engineer answers the technical questions. 4. Improvements planned Anything outstanding has an owner and a date. Reviewed without drama. ## Cyber security compliance standards in Australia ### One set of controls. Every framework. Most frameworks ask for the same things: multi-factor authentication (MFA), patching, backups, access control and a response plan. We build them once, then map them to each obligation that applies to you. - #### Privacy Act & Notifiable Data Breaches Reasonable steps to protect personal information, and a tested process to assess and report an eligible data breach. - #### Essential Eight The Australian Signals Directorate’s (ASD) baseline controls, assessed against the maturity model and uplifted in a practical order. - [The Essential Eight, explained ](https://ccp.com.au/essential-eight/) - #### ASIC cyber resilience Since ASIC v RI Advice (2022), Australian financial services licensees are expected to manage cyber risk adequately. We give you the controls and records to show it. - [IT for financial advisers ](https://ccp.com.au/industries/financial-advisers/) - #### Tax practitioner obligations ATO security requirements for online services, and the client-data handling expected of registered tax agents. - [IT for accountants ](https://ccp.com.au/industries/accounting/) - #### Cyber insurance Questionnaires answered accurately from what’s configured, so a claim isn’t undone by a wrong tick. - #### Client & supplier due diligence Security questionnaires from larger clients, answered with evidence rather than optimism. ## What’s included in compliance and governance ### Governance, without hiring a compliance department. Practical, documented and kept current. The + Compliance and Complete plans include staff training, vendor reviews and, from 30 seats, the Technology Success Program. Policy and evidence work is quoted as a fixed fee after a free review. ![A card access reader beside a glass office door, with a visitor sign-in tablet on a stand in the entry.](https://ccp.com.au/_astro/feature.C6z8Yb6K_2995a9.webp) - #### Gap assessment Where you stand against the obligations that apply to you, in plain English. - #### Policies written for you Information security, acceptable use, access control and incident response. Specific to you, not templates. - #### Incident response plan Who does what in the first hour, day and week, including data breach assessment steps. - #### Evidence pack Reports and screenshots showing controls are in place, refreshed at every review. - #### Access reviews Who can see what, checked regularly. Leavers removed the day they go. - #### Staff training records Phishing simulations and awareness training, reported so you can show an auditor. - #### Compliance tracking Obligations from your licensee, insurer and clients tracked in regular Technology Success meetings. - #### Questionnaire support Insurance, licensee and client forms drafted from real configuration. - #### Partner & board reporting A short, readable summary of your security posture for decision-makers. - #### Password & MFA hygiene A managed password manager, and MFA on every account that supports it. - #### Vendor risk checks Key software and cloud suppliers reviewed for how they handle your data. - #### Controls, not just paperwork Policies only count if the settings match. Our security team does the technical work. [See our cybersecurity services](https://ccp.com.au/services/cybersecurity/) ## Client reviews of our compliance work ### Law firms trust us with client confidentiality. > “Tim identified and rectified the issues straight away… I highly recommend CCP for their knowledge and prompt support.” **Monique Atkinson** · CGL Legal ## How a compliance gap assessment works ### From “are we compliant?” to “here’s the proof.” No 200-page report. A clear list of what to fix, in the order that matters. 1. Step 1 · Free #### A compliance conversation 45 minutes on which obligations apply to you, and a light-touch check of the controls behind them. 2. Step 2 · Within a week #### Gap report and fixed quote What’s in place, what’s missing and what matters most, in priority order and plain English. 3. Step 3 · Ongoing #### Build, evidence, review We close the gaps, write it down and refresh your evidence at every review. ## Cyber security compliance questions ### Straight answers. Or skip the reading: call [(08) 9467 2269](tel:+61894672269) and ask an engineer. ### Does the Privacy Act apply to my business? Most businesses with annual turnover over $3 million are covered, and some smaller ones are too, such as health service providers. Anyone handling tax file numbers must follow the TFN Rule regardless of size. We’ll help you confirm where you stand. ### Do we need Essential Eight Maturity Level Three? Rarely. For most professional firms, Maturity Level One or Two is the realistic, defensible target. We recommend a level based on your risk, not our invoice. ### Can you guarantee we’re compliant? No provider can. What we do is put the controls in place, document them and keep the evidence current, so you can show reasonable steps were taken. ### Do you replace our compliance manager or lawyer? No. We handle the IT and security side and work alongside your compliance team, licensee or legal adviser. ### How much does compliance support cost? Policy and evidence work is quoted as a fixed fee after the free review, based on the obligations that apply to you. The + Compliance and Complete plans add security training, application control, vulnerability scanning, centralised logging and vendor reviews, plus the Technology Success Program from 30 seats. Rates are on the [pricing page](https://ccp.com.au/pricing/).