Drag
loader

Contact info

Email
hello@ferressystems.com.au
Based in
Melbourne, Victoria

Follow us

Talk to the team
Talk to the team
// SECURITY BASELINE ASSESSMENT

Most organisations have no idea what their Microsoft 365 environment actually looks like

and the honest ones will tell you their answers on the insurance renewal form were educated guesses. The Security Baseline Assessment fixes that for $495.

Book the assessment
 Free first Run the Exposure Check
FIXED PRICE
$495+ GST
Duration3 business days
AccessRead-only
ScopeMicrosoft 365 and Entra
Findings mapped toEssential Eight, ISO 27001 controls
Data residencyAustralia

Go on to a managed agreement within 60 days and the full $495 comes off your onboarding.

// WHAT YOU ARE BUYING

We take read-only access to your Microsoft 365 and Entra environment for three business days. We don't change anything, and the access comes out when the report goes in. What you get back is a written assessment scored against the Essential Eight and ISO 27001, a plain-English explanation of the five risks that matter most for a business your size, a full findings register, and a 90-day roadmap that separates what should be fixed straight away from what needs ongoing attention. We'll walk you through all of it on a call.

Your data stays in Australia the whole way through, and it's deleted after twelve months. If you go on to a managed agreement with Ferres Systems within 60 days, the full $495 comes off your onboarding.

// THE TWO FRAMEWORKS

Two yardsticks, and what each one is

What each framework is, and how this assessment uses it.

FRAMEWORK 01

The Essential Eight

Eight specific technical controls published by the Australian Signals Directorate, through the Australian Cyber Security Centre.

It is not a law and it is not a certification. It is a prioritised baseline: the eight things that stop or slow the widest range of real attacks for the least effort. Each control is measured on a maturity scale from Level Zero to Level Three.

It matters to you because it is what Australian cyber insurers, tender panels and enterprise customers increasingly ask about by name. It is short, concrete and technical, which is exactly why it is the right yardstick for a Microsoft 365 environment.

  • Australian, published by the ASD
  • Eight controls, four maturity levels
  • Technical and specific
  • Asked for by insurers and tenders
The Essential Eight explained in full
FRAMEWORK 02

ISO/IEC 27001

The international standard for an information security management system, published jointly by ISO and the IEC.

Where the Essential Eight tells you which controls to turn on, ISO 27001 is about how security is governed: how risks are identified and accepted, who owns what, how decisions are recorded, and how the whole thing is reviewed rather than set up once and forgotten.

It is broader and less technical, and it is the framework larger customers and offshore partners recognise. We map tenant findings to its relevant controls so the report is useful in a procurement conversation as well as a technical one.

  • International, recognised worldwide
  • A management system, not a control list
  • Governance, risk and accountability
  • Recognised in enterprise procurement
How we build the evidence for it

What this is not: this assessment does not certify you against ISO 27001, and nobody can certify you against the Essential Eight because it is not a certification scheme. It is also not a full, organisation-wide maturity assessment. It looks at your Microsoft 365 and Entra tenant and maps what it finds to the relevant Essential Eight and ISO 27001 controls. Systems outside the tenant, such as on-premises servers or line-of-business applications, are not assessed. What you get is a clear picture of where the tenant stands and evidence that an auditor or certification body can use.

// WHAT YOU GET BACK

Five things, all of them yours

Everything below is included in the price. There is no premium tier and no findings held back for the version that costs more.

01

Written assessment

What we found in your Microsoft 365 and Entra tenant, mapped to the relevant Essential Eight and ISO 27001 controls, with the evidence behind each finding

02

Your top five risks

In plain English, chosen for a business your size rather than copied from a generic risk register

03

Full findings register

Everything found, not just the highlights, so nothing is quietly dropped for being awkward

04

90-day roadmap

Split into what should be fixed straight away and what needs ongoing attention

05

Findings walkthrough

A call where we take you through all of it and answer the question everyone actually has, which is what to do first

// THE THREE DAYS

What happens, and when it stops

Day 1 01

Read-only access granted

You grant read-only access to your Microsoft 365 and Entra environment. Read-only means exactly that: we can look, and we cannot change anything even by accident.

Day 1 to 2 02

We look at everything

Identity and access, mail flow and authentication, device posture, sharing and data handling, admin roles, logging, and backup. Configuration as it actually is, not as a policy document claims.

Day 2 to 3 03

Mapping and writing

Findings mapped to the relevant Essential Eight and ISO 27001 controls, ranked by what would do the most damage to a business your size, and written so a director can act on them.

Day 3 04

Report in, access out

The report goes in and the access comes out on the same day. You do not have to remember to ask, and you do not have a standing set of credentials belonging to a supplier.

After delivery 05

The walkthrough

A call to take you through the findings and the roadmap. No hard sell attached, because you have already paid for the work.

Melbourne based Australian owned and operated, working nationally
Data stays in Australia For the whole engagement, then deleted after twelve months
Read-only, then removed Nothing changed, and access out the day the report goes in
We teach this Our team teaches cybersecurity and speaks at security conferences
// QUESTIONS, ANSWERED

Asked before granting access

It means the access we are granted cannot modify your environment. We can read configuration and logs, and we cannot change a setting, add an account or alter a policy even if we wanted to. The access is removed the day the report is delivered.

No. Nothing is installed, nothing is changed and no agent is deployed. Your staff will not notice the assessment is happening. The only time you hear from us during the three days is if we find something serious enough that waiting for the report would be irresponsible.

No. The price is $495 plus GST, which is $544.50 in total. It is fixed for the scope described on this page: your Microsoft 365 and Entra tenant, over three business days.

It stays in Australia for the whole engagement and it is deleted after twelve months. What we hold is the evidence behind the findings, so that if an insurer or auditor questions a rating a year from now, we can show our working.

No, and they answer different questions. This assessment reads how your Microsoft 365 and Entra environment is configured, using read-only access you grant, and changes nothing. A penetration test, with your authorisation, actively tries to exploit weaknesses to show what an attacker could do. It can be external, from the internet, internal, from inside your network, or aimed at a particular web application. For many businesses on Microsoft 365 this assessment is the more useful first step.

See how penetration testing runs

Then this particular assessment is not the right fit. A scoped security assessment covers similar ground for whatever you run, and is quoted against that scope.

Yes. We publish a redacted sample penetration test report, and the free external Exposure Check sends you a real Ferres Systems report on your own domain, so you can judge the writing before you spend anything.

See the free resources

Stop guessing on the renewal form.

Book the assessment
Shapes Shapes