IT Governance & Compliance
for Small Business
Insurers, clients and tender panels now want proof of security. We set up and run the controls, write the policies and keep the evidence for SMB1001, the Privacy Act and any Essential Eight reporting. You stay accountable for your security.
- SMB1001 Gold achieved
- Policies without jargon
- Evidence kept current
As a CyberCert Partner, we help clients get SMB1001 certified at Bronze, Silver or Gold.
Achieved through CyberCert
Partner
Owners’ IT experience, each
Businesses supported
The compliance work we take on
Each piece stands on its own. Most clients start with one and add the rest over time.
Essential Eight and ASD Essentials
ASD’s newer framework, the ASD Essentials, is superseding the Essential Eight. We run the kinds of controls the Essentials covers, and assess your Essential Eight maturity if you still report against it.
SMB1001 certification
We achieved Gold ourselves. As a CyberCert Partner we take you through Bronze, Silver or Gold, starting with a gap analysis and finishing with the submission.
Privacy Act and NDB readiness
Controls around the personal information you hold, and a data breach response plan for assessing a breach and meeting the Notifiable Data Breaches scheme if it applies.
Cyber insurance readiness
We put the controls insurers ask about in place and help you answer the questionnaire accurately, with evidence behind each answer.
Business continuity
A business impact analysis, recovery targets and a written plan your team can follow, tested before you need it.
Evidence and documentation
Configuration reports, training records and policy versions, kept in one place and ready when an insurer, client or certifier asks.
Compliance has become a commercial question
Security questions now reach small businesses through insurance renewals, client contracts and tenders. Many are written as if you employ an IT security manager.
We work out which obligations apply to you, then put the controls, policies and evidence in place.
- An insurer questionnaire about MFA, EDR and tested backups
- A client security questionnaire before a contract is signed
- A tender that asks for a recognised certification
- Privacy Act obligations, if they apply to the health or personal information you hold
- An incident that showed how little was written down
Policies your team can follow
Many standards and frameworks, and many insurers, expect written policies. Without them it is hard to show compliance, however good your technical controls are. We write them in clear, everyday language for your systems and people, enforce them with technical controls where we can, and review them when something changes.
- Cyber security policy
- Acceptable use policy
- Password policy
- Incident response plan
- Backup and recovery policy
- AI use policy
- Data breach response plan
- Remote work policy
- Data classification policy
- Supplier and third-party policy
- Short enough that staff read it
- Specific to your systems and people
- Enforced by technical controls where possible
- Approved by a director
- Reviewed at least once a year
Find out where you stand
Our free cyber security assessment checks your key controls, such as MFA, patching, admin access and backups, and gives you a prioritised plan. Free, with no obligation.
Which standard or framework fits your situation?
Not every business needs every standard or framework. Start with who is asking and what they asked for.
Controls such as MFA, EDR, patching and tested backups, with evidence
A recognised certificate you can show
The kinds of controls the ASD Essentials covers
Privacy Act obligations and a plan for notifiable breaches
Recovery targets and a tested plan
Specialist work beyond our scope
Not sure which row fits? Read what GRC means for a small business.
Our compliance process
Identify your obligations
We look at your industry, clients, insurer and the data you hold, and work out which standards and frameworks apply to you.
Find the gaps
We check your environment against what applies to you, such as SMB1001 tiers, insurer questions or Essential Eight reporting, and give you a prioritised action plan without the jargon.
Fix and document
We implement the technical controls, write the policies and train your staff. Projects are quoted before work starts.
Keep it current
We maintain the controls, refresh policies and keep evidence ready for renewals, questionnaires and certification.
Where we stop and specialists take over
We deliver the operational and compliance foundations: technical controls, policies, documentation and the evidence insurers, standards and frameworks ask for. For many small and medium businesses, that is all they are asked for.
Formal standards such as ISO 27001, an outsourced chief information security officer (CISO) and enterprise risk management are specialist work. We refer that work to trusted Australian GRC specialists and keep running your day-to-day IT and security.
Do you need ISO 27001?
Most small businesses don’t. SMB1001 and ASD’s frameworks usually cover what clients and insurers ask for, and we’ll tell you honestly if you have outgrown them.
New to GRC?
Our guide explains governance, risk and compliance and the four stages most businesses move through.
Compliance we practise ourselves
SEQ IT achieved SMB1001 Gold through CyberCert and is a CyberCert Partner, so the controls and evidence we prepare for you match what we maintain ourselves.
SMB1001 Gold
Partner
Partner and Cloud Solution Provider (CSP)
Google Cloud Partner
Governance and compliance: common questions
What is the difference between a standard and a framework?
A framework is guidance: it sets out what good security looks like and measures how far you have gone, with no certificate. The ASD Essentials, which is superseding the Essential Eight, is a framework. A standard sets requirements you either meet or don’t, and an accredited certifier certifies you against it. SMB1001 is a standard, so certification gives you something clients, insurers and tender panels can check. Both have their place. We’ll tell you which one the people asking for it need.
Does my small business have to comply with anything?
Often, yes. The Privacy Act covers all health service providers regardless of turnover and other businesses with annual turnover over $3 million, plus some specific cases. Your cyber insurance policy likely expects certain controls, and clients may ask for proof of security before they sign.
Can you help us get ISO 27001 certified?
That is outside our scope. ISO 27001 projects, formal GRC programmes and enterprise risk management are referred to trusted Australian GRC specialists, and we can keep running your IT and security alongside them. For many small businesses, SMB1001 covers what clients ask for.
Our insurer is asking about our security controls. Can you help?
Yes, it’s one of the most common reasons businesses call us. We put in place the controls insurers ask about, such as multi-factor authentication, EDR, patching and tested backups, then help you answer the questionnaire accurately. Your insurer still decides on cover and premiums.
What IT policies does a small business need?
Most standards, frameworks and insurers expect a cyber security policy, acceptable use policy, password policy, incident response plan and backup and recovery policy. If staff use tools like ChatGPT, Copilot or Gemini, add an AI use policy. Businesses holding personal information also need a data breach response plan.
Can you certify us as compliant?
Not directly. SMB1001 certification is issued through CyberCert. As a CyberCert Partner, we start the certification process on your behalf and help you complete the controls. SMB1001 also asks businesses to engage a technical support specialist (TSS), and as your managed service provider, that’s our role. The ASD Essentials and the Essential Eight have no certificate. For the Privacy Act and insurance, we help you meet the requirements, but the regulator and insurer make their own decisions.
How much does compliance work cost?
Projects are quoted on scope: which standard or framework, how far you have to go and how big your environment is. For clients on our managed IT or managed security services, much of the technical work is already done. The first assessment is free, and there are no lock-in contracts.
Explore governance and compliance
What is GRC?
Governance, risk and compliance explained for small businesses.
Essential Eight
The Essential Eight, and the move to the ASD Essentials.
SMB1001 certification
Bronze, Silver and Gold with a CyberCert Partner.
Cyber insurance readiness
Controls and evidence for your insurer’s questionnaire.
Business continuity planning
Recovery targets, a written plan and tested restores.
Data backup and recovery
Monitored, test-restored backups for cloud, devices and servers.
Get a clear view of your obligations
Tell us who is asking: your insurer, a client, a tender panel or your own board. We’ll work out which standards and frameworks apply and what it would take to meet them.
- Which obligations apply to you
- The gaps, in priority order
- A quoted plan with no lock-in contract
Prefer to talk? Call 1300 619 750, Monday to Friday.
Tell us what you need and we’ll get back to you.