Know exactly where your controls fall short against a recognised framework, and leave with a roadmap your board, buyer or regulator can actually follow, backed by evidence rather than a checklist tick.
A security audit is a scoped, evidence-based assessment of whether controls meet an agreed framework or requirement at a point in time. Security assurance turns that assessment into a defensible view of risk, gaps and the work needed next; it is not a certification or a blanket compliance claim.
Australian buyers often ask about the Essential Eight, the Information Security Manual (ISM), ISO/IEC 27001 control mappings, or a client’s own standard. We will only use framework language that matches the scope of the engagement. We never describe the company as holding a certification it does not hold.
In particular, we will never use the phrase “IRAP certified” about the company. Any IRAP-related statement, if made at all, will name the assessed system, assessor, date and scope.
What a security audit can answer
Control coverage
Which requirements apply to the agreed boundary and where evidence supports implementation.
Operating effectiveness
Whether selected controls are demonstrably operating, not merely documented.
Material gaps
Which weaknesses matter most to the organisation, buyer or assurance objective.
Improvement sequence
What should change first, who should own it and what evidence will demonstrate closure.
Audit, assessment and certification
A security audit gathers and evaluates evidence against agreed criteria. A gap or maturity assessment describes the current state using a stated method. Certification or accreditation is a separate decision made only by the relevant scheme and authorised assessors. This service does not turn a scoped review into a company-wide badge.
Current landscape
A credible assurance result names the framework, system boundary, evidence, method and assessment date. A percentage without those facts is not enough.
The Information Security Manual (ISM) is ASD’s cyber security framework: hundreds of controls an organisation applies through its own risk management process. The Essential Eight is eight prioritised mitigation strategies derived from that manual, application control, patch applications, patch operating systems, multi-factor authentication, restrict administrative privileges, restrict Microsoft Office macros, user application hardening, and regular backups. An Essential Eight maturity score is not “ISM complete”. ASD has said as much for years.
In June 2026 ASD opened consultation on evolving the Essential Eight into an Essentials series (first chapter: Essentials for enterprise IT), because cloud, software-as-a-service, OT and generative AI change the control set. Consultation closed in July 2026. Until ASD publishes the new chapter and starts deprecation, the November 2023 Essential Eight remains the live baseline. We will describe an engagement against the document that is actually in force on the assessment date.
IRAP means Infosec Registered Assessors Program. IRAP assesses a system against the ISM, at a date, with a named assessor. It is not a company badge. We will never write “IRAP certified” about Cybersecurity Engineering Pty Ltd.
In (ISC)² terms this is audit/auditing (tools, processes and activities used to perform compliance reviews), governance (how decisions are made) and compliance (adherence to a mandate). It is not a penetration test and it is not certification. Sources: Essential Eight; ISM; (ISC)² CISSP student glossary.
When this fits
Framework baseline
You need an honest view against the Essential Eight, ISM or another agreed requirement.
Buyer assurance
A board, client, insurer or acquirer needs evidence about defined controls and boundaries.
Assessment readiness
You want to identify and prioritise gaps before a formal assessment or procurement gate.
Unowned findings
A previous review produced scores or findings but no accountable improvement sequence.
Decisions and outcomes
The review is built to answer: where do our controls fall short against the standard we have chosen, how material is each gap, and what should be fixed first, by whom, by when.
Scope
Typically included
- Mapping of evidence to each control in the chosen framework
- A maturity or gap assessment with a clear, stated rating methodology
- A prioritised roadmap with ownership, not just a findings list
Not included unless agreed
- Formal certification or accreditation decisions, those belong to the relevant scheme and its own assessors
- Any implication of blanket compliance without a stated scope, boundary and assessment date
Deliverables
- An evidence-to-control matrix
- A gap or maturity report with methodology
- A prioritised roadmap with clear ownership
Process
Authorise
Confirm scope and stakeholders.
Scope
Select the relevant framework and boundary.
Assess
Gather evidence against each control.
Report and remediate
Deliver gaps, roadmap and ownership.
Methods and standards
Framework language is used only where it matches current, evidenced capability for the specific engagement, never as a blanket company-wide claim. Official Essential Eight and ISM guidance is published by the Australian Signals Directorate at cyber.gov.au.
Security and evidence
No public evidence upload
This page never accepts malware, source code or evidence. Secure transfer is agreed only after authorisation and scoping, outside this website.
Limitations
What this engagement cannot promise
An assurance review reflects a specific scope and a point in time. It is not a certification, and does not itself confer one.
Common questions
What evidence should we prepare for a security audit?
The evidence depends on scope, but commonly includes policies, system boundaries, configuration records, access reviews, change records, backup and recovery evidence, security monitoring outputs and proof that controls operate over time. The request list is agreed before collection begins.
Can you assess us against the Essential Eight?
We can review evidence against the Essential Eight strategies as a scoped assurance engagement. That is not the same as an ASD assessment, and it is not a certification. Maturity levels are stated with the methodology used, for the systems in scope, at a point in time.
Are you IRAP certified?
No company-wide IRAP claim is made here. IRAP assesses a system, not a brand. If an assessed-system statement is ever published, it will name the system, assessor, date and scope.
Will this replace a penetration test?
No. An audit asks whether controls exist and operate. A penetration test asks whether an attacker can still get through. Many procurement processes want both.
Case Studies
Current published case studies. Public-source illustrations are labelled clearly and are not presented as client engagements. View all case studies.
Six gift cards and a forged executive
A courier employee bought six $500 prepaid cards after mail that looked like it came from an executive. There was no malware. The missing control sat in the payment process.
More than $150,000 to a supplier who never changed banks
A construction firm paid an invoice twice after a supplier mailbox was taken over. No callback. No funds recovered.
The backup that encrypted itself
Ransomware at an auto parts store encrypted the live files and the backup disk still plugged into the same machine. Years of data went with the old system.
Related
Ready to talk about your situation?
Tell us the high-level scope. No malware, source code or evidence – just enough for us to route you safely.