A cyber security audit is an independent check of whether your security controls exist, are configured properly and actually work, measured against a standard such as the Essential Eight, ISO 27001 or your client's requirements. In Australia there's no single legal definition, so "audit" can mean anything from a $80 automated scan to a policy review to a full penetration test. The right one depends on who is asking for the evidence and what they'll accept.
This guide explains what a cyber security audit usually covers, the main types Australian businesses buy, what they cost, how to prepare, and how to avoid paying for an audit that doesn't answer the question your insurer, client or board is really asking. It's written for Australian SMB owners, IT managers and finance leads who have been told to "get an audit" and want to buy the right thing.
What is a cyber security audit?
A cyber security audit is a structured, evidence-based review of your organisation's security controls against a defined benchmark, producing findings, a risk rating and recommendations. The benchmark matters more than the label. An audit against the Essential Eight looks very different from an ISO 27001 internal audit or a penetration test of your website.
Most audits answer three questions:
- ▸Do the controls exist? For example, is multi-factor authentication (MFA) turned on, is there a patching policy, are backups configured?
- ▸Are they designed properly? Does MFA cover remote access and admin accounts, or just email? Do backups sit somewhere ransomware can't reach?
- ▸Do they actually work? Can a tester bypass the control, run unapproved software, or move from one compromised laptop to the whole network?
The third question is where most cheap audits fall short. ASD's Essential Eight Assessment Process Guide is blunt about it: assessments based on interviews, reports and screenshots "will always be inferior" to assessments using scripts and tools. The highest-quality evidence comes from actually testing a control with a simulated activity.
Is a cyber security audit a legal requirement in Australia?
For most private businesses, no law says "get a cyber security audit". But several laws and regulators require you to manage cyber risk and to be able to prove it, and an audit is usually how you produce that proof.
The Privacy Act and the NDB scheme
Under Australian Privacy Principle 11, organisations covered by the Privacy Act must take reasonable steps to protect the personal information they hold. If you suffer an eligible data breach, the Notifiable Data Breaches scheme requires you to notify affected people and the OAIC. The OAIC received 1,205 data breach notifications in 2025, the highest since the scheme began in 2018. A recent, independent audit is one of the clearest ways to show you took "reasonable steps" before something went wrong. Our guide to Privacy Act cyber security requirements goes deeper.
APRA CPS 234
If you are a bank, insurer or super fund, CPS 234 is explicit. Regulated entities must test the effectiveness of their information security controls through a systematic testing program, use "appropriately skilled and functionally independent specialists", and have internal audit review the design and operating effectiveness of those controls, including controls maintained by third parties. If you supply an APRA-regulated entity, expect their audit requirements to flow down to you. See our CPS 234 penetration testing guide.
Directors' and licensees' duties
In ASIC v RI Advice Group, the Federal Court found in 2022 that an Australian financial services licensee breached its obligations by failing to have adequate cyber security risk management across its network of authorised representatives. The court ordered RI Advice to engage a cyber security expert to identify further measures and to pay $750,000 towards ASIC's costs. ASIC described it as an Australian first. The lesson for any business: "we thought our IT provider had it covered" isn't a risk management system.
SOCI, DISP and tenders
Critical infrastructure owners covered by the SOCI Act need a risk management program, and Defence suppliers in DISP are expected to meet Essential Eight Maturity Level 2 for in-scope systems. Government and enterprise tenders increasingly ask for recent independent testing too. Our guides to SOCI Act requirements and DISP cyber security requirements cover both.
What does a cyber security audit cover?
A good audit covers your people, processes and technology, with the depth set by scope. For an Australian SMB, a sensible audit scope usually includes these areas.
Governance and policy
- ▸Information security policy, owner and review date
- ▸Risk register and who signs off on accepted risks
- ▸Incident response plan and whether it has ever been tested
- ▸Supplier and MSP responsibilities written down, not assumed
Identity and access
- ▸MFA coverage across email, remote access, cloud services and admin accounts
- ▸Privileged account management and separation of admin and daily-use accounts
- ▸Joiner, mover and leaver process, including how fast access is removed
Technical controls (the Essential Eight)
- ▸Application control, patching of applications and operating systems, Microsoft Office macro settings and user application hardening
- ▸Restriction of administrative privileges, MFA and regular backups
ASD's Essential Eight is the most common benchmark Australian auditors use for these controls, because it's prioritised, practical and recognised by insurers, government and Defence.
Exposure and exploitability
- ▸Internet-facing systems: websites, VPNs, remote desktop, email security records
- ▸Internal network weaknesses: default credentials, legacy protocols, missing lockout policies
- ▸Web applications and APIs that hold customer data
Data protection and recovery
- ▸Where sensitive data lives, including offshore and cloud storage
- ▸Encryption in transit and at rest
- ▸Whether backups have been restored in a test, not just configured
What are the main types of cyber security audit?
There are five common types, and they're not interchangeable. Each answers a different question, carries a different level of assurance and suits a different buyer.
| Type | What it answers | Evidence quality | Best for |
|---|---|---|---|
| Policy and governance review | Do we have the right documents and roles? | Low to moderate (documents and interviews) | First-time baseline, board awareness |
| Automated security assessment | What obvious weaknesses can be found from outside? | Moderate (tool output, analyst-reviewed) | Fast, low-cost starting point |
| Essential Eight assessment | What maturity level have we actually achieved? | High (configuration review plus control testing) | Insurers, tenders, DISP, board reporting |
| Penetration test | Can an attacker actually break in, and how far can they get? | Highest for the systems in scope | Clients, APRA suppliers, product launches |
| ISO 27001 or SOC 2 audit | Does our management system meet the certification standard? | High for governance, varies for technical depth | SaaS and enterprise sales |
Policy and governance reviews
A desktop review of policies, roles and processes. Useful as a starting point, but it can't tell you whether controls work. A perfect policy and an unpatched VPN can sit side by side.
Automated security assessments
Tool-driven scanning of your external footprint, reviewed by an analyst. Fast and affordable, and a good way to find the low-hanging fruit before you spend more. It is not a penetration test, because a scanner can't chain weaknesses together or think like an attacker. Our vulnerability assessment vs penetration testing guide explains the difference.
Essential Eight assessments
An assessment of each of the eight controls against a target maturity level, usually ML1 or ML2. Done properly, it uses scripts, tools and simulated activity rather than screenshots, which is what ASD's assessment guide recommends. Read Essential Eight Maturity Level 1 vs Level 2 to choose a target.
Penetration tests
A human-led, scoped attempt to exploit your systems the way a real attacker would. It gives you proof-of-concept evidence, not just a list of possible issues. If someone asks for proof that your defences hold up, this is usually what they mean.
Certification audits
ISO 27001 and SOC 2 audits are performed by accredited certification bodies or licensed auditors against their standards. Aussie Pentest doesn't certify you, but penetration testing is commonly used as evidence in both. See ISO 27001 penetration testing and SOC 2 penetration testing.
How much does a cyber security audit cost in Australia?
Cost depends on type and scope: from $80 for a single-target automated assessment, $4,950 + GST for a fixed-fee Essential Eight assessment of up to 50 seats, and from $5,000 + GST for a human-led penetration test. Certification audits and enterprise programs are priced separately by the certifying body or provider.
Here is what Aussie Pentest charges, taken from our pricing page (all AUD, + GST; international clients are GST-free):
| Service | Price | What you get |
|---|---|---|
| Automated Security Assessment | $80, $200, $500 or $2,000 | 1 to 10+ targets, analyst-reviewed, 24 to 72 hour SLA |
| Penetration testing | From $5,000, $12,000 or $20,000 | Written scope, severity-ranked report, proof of concept on every critical finding, delivered in 5 to 10 business days |
| Essential Eight assessment | $4,950 fixed fee (up to 50 seats) | ML1 or ML2 target, testing across all eight controls, maturity score, remediation roadmap, board-ready summary, 60-minute debrief |
| vCISO retainer | $2,500 to $6,500 per month | Ongoing advisory, risk register, reporting and (on higher tiers) quarterly light technical checks |
| MSP white-label | Partner rate card | Testing and compliance capacity resold under your MSP's brand |
What pushes the price up:
- ▸Number of systems: more IP addresses, web apps, APIs or seats means more testing time
- ▸Depth: internal network and Active Directory testing takes longer than an external scan
- ▸Assurance level: testing controls with simulated activity costs more than reviewing screenshots, and is worth more to the person reading the report
- ▸Retesting: confirming fixes after remediation adds value and, sometimes, cost
For context on what the alternative costs, ASD's Annual Cyber Threat Report 2024–25 puts the average self-reported cost of cybercrime per report at $56,600 for small businesses and $97,200 for medium businesses. ASD also received over 84,700 cybercrime reports that year, about one every six minutes.
Which cyber security audit do you actually need?
Start with who is asking for the evidence, then buy the lowest-cost audit they'll accept as proof. Buying a cheap audit that the reader rejects is the most expensive option of all.
| If the request comes from... | They usually want | Start with |
|---|---|---|
| Your cyber insurer | Evidence of MFA, patching, backups and Essential Eight progress | Essential Eight assessment |
| A large client or vendor questionnaire | Independent testing of the systems that touch their data | Penetration test |
| An APRA-regulated customer | Functionally independent testing and evidence of remediation | Penetration test plus retest |
| A Defence prime or DISP application | Essential Eight ML2 for in-scope systems | Essential Eight assessment at ML2 |
| Your board | A plain-English view of risk and a plan | Essential Eight assessment, then a vCISO |
| Nobody yet, you just want a baseline | A quick view of external exposure | Automated security assessment |
If you're an MSP whose clients keep asking for audits, our white-label program lets you deliver independent testing under your own brand. For questionnaires specifically, see our guide to vendor security questionnaires.
Can our MSP do the audit?
Your MSP can help gather evidence, but asking them to audit their own work creates an obvious conflict. CPS 234 requires "functionally independent" testers for a reason. An independent audit isn't about replacing your MSP. It's about validating what they built so you can sign the insurance form or the client questionnaire with confidence.
How do you prepare for a cyber security audit?
Agree the benchmark and scope in writing, gather the basics, and tell the people who need to know. Preparation shortens the audit and makes the findings more useful.
- Confirm who the audit is for and ask them which standard or evidence they'll accept.
- Define scope: which sites, cloud tenants, applications, IP ranges and user groups are in and out.
- Collect what exists: policies, network diagrams, asset lists, MSP contracts, previous reports and your insurance questionnaire.
- Arrange access: test accounts, a technical contact and written authority to test from the system owner, including any cloud or hosting provider.
- Brief your MSP and staff so a legitimate test isn't mistaken for an attack, and so nobody "fixes" things the night before.
- Book remediation time after the report lands, plus a retest if the reader expects proof that issues were fixed.
Our penetration test preparation checklist covers the technical side in more detail.
What should a good audit report include?
A good report tells a non-technical reader what matters in the first two pages and gives your technical team enough detail to fix each issue. Look for:
- ▸an executive summary written for the board, not the server room
- ▸clear scope, dates and methodology, so the reader knows what was and wasn't tested
- ▸findings ranked by severity, with business impact explained
- ▸evidence for each finding, including proof of concept for critical issues
- ▸a prioritised remediation roadmap, not a 200-page scanner export
- ▸for Essential Eight, the maturity level achieved for each control and the gaps to the next level
A real example of why testing matters: in one internal black-box test for a financial services client on Azure-hosted Windows servers, we found 10 issues, including factory-default credentials on a live security monitoring platform, a legacy remote access protocol sending credentials in cleartext and no account lockout policy. A follow-up validation four days after the report confirmed documented fixes for 8 of the 10. A policy review would have found none of that. More detail is on our pricing page, and our guide to what a penetration testing report includes explains how to read one.
Frequently asked questions
How often should we do a cyber security audit?
At least annually, and after any major change such as a cloud migration, new customer-facing application or merger. Regulated entities and suppliers often need more frequent testing. Our guide to how often to get a penetration test sets out sensible cadences.
What's the difference between a cyber security audit and a penetration test?
An audit checks controls against a benchmark and can be largely document-based. A penetration test actively tries to exploit your systems. A penetration test can form part of an audit, and it gives the strongest evidence that technical controls work.
How long does a cyber security audit take?
It depends on type. Our automated assessments have a 24 to 72 hour SLA, penetration tests are delivered in 5 to 10 business days, and Essential Eight assessment reports are delivered within 10 business days. Scoping and your own preparation add time before testing starts.
Can a small business pass an audit?
There's usually no pass or fail. You get findings and a maturity level. Insurers, clients and tenders decide what they'll accept, so ask them first. Many small businesses aim for Essential Eight Maturity Level 1 as a realistic first target.
Will an audit guarantee our insurance or tender?
No. An independent audit gives you credible evidence, but the insurer, client or assessor makes the final decision. Anyone guaranteeing approval is overselling.
Bottom line
"Cyber security audit" is a broad label, so define it before you buy it. Work out who needs the evidence, agree the benchmark, and choose an audit that actually tests your controls rather than just reading about them. For most Australian SMBs that means an Essential Eight assessment for a maturity baseline, a penetration test where clients or regulators want proof, and an automated assessment when you just need a fast first look.
Aussie Pentest provides fixed-fee, independent audits for Australian businesses: automated security assessments from $80, Essential Eight assessments for $4,950 + GST, human-led penetration testing from $5,000 + GST and vCISO retainers from $2,500 per month. Book a 1-on-1 call and tell us who's asking for the audit. We'll recommend the smallest scope that will satisfy them.
Sources
- ▸ASD: Essential Eight Assessment Process Guide
- ▸ASD: Essential Eight Maturity Model
- ▸ASD: Annual Cyber Threat Report 2024–25
- ▸OAIC: Data breach notifications increase to all-time high in 2025
- ▸APRA: Prudential Standard CPS 234 Information Security
- ▸ASIC: Court finds RI Advice failed to adequately manage cybersecurity risks
- ▸Aussie Pentest: Pricing
This article is general information only, not legal, compliance or insurance advice. Requirements vary by industry, contract and regulator, so confirm what applies to you with the party requesting the audit or a qualified adviser. Prices are current as of October 2026, and ASD, OAIC, APRA and ASIC sources were checked on 23 October 2026. Aussie Pentest does not certify Essential Eight, ISO 27001 or SOC 2 compliance, and our reports support your evidence but don't guarantee acceptance by an insurer, client or assessor. Only test systems you have written authority to assess.