Most providers sell you an audit, hand over a PDF and disappear until next year. synfo runs compliance as a continuous managed service: your controls monitored monthly, evidence collected automatically, policies kept current, and your posture re-scored every quarter. The audit is how the engagement starts. The programme is what keeps you defensible. Included as an ongoing capability in the Enterprise tier of our managed services agreement, and available as a standalone programme to any Australian business.
Australian organisations are now asked to prove their security posture by three groups at once. Insurers price cyber cover on control-level answers. Enterprise clients run third-party risk reviews before they will sign. Regulators operate a mandatory breach notification regime with real consequences attached.
Each of them wants documented evidence that specific controls exist and work, on the day they ask. Essential Eight alignment, ISO 27001 certification and completed security questionnaires now appear as gating criteria in tenders, panel arrangements and supplier onboarding, and organisations that cannot answer are quietly removed from the shortlist without being told why.
The harder problem is decay. Staff join and leave, a new SaaS platform arrives without IT, an exception granted for a project quietly becomes permanent. Environments drift within weeks, which means an annual snapshot is out of date long before it is next refreshed. The organisations that stay compliant are the ones running a cycle, not the ones repeating a project every twelve months.
This is the part most of the market doesn't sell. A point-in-time audit tells you where you stood on one day; a managed compliance programme keeps you defensible every day in between. In the Enterprise tier of our managed services agreement, compliance and GRC auditing runs as a standing capability alongside your vCIO engagement, with a defined monthly, quarterly and annual cadence and a named senior practitioner accountable for it.
A defined engagement that establishes where you actually stand. Valuable, necessary, and on its own insufficient. Available standalone to any Australian business, including organisations supported by another IT provider.
The audit becomes the baseline, and the programme keeps it true. Controls monitored continuously, evidence collected as it is generated, policies reviewed on schedule, and the scorecard re-issued each year without starting from scratch.
| Capability | Baseline auditPoint-in-time | Managed programmeEnterprise tier | + Managed ISMSAdd-on · requires Enterprise |
|---|---|---|---|
| Baseline assessment: establishing where you stand | |||
| Framework gap analysis | |||
| Essential Eight maturity rating | |||
| Verified asset & identity inventory | |||
| Governance & evidence review | |||
| Findings workshop | |||
| Continuous operation: keeping the baseline true | |||
| Continuous control monitoring | – | ||
| Drift alerting with owners | – | ||
| Automated evidence collection | – | ||
| Policy lifecycle & attestation | – | Optional | |
| Risk register & exception management | – | ||
| Third-party & vendor register | – | Optional | |
| Standing incident readiness | – | ||
| Governance & reporting: the cadence | |||
| Monthly posture report | – | ||
| Quarterly governance review | – | ||
| Quarterly board reporting pack | – | ||
| Annual re-audit & re-scored | – | ||
| Internal audit & management review | – | – | |
| Certification body coordination | – | – | |
| On demand: when someone asks you to prove it | |||
| Risk-rated remediation roadmap | |||
| Roadmap progress tracking | – | ||
| Cyber insurance questionnaires | Optional | ||
| Tender & supply chain schedules | – | ||
| Notifiable breach assessment support | – | ||
| What you receive | |||
| Executive summary | |||
| Maturity scorecard | |||
| Technical findings register | |||
| Evidence pack | |||
| Maintained policy set | – | Optional | |
| Statement of applicability | – | – | |
Hover any capability for a plain-English explanation. Every line in the managed programme is delivered on a defined cadence, not on request. Managed ISMS is an add-on to the Enterprise tier: faded ticks are already covered by Enterprise, solid ticks are what the add-on adds.
Security auditing is not reserved for the top of the range. Every synfo managed services tier includes baseline auditing of the foundational controls. What Enterprise adds is the governance layer: full compliance and GRC alignment, framework mapping, executive reporting and a vCIO engagement that owns the outcome. Where an organisation needs a formal management system on top of that, Managed ISMS is available as an add-on to any tier.
Included in Standard, Premium and Enterprise. A regular check that your foundational controls are doing what they should: multi-factor authentication, endpoint protection, backups, patching and licence compliance, with periodic system auditing against our standard operating environment.
Compare the tiersCompliance & GRC auditing and alignment, ongoing. Framework mapping, continuous control monitoring, policy lifecycle, risk register, quarterly governance reviews and annual re-audit, delivered inside the vCIO engagement that comes with Enterprise. Also available standalone.
See the Enterprise tierAdded to the Enterprise tier, for organisations pursuing or holding certification. A fully operated Information Security Management System aligned to ISO 27001, the Essential Eight and SOC 2, including internal audit schedule, management review, corrective action tracking and certification body coordination.
See the add-onsOnce the programme is running, compliance stops being an event and becomes a schedule. Four cycles, each with a defined output and a named owner.
Controls monitored and evidence captured as it is generated. Deviations raise an alert with an owner and a remediation date, so a gap discovered in June is closed in June rather than found at next year's audit.
A posture report covering control status, the drift register, remediation progress and anything that changed in your environment. Short, current, and written to be read by people who are not engineers.
Governance review at the leadership table, roadmap progress against risk, the policy review cycle and staff attestations, and a board pack ready to table. Your vCIO or vCISO chairs it.
Full re-audit, scorecard re-issued and re-evidenced, internal audit and management review completed. Any material change to the business triggers an out-of-cycle re-assessment of the affected domain.
Running a compliance programme on spreadsheets and shared drives works until the first time someone asks you to prove something. The managed programme is operated on a dedicated compliance and ISMS platform that maps your controls to the frameworks you're assessed against, collects the evidence automatically, and produces audit-ready reporting on demand. We deploy and operate the platform that suits your framework and budget, or work inside one you already licence.
Your control set is defined once and mapped across every framework that applies, so multi-framework organisations do the work once rather than three times.
The platform connects to the systems that generate proof and collects it continuously, replacing screenshots taken by hand the week before an audit.
A current view of every control, its status, its owner and its supporting evidence, accessible to your executive team rather than locked inside ours.
A maintained set of information security policies aligned to your framework, with the version history and acknowledgement records auditors ask for first.
Structured registers for organisational risk, treatment plans, exceptions and third-party suppliers, each with owners, review dates and linked evidence.
Reporting packs generated to order from a single source of truth, so the numbers never disagree with each other across audiences.
We assess and then continuously monitor against the framework that matters to your business, not a generic checklist. For most Australian SMBs that starts with the Essential Eight and the Privacy Act. For organisations selling into government, enterprise or regulated sectors, it usually extends to ISO 27001 or the ASD Information Security Manual. Where more than one applies, we map the controls once and report against each framework separately.
The Australian baseline. Eight mitigation strategies assessed individually against maturity levels zero to three, with the evidence required to support each rating. The most common starting point and the one most tender documents reference by name.
The international standard for an information security management system. We run the gap analysis against the current standard and its Annex A control set, build the statement of applicability, prepare the organisation for external certification, and then operate the management system through surveillance and recertification.
The full ISM control catalogue, relevant to organisations handling government data or operating under a security classification. Assessed by control, mapped to your system architecture, and reported against the applicable protection level.
Australian Privacy Principle obligations across collection, storage, access, disclosure and destruction of personal information, plus readiness for the Notifiable Data Breaches scheme. Reviewed as a set of operational controls, not a policy document.
Where a client operates internationally or reports to an offshore parent, we assess against the NIST Cybersecurity Framework functions or the CIS Critical Security Controls, and cross-map the findings back to the Essential Eight so one body of work satisfies both audiences.
Cyber insurance applications, enterprise third-party risk questionnaires and tender security schedules. We complete them from assessed evidence rather than assumption, and flag every answer that would not survive scrutiny before it is submitted.
Each strategy is assessed independently, and your overall maturity is set by the weakest of the eight rather than the average. Maturity Level 1 resists commodity attacks, Level 2 resists adversaries investing real effort, and Level 3 resists adaptive, targeted adversaries. We record the evidence behind every rating, then monitor all eight continuously so the score you quote in a tender is the score you actually hold.
Whether only approved executables, libraries, scripts and installers can run, and whether the ruleset is enforced rather than merely logged. Consistently the hardest of the eight to reach a meaningful level on.
Time to patch internet-facing applications and productivity software against the ACSC timeframes for each level, plus how quickly unsupported software is removed from the estate.
Whether macros are blocked for users without a demonstrated business need, whether macros from the internet are blocked outright, and whether execution events are reviewed rather than merely captured.
Browser, PDF reader and productivity suite hardening: blocked web advertising, disabled legacy plug-ins, restricted scripting, enforced through managed policy rather than local settings that drift.
Who holds privileged access, whether it is time-bound and justified, whether privileged accounts are separated from daily-use accounts, and whether that activity is logged in a form an auditor can review.
Patch cadence across workstations, servers, hypervisors and network devices against the ACSC timeframes, together with removal of operating systems no longer receiving vendor support.
Coverage across remote access, privileged accounts, internet-facing services and third parties holding your data, and whether the factors in use meet the phishing-resistance expectations of the level you claim.
Coverage, retention, immutability and separation from production credentials, plus whether restoration is tested to a schedule. Evidence of a successful restore is the control; the backup job itself is not.
Every programme starts with a defined, six-stage audit that establishes the baseline. Named deliverables at each stage, no open-ended discovery, no report that arrives three months later, and no findings your team hears about for the first time in a board pack.
We establish which frameworks apply, why, and to what part of the business. Scope is written down and agreed before any assessment begins, covering the systems, sites, entities and data classifications in and out of scope. Most disputed audit findings trace back to a scope that was never properly defined.
You cannot secure what you have not counted. We build a current, verified inventory of endpoints, servers, cloud tenants, identities, network devices, line-of-business applications and third-party data processors. This baseline becomes the denominator for every coverage percentage in the report, and the foundation the ongoing programme maintains.
Configuration review against each control in the selected framework: identity and conditional access, privileged access, endpoint hardening, patch cadence, email authentication, network segmentation, logging, encryption and backup. Assessed from the systems themselves, not from a questionnaire your team fills in.
Policies, procedures, registers and records. Whether the documented control matches the operating reality, whether exceptions are approved and time-bound, and whether an auditor could reconstruct what happened from what you keep. Technical controls without evidence do not pass an audit.
Every gap rated by likelihood and business impact, not by tool severity. We walk your leadership team through the findings in person before anything is finalised, so the report that reaches the board has already been tested against how the business actually operates.
The remediation roadmap is sequenced with owners, effort, indicative cost and dependencies, ordered by risk reduction per dollar. From there the control set is loaded into the compliance platform, monitoring begins, and the reporting rhythm starts. Where you would rather keep the assessor and the implementer separate, we hand the roadmap to your incumbent provider and monitor progress independently.
An audit that only looks at the firewall is not an audit. We assess the environment the way an attacker and an assessor both see it: as a chain of identity, device, data and process, where the weakest link determines the outcome. Each domain is baselined at audit and then tracked for the life of the programme.
Directory hygiene, conditional access, multi-factor coverage, legacy authentication, guest and external identities, service accounts, joiner-mover-leaver process and the actual state of privileged role assignment.
Managed versus unmanaged devices, disk encryption, endpoint detection coverage, local administrator rights, device compliance policy enforcement and the treatment of personal devices accessing corporate data.
Microsoft 365 and Azure tenant hardening, sharing and external collaboration settings, application consent, audit log retention, and the security posture of any other SaaS platform holding material business data.
SPF, DKIM and DMARC alignment and enforcement policy, inbound filtering effectiveness, impersonation and business email compromise controls, mail flow rules and the auditability of mailbox delegation.
Segmentation, firewall rule base hygiene, remote access architecture, wireless security, exposed services, certificate management and the state of vendor support on the devices holding the perimeter together.
Data classification, retention and destruction, encryption at rest and in transit, backup coverage and immutability, and documented evidence of restore testing. Cross-referenced with our cloud backup and disaster recovery standards.
Information security policy set, acceptable use, risk register, exception management, board reporting cadence, security roles and responsibilities, and whether the documented governance reflects what the organisation actually does.
Which vendors hold or can reach your data, what contractual security obligations exist, how vendor access is provisioned and revoked, and whether your critical suppliers can evidence their own posture when asked.
Incident response plan, defined severity levels and escalation paths, logging coverage and retention sufficient to investigate, notifiable breach assessment process, and whether the plan has ever been exercised rather than merely written.
The questions executives, boards, insurers and procurement teams ask before an engagement starts. Direct answers.
Both, and the ongoing programme is the point. The audit establishes the baseline; the managed programme keeps it current with continuous control monitoring, monthly posture reporting, quarterly governance reviews, policy lifecycle management and an annual re-audit. Compliance and GRC auditing runs as a standing capability in the Enterprise tier of our managed services agreement, and the programme is also available standalone to any Australian business.
The Essential Eight is a set of eight baseline mitigation strategies published by the Australian Cyber Security Centre, each assessed at maturity level zero through three. It is mandatory for many Commonwealth entities and increasingly written into state government contracts, tender schedules, supply chain questionnaires and insurance policies. Most private businesses are not legally bound to it, but are effectively required to demonstrate alignment in order to win or keep certain work.
A dedicated compliance and ISMS platform that maps your control set across every framework you're assessed against, connects to your identity provider, cloud tenant, endpoint management and ticketing systems to collect evidence continuously, and produces audit-ready reporting on demand. Your executive team gets direct access to the posture dashboard. We are platform-agnostic: we deploy and operate the tool that suits your framework and budget, or work inside one you already licence.
No, and no legitimate provider can. Certification is issued only by an accredited certification body, and the same organisation cannot both implement and certify a management system. We perform the gap analysis, build the control set and evidence trail, prepare your team, coordinate the external certification body through stage one and stage two, and then operate the management system through surveillance audits and recertification. Keeping the assessor and the certifier separate is the point.
An audit assesses whether the right controls exist, are configured correctly and can be evidenced. A penetration test attempts to break them. The audit tells you what is missing across the whole environment; the penetration test tells you what an attacker can do with what remains. They answer different questions, and most organisations benefit from both, usually in that order.
A standard Essential Eight maturity assessment for a small to mid-sized Australian business typically runs three to four weeks from kick-off to final report. A full ISO 27001 readiness engagement is scoped in months rather than weeks because it covers governance and process as well as technical controls. Disruption is minimal: most of the technical assessment is read-only, and the demand on your team is a handful of interviews and access to documentation.
No. Both the audit and the ongoing compliance programme are available as standalone engagements to any Australian business, including organisations supported by another IT provider. Independent assessment is often more valuable when the assessor is not the incumbent, and we are comfortable handing the remediation roadmap to your existing partner to execute while we monitor progress.
We tell you immediately rather than waiting for the report. If the assessment surfaces an active compromise, an exposed service or a control failure that constitutes present danger, that goes to your nominated contact the same day with a recommended containment action. The written findings follow the process; genuine urgency does not wait for it.
A full re-audit annually, with the scorecard re-issued and re-evidenced, plus quarterly governance reviews against the remediation roadmap and monthly control reporting in between. Any material change triggers a re-assessment of the affected domain: a merger or acquisition, a platform migration, a significant headcount change, a new regulatory obligation or a security incident. The result is a posture position that is never more than a month out of date.
Begin with a free IT and security audit. We'll review your environment against the Essential Eight, show you where the evidence gaps are, and set out what an ongoing managed compliance programme would look like for your business. No commitment, no sales pressure, no offshore handoff.
Manage your tickets, view reports and access your IT documentation, all in one place.
Continue to the Client Portal