A fixed-fee, independent Cyber Health Check for Australian businesses. Ten non-negotiable control areas. Plain-English report. Board-ready results. Ten business days.
Your IT provider, or your IT department, keeps the systems running. What they typically can't provide — and what insurers, boards, and regulators increasingly require — is independent evidence of your cyber security posture.
Your board has started asking "are we cyber-safe?" — and no one can give a confident, evidence-backed answer.
Your MSP manages infrastructure, but you're not sure anyone is looking at governance, regulatory alignment, or evidence for your insurer.
A peer organisation made the news for a data breach and you're wondering how you'd cope if it were you.
Regulatory obligations under the Privacy Act, Essential Eight, or sector-specific requirements are tightening — and you're not sure where you stand.
You've had an IT review — but no one looked at governance, accountability, third-party risk, or privacy obligations.
A data breach or prolonged outage isn't just an IT incident. It's a regulatory, financial, and reputational event. The organisations that navigate those situations well are the ones with evidence on the table before anything goes wrong.
Every Health Check covers the same ten areas, regardless of sector. Each is scored on a 0–4 maturity scale backed by documented evidence — not assertions. We also map your controls against the ACSC's Essential Eight at Maturity Level 1.
Is cyber risk formally assessed, owned, and reported to leadership on a regular cycle?
Are controls mapped to Essential Eight, NIST CSF, or ISO 27001? Are gaps tracked and improving?
Do you know what your most critical data and systems are — and are they specifically protected?
Is your privacy policy current? Do you have a breach response process that actually works?
Is your vendor inventory current? Do data processors have appropriate agreements in place?
Is MFA enforced everywhere? Are privileged accounts controlled, separated, and reviewed?
Does a plan exist? Has it been tested? Does it include clear decision-making authority?
Is the 3-2-1 rule applied? Has a restore test been completed within the last 12 months?
Is training delivered at onboarding and annually? Are incidents reported, not quietly buried?
Is there a policy for GenAI use by staff? Are approved tools and data classifications defined?
Every engagement produces the same four deliverables. The report is written for your board and leadership team — not a security operations centre.
14–18 pages, plain English, Australian English. Executive summary, ten-point scored scorecard, Essential Eight ML1 mapping, and a prioritised remediation roadmap across three time horizons. Evidence-linked throughout.
A single A4 page designed to be tabled at a board or executive meeting without modification. Overall posture rating, traffic-light dashboard across all ten control areas, and the top three actions with indicative cost.
A structured video call with your leadership team at the end of the engagement. We walk through findings, agree priorities and owners, and take questions. Agenda provided 24 hours in advance.
From the debrief date, email questions about the findings and receive a considered response within two business days. No additional charge. No time limit on the question.
The engagement is structured, time-boxed, and runs around your schedule — not ours.
Kick-off with your leadership team. Document review. Structured interviews with Principal/CEO, Business Manager/CFO, and IT/MSP lead. Technical walkthrough of identity, patching, backup, and email controls.
Maturity scoring across all ten control areas. Essential Eight ML1 mapping. Gap identification. Remediation roadmap built around your risk and your resources — not a generic checklist.
Report assembly. Board one-pager. Full QA pass. Plain English throughout. Every finding cites the evidence that produced it.
60-minute debrief with your leadership team. Deliverables pack handed over. 30-day Q&A window opens. No hard sell on what comes next.
Every Health Check is delivered by Daniel Johns, Principal of Coastal Cyber. No account manager, no junior consultant doing the real work, no handoffs.
If, at the end of your debrief, you don't feel the Health Check gave you a clear picture of where you stand and what to do next — we'll refund your fee in full. No questions, no paperwork.
Insurance $5M professional indemnity and $10M public liability. Certificates of currency available on request before engagement commencement.
We'll talk about your organisation, your current cyber position, and whether a Health Check is the right next step. If it's not, we'll tell you — and point you somewhere that is.
Coastal Cyber · Sunshine Coast, QLD · dj@coastalcyber.com.au