Frameworks
Recognised measures of good practice.
- ASD Essentials, previously the Essential Eight
- The Essential Eight, where a regulator, insurer or contract still requires it
- ISO 27001 technical controls
- The NIST Cybersecurity Framework
Security and Compliance Audit
One audit for your security, your infrastructure and your obligations.
A paid audit of your whole environment, including identity, devices, servers, networks, cloud tenants and backups, with internal and external vulnerability scanning. We test your controls against ASD Essentials and the obligations you carry, then give you the evidence, a risk register and a costed plan.
- Eight areas
- Vulnerability scanning
- ASD Essentials and your obligations
Recognise this?
When the questions start arriving.
Insurance renewal
The cyber insurance questionnaire asks about patching, admin access, backups and incident response, and wants evidence.
Client due diligence
A large client sends a security questionnaire before they will sign or renew.
Privacy obligations
You hold personal information and need to show how you protect it, and what would happen in a breach.
Board or owner assurance
Leadership wants to know, in plain terms, whether the controls work.
Snapshot or audit?
Two ways to find out where you stand.
The free security snapshot is a quick, high-level check of Microsoft 365. The audit covers the whole environment in depth.
| What each one covers | Free snapshot | Full audit |
|---|---|---|
| Microsoft 365 identity and sign-in checks | Included | Included |
| Email security | Partly included | Included |
| Endpoints and patching | Not included | Included |
| Network and firewalls | Not included | Included |
| Servers and storage | Not included | Included |
| Backup and recovery | Not included | Included |
| Internal and external vulnerability scanning | Not included | Included |
| Policies and documentation | Not included | Included |
| ASD Essentials position, by domain | Not included | Included |
| Controls tested against your obligations | Not included | Included |
| Costed remediation roadmap | Not included | Included |
Partly included means the snapshot looks at the headline settings only.
Coverage
What the audit covers.
Standards and obligations
What we audit against.
Obligations
What others require of you.
- IT controls supporting Privacy Act obligations and the Notifiable Data Breaches scheme
- Cyber insurance questionnaires
- Client and supplier security questionnaires
Controls
Controls we test in practice.
- Access and administrative privileges
- Logging, monitoring and detection
- Patching and device management
- Backup, retention and recovery
How it runs
From scope to read-out.
- 01
Scope
We agree the sites, systems and cloud tenants in scope, the obligations you need to meet, and who we need to talk to.
- 02
Collect
We gather configuration, logs and documentation, and run internal and external vulnerability scans against your network and internet-facing systems.
- 03
Review
We assess each area on site and remotely against ASD Essentials, current good practice and the obligations agreed at the start.
- 04
Report
Findings go into a risk register, each with a rating, an owner and a recommended fix.
- 05
Read-out
We walk your leadership through the results and the roadmap, and answer their questions.
First step
Talk to us about an audit.
We scope every audit to your environment and the obligations you need to meet. Send us the questionnaire in front of you, or tell us about your business, and we will come back with a proposal.
We audit the IT controls and give you the evidence. How an obligation applies to your business is a legal question, and we work alongside your adviser on it.
Request an audit proposalWhat you receive
- A risk register with ratings, owners and dates
- Internal and external vulnerability scan results
- Your ASD Essentials position, domain by domain
- Controls tested against your agreed obligations, with the evidence
- A twelve-month remediation roadmap with indicative costs
- A leadership read-out
Questions
Questions about the audit.
Do we have to be an IT Logic client?
No. The audit stands on its own, and the findings are yours to act on with us, your own team or another provider.
How much does it cost, and how long does it take?
We quote each audit on your requirements: the number of sites, systems and cloud tenants, the obligations in scope, and how deep you need us to go. Get in touch and we will scope it with you, then confirm the price and timeline before anything starts.
Does the audit include a penetration test?
No. The audit includes internal and external vulnerability scanning, which finds known weaknesses across your network and internet-facing systems. The results are in the report. A penetration test, where someone actively tries to break in, is a separate exercise.
We were working towards an Essential Eight maturity level. Is that wasted?
No. ASD Essentials evolved from the Essential Eight, and existing controls and evidence carry forward. If a regulator, insurer or contract still asks for an Essential Eight maturity level, we assess against that as well.
How often should we audit?
At least once a year, and before a major renewal or client review. Each round is quicker because the evidence is already organised, and we keep the history of every round so you can show an auditor or insurer how your controls have changed.