Drag
loader

Contact info

Email
hello@ferressystems.com.au
Based in
Melbourne, Victoria

Follow us

Talk to the team
Talk to the team
All services // CYBERSECURITY GOVERNANCE AND COMPLIANCE

Evidence is a folder, not a scramble

The questionnaire arrived, the deadline is Friday, and the honest answers are all educated guesses.

Essential Eight compliance, ISO 27001 readiness, security policies people can actually follow, incident response plans that have been tested, Privacy Act readiness, vendor and supply chain risk, and staff training. Written for your business, not lifted from a template pack.

Scope this with us
 Free: The Essential Eight evidence checklist
// SOUND FAMILIAR

If two of these sound familiar, we should talk

The rest of this page covers what the work includes, what it produces and how it is priced.

01 An insurer or customer questionnaire is due and nobody can answer it confidently
02 You have policies, but they were downloaded and nobody has read them
03 There is an incident response plan that has never been opened, let alone tested
04 A supplier holds your data and nobody has ever asked them how they look after it
05 An enterprise customer has started asking about ISO 27001 and you do not know what that involves
06 A tender or enterprise customer wants Essential Eight evidence you cannot produce
// THE SCOPE, BOTH SIDES OF IT

What this is, and what it deliberately is not

What this is

  • Essential Eight assessment against where you genuinely are, and a plan to move up
  • ISO 27001 readiness and gap assessment, when a customer or tender has started asking for it
  • Security policies written for your business and short enough that staff read them
  • An incident response plan that gets tested in a room with your people, not just filed
  • Privacy Act and notifiable breach readiness, including who decides and how fast
  • Vendor and supply chain security: answering the questionnaires you receive, and asking the ones you should be sending
  • Staff security awareness training that treats people as capable adults
  • An evidence register holding the proof for each control

What this is not

  • Generic templates with your logo in the header
  • A certification. We prepare you for audit; an auditor certifies
  • A compliance score mistaken for being secure
// THE ENGAGEMENT, START TO FINISH

What actually happens after you say yes

Typically four to ten weeks

An Essential Eight assessment alone sits at the short end. A full policy set, tested response plan and evidence register sits at the long end.

01

Where you actually are

An honest assessment against the Essential Eight and whatever your customers or insurer are asking for. We look at what is configured, not what a policy claims. The gap between the two is usually the finding.

02

What you actually need

Compliance work expands to fill any budget you give it. We work out what is genuinely required by your obligations, your insurer and your customers, and what is optional, then say plainly which is which.

03

Write what is missing

Policies and plans in language your staff can follow. If a document only exists to be waved at an auditor, we would rather not write it.

04

Test the plan

The incident response plan gets walked through in a room with your people and a realistic scenario. Plans that have never been tested fail on contact, usually on something mundane like nobody knowing who can authorise shutting a system down.

05

Train the people

Staff training built on what actually reaches your business rather than generic phishing slides. Blame-free, because a culture where people hide mistakes is worse than the mistakes.

06

Build the evidence register

One place holding the evidence for each control, kept current. The whole point is that the next insurer questionnaire or customer audit becomes a forwarding job rather than a fortnight of panic.

// WHAT YOU WALK AWAY WITH

Things you can hold, forward and act on

The artefacts this work produces, named so you know what you are buying.

Written report

Essential Eight assessment

Your genuine maturity per control, with the evidence behind each rating

Written documents

Policy set

The policies your obligations actually call for, and no more

Written document

Incident response plan

With named roles and decision authority, and tested rather than filed

Live session

Tabletop exercise

Your people, a realistic scenario, and a written list of what broke

Live session

Staff training

Based on what actually targets your sector

Living document

Evidence register

The dated evidence behind each control, in one place

// NOT A MOCK-UP

What an assessor actually accepts

A page straight out of the Essential Eight evidence checklist, shown as it is. Read the page, then decide whether the whole document is worth an email address.

Essential Eight Evidence Checklist CONTROL 07 OF 08 // MULTI-FACTOR AUTHENTICATION
EXAMPLES OF USEFUL EVIDENCE
  • An export showing the registered authentication methods for every account, including service, shared and break-glass accounts
  • The conditional access or equivalent policy showing multi-factor authentication is enforced rather than merely available, exported as configured
  • Sign-in log evidence over a defined window, interpreted rather than pasted, with service accounts, non-interactive authentication and token flows identified and explained
  • For shared mailboxes, evidence that direct sign-in is disabled rather than an attempt to show a registered second factor
WHERE IT USUALLY LIVES

Identity provider administration centre, under authentication methods and sign-in logs. Export as CSV with the generated timestamp intact.

COMMONLY REJECTED FAIL

"Multi-factor authentication is enabled for all staff." This describes intent, not state. It also usually turns out to exclude the accounts that matter most, being service accounts, shared mailboxes, the founder, and whoever complained loudest during rollout.

ALSO REJECTED FAIL

Registration state offered as proof of enforcement. Registration shows a method exists on the account. Enforcement is a policy question, and the two diverge more often than people expect.

WHAT A USABLE ARTEFACT LOOKS LIKE PASS

An export with its own header block intact, carrying the source system, a generation timestamp, the query scope, the row count against the directory total, and the person who ran it. An assessor can tell what population it covers without asking a single follow-up question.

Fillable checklist · 20 pages Read the rest of this page
Send me the checklist
// WHAT IT COSTS

Fixed price per scope, or staged

Most organisations do not need everything at once, so the work can be staged. An Essential Eight assessment on its own is a common and sensible starting point, and it tells you what the rest of the work should be before you commit to it.

Get a written scope
WHAT MOVES THE NUMBER
How many staff and sites the policies and training have to cover
Whether you are working to the Essential Eight alone or to a customer or industry framework as well
How much already exists and is worth keeping rather than rewriting
Whether you want the evidence register maintained afterwards or handed over
// FROM THE FILE

One of these, in the field

DECLASSIFIED

The questionnaire that arrived on a Thursday

A funding body sent a 68-question security questionnaire with a two-week deadline. The honest answer to most of it was we do not know. Six weeks later the same questions took forty minutes, because the evidence had somewhere to live.

Read the case file
// QUESTIONS, ANSWERED

Asked before signing anything

No. The Essential Eight is where most Australian businesses start, because it is what insurers and tenders ask about. The same work covers ISO 27001 readiness, policies, incident response planning and testing, Privacy Act readiness, vendor risk and staff training. Tell us what triggered the question, because the right scope is usually driven by who is asking you rather than by a framework.

It is mandatory for most non-corporate Commonwealth entities and not law for private businesses. In practice it arrives through the side door anyway, via cyber insurance questionnaires, tenders and enterprise customer requirements, which is why most of the businesses we work with end up adopting it.

Read the plain-English guide

No. Certification is issued by an independent certification body or auditor. We assess where you stand, do the work to close the gaps, and prepare the evidence so that audit goes smoothly.

Not usually. We start by reading what you have, and plenty of it is often fine and simply out of date. Working documents are kept rather than rewritten. What is normally missing is not the policies but the evidence that anyone follows them.

They answer different questions. GRC work proves and improves how you govern security. Managed security is the thing actually watching. A well-documented business with nothing monitoring it passes questionnaires and still has bad nights, so most clients want both eventually, but the GRC work stands alone.

There is a free Essential Eight readiness checklist that lists the gaps you report in about a minute, and nothing is stored. It is not an ASD maturity rating or a substitute for a proper assessment, but it is a quick place to start.

Try the readiness checklist
// OFTEN SCOPED TOGETHER

What usually comes with this

Security Assessments and Penetration Testing Find it before someone less friendly does Security Assessments and Penetration Testing, scope and pricing
IT Projects and Microsoft 365 The project nobody wants to own IT Projects and Microsoft 365, scope and pricing

Tell us the problem, not the solution.

Get in touch
Shapes Shapes