In a Box

You know something needs to happen. These services make it happen.

Every In a Box service has a defined scope, a clear deliverable, and a fixed fee. No open-ended consulting. No scope creep. A CEO can approve the engagement without a board-level commitment or multi-year budget conversation.

🔏

Privacy Act Compliance

1 July 2026 exemption ends — 4–6 week sprint

The small business exemption is gone. If you hold personal information about customers or staff, you now have obligations under the Privacy Act 1988. We get you compliant before the deadline — with policies, a privacy notice, and a data register that's actually usable.

Beat the deadline

🏅

SMB1001 Certification

ASD-recognised security certification for SMEs

SMB1001 is the Australian Cyber Security Centre's certification framework built for small and medium businesses. Bronze is achievable in weeks — and gives you a recognised credential you can show clients, insurers, and procurement teams.

Get certified

📋

Client-Ready Security

Answer any vendor questionnaire with confidence

Your biggest client has sent a security questionnaire. If you can't answer it, you don't get the contract. We build the documentation, evidence pack, and responses that let you say yes — and mean it.

Protect the contract

🎓

Security Awareness Training

Phishing simulations & annual programme

Your people are your largest attack surface. Quarterly phishing campaigns, role-specific training, and metrics reporting — built around your organisation, not a generic template library your staff will click through and forget.

Train your team

🚨

Incident Response Planning

72-hour mandatory reporting — are you ready?

Under the Cyber Security Act 2024, you have 72 hours to report a ransomware payment to the ASD. Most SMEs have no plan. We build your response procedures, communication templates, and escalation paths — then test them in a tabletop exercise.

Build your IR plan

📄

Policy & Procedures

Written for your stack — not a template library

Your insurer asked for a security policy. Your client's questionnaire requires one. We write a complete policy set around your actual technology environment, MSP arrangement, and regulatory obligations — practical documents your staff will understand.

Get your policies written

📊

Cyber Risk Assessments

Board-ready risk register & treatment plan

A structured risk assessment that produces something your board, insurer, or enterprise client can actually read. Risk register, treatment plan, and executive presentation — in business language, not technical jargon.

Handle your questionnaire

☁️

M365 Security

Ongoing review & configuration drift monitoring

Microsoft 365 misconfiguration is the most common cause of SME data breaches in Australia. Quarterly reviews, drift monitoring, and MSP coordination — so your security posture stays where it should be, not where it drifts to.

Lock down your M365

Security Foundations Bundle

Starting from scratch or responding to multiple pressures at once? The Security Foundations Bundle combines the three most-requested one-time services into a single coordinated engagement — at a bundled rate.

Privacy Act Compliance Policy & Procedures Incident Response Planning

Ask about the bundle →

Not sure which service fits?

Start with a Getting Started assessment — the results point directly to which In a Box services make sense for your situation.

Start with an assessment

Kaurna Acknowledgement

We acknowledge and pay our respects to the Kaurna people, the traditional custodians of the ancestral lands on which we work. We acknowledge the deep feelings of attachment and relationship of the Kaurna people to country and we respect and value their past, present and ongoing connection to the land and cultural beliefs.