← Cyber ServicesYour Journey

Most AU and NZ businesses follow one of five paths. Find yours.

Every security conversation starts with a trigger. The trigger shapes the path. These are the journeys we see most often — find the one that matches your situation and see the typical service sequence that follows.

🛡️ Insurance-driven

Your insurer is asking for evidence of controls

For businesses renewing cyber insurance, applying for the first time, or dealing with an insurer who has started asking questions you cannot easily answer.

1
Security Health Check
See what your insurer sees from the outside. An A–F scorecard of your internet-facing exposure with a clear fix list. Run quarterly or pre-renewal.
2
Cyber Insurance Readiness Assessment
Maps your controls against insurer requirements. Produces the evidence pack your broker needs and identifies the gaps that affect your premium or coverage.
3
Policy & Procedures
Insurers consistently ask for written policies. Cyber, acceptable use, BYOD, and incident response policies drafted for your context.
4
Security Awareness Training
Staff training is a standard insurer ask. Phishing simulations and a measurable awareness programme give you evidence of ongoing training.
5
Annual Security Health Check
Run annually (or quarterly) to support your renewal conversation and demonstrate ongoing security vigilance.

🔗 Supply chain pressure

A large client or tender is requiring you to demonstrate cyber maturity

For SMEs whose enterprise clients — banks, government agencies, large corporates — are pushing security requirements down their supply chains through questionnaires, audits, or certification requirements.

1
Client-Ready Security
Handle the immediate questionnaire or vendor audit. Fast turnaround — typically 2–3 weeks from engagement to completed response.
2
Cyber Risk Snapshot
Understand your broader security posture before the next questionnaire arrives. Identifies the gaps that will come up again.
3
Essential Eight Implementation
The framework enterprise clients and government agencies expect. Demonstrates systematic maturity, not ad-hoc controls.
4
ISO 27001 Certification
If the client or tender requires formal certification, ISO 27001 is the destination. Builds on everything from Step 3.

🌱 Building foundations

You know you should do something about cyber but haven't started

For growing businesses that have been operating on goodwill and good luck. You've never had a breach — but you know the exposure is there and it's time to build proper foundations before something forces the issue.

1
Security Health Check
A low-cost, non-intrusive starting point. See what's exposed before committing to a larger programme. Gives you an honest picture of your external risk.
2
Cyber Risk Snapshot
Build the baseline documentation and close the priority gaps. Sets the agenda for everything that follows — no wasted spend on the wrong things.
3
SMB1001 Certification
The achievable first certification for Australian businesses. Demonstrates commitment, gives you something tangible, and sets the foundation for Essential Eight or ISO 27001 later.
4
In a Box services (over 12 months)
Add layers progressively: policies, incident response planning, awareness training, risk assessments. Build a mature programme without trying to do everything at once.

⭐ Defence & government

You want to bid on Australian defence or government contracts

For technology companies, professional services firms, and manufacturers seeking DISP accreditation, ASD panel access, or the right to handle government-sensitive information.

1
Cyber Risk Snapshot
Understand where you stand before starting the DISP process. DISP assessors will ask about your existing controls — the snapshot gives you honest answers.
2
M365 Security
DISP and government work requires a secure Microsoft 365 environment. Configuration review and ongoing drift monitoring — hands deliverables directly to your MSP.
3
DISP Accreditation
The gateway to defence work. CyberCraft guides the full accreditation process — policy development, control evidence, DISP assessment preparation.
4
ISO 27001 Certification
Required for higher-level defence contracts and ASD panels. Builds directly on the DISP work already completed.
5
vCISO / Security Leadership
For businesses with ongoing defence obligations, a vCISO provides the security leadership function without the cost of a full-time hire.

⚠️ Privacy Act deadline

The Australian Privacy Act small business exemption ends 1 July 2026

For businesses that will lose the small business exemption on 1 July 2026 — any business with turnover above $3 million, or that handles health information, or that has opted in previously. If you are not ready, you are running out of time.

1
Privacy Act Compliance Sprint
Fixed-scope sprint to get compliant before 1 July 2026. Covers the key obligations — data mapping, privacy notices, consent mechanisms, and breach response procedures.
2
Policy & Procedures
Update your privacy policy and internal handling procedures. The Act requires documented processes — not just good intentions.
3
Privacy Framework (ongoing)
Build the ongoing programme: privacy by design, vendor assessments, breach response rehearsal, and staff training. Compliance is not a one-time event.

Not sure which path fits your situation?

Tell us what prompted the question and we'll map out the right sequence for where you are now.

Find my starting point