A cybersecurity audit is a structured review of how your business protects its accounts, devices, data and people, checked against a standard and written up with a fix list. For a Queensland business of 5 to 100 people, a good one takes a few weeks of light involvement from you, looks at real settings rather than policy documents, and ends with a short list of jobs in priority order. We are a Brisbane Managed IT team, and this is how we see audits work in practice.
Key takeaways
- An audit is only as good as its evidence. Checking the actual settings in Microsoft 365 beats reading a policy or asking someone whether MFA is on.
- Most small businesses fail on the basics: accounts without multi-factor sign-in, old staff accounts still active and backups nobody has tested.
- The report matters less than what happens next. Pick the top few findings, give each an owner and a date, then check them again.
- You do not need a government-grade assessment unless a contract or regulator asks for one. A scoped review against the Essential Eight is enough for most firms.
Table of Contents
- What a cybersecurity audit actually is
- What most businesses get wrong about audits
- What an audit looks at
- Where the data and reality do not match
- Do you need a formal audit or a lighter review?
- Rules that can make an audit relevant
- How to prepare
- What the report should look like
- What to do with the findings
- How often to repeat it
- Our perspective
- How we can help
- FAQ
- Your next step
- Sources
What a cybersecurity audit actually is
People use “audit”, “assessment”, “health check” and “penetration test” as if they were the same thing. They are not.
An audit compares what you have against a defined standard. A health check is a lighter, faster version of the same idea. A penetration test is different: someone tries to break in using the weaknesses they find. Most small businesses need the first or second long before the third.
The cost of getting this wrong is real. Business Queensland reports that the average cost of cybercrime in Australia is $56,600 for small businesses and $97,200 for medium businesses. For a ten-person firm, that is a bad year’s profit, and an audit costs a fraction of it.
What most businesses get wrong about audits
We see this a lot. A business owner hears “audit” and imagines a pass or fail exam. They tidy up for a week, tell the auditor everything is fine and get a clean-looking report that finds nothing useful.
That is backwards. The point is to find the gaps while they are cheap to fix. If your audit finds nothing, either your setup is unusually good or the audit was too shallow.
The second mistake is treating a policy as proof. Many firms have a cyber security policy in a shared folder. Ask whether every account actually has multi-factor sign-in turned on and you often get “I think so”. The Australian Signals Directorate’s own guidance for Essential Eight assessors ranks evidence by quality: simulated testing is excellent, a review of settings through the system interface is good, a copy of the configuration is fair, and policies or interviews are poor. We agree with that ranking. If someone offers you an audit built mostly on a questionnaire, it is not worth paying for.
What an audit looks at
The scope depends on your business, but for a typical Brisbane office running Microsoft 365 the review covers these areas.
Accounts and sign-in
This is where we find the most. We check whether multi-factor authentication (a second step like an app prompt, on top of the password) is on for every account, including shared mailboxes with sign-in enabled and the old account of someone who left. We look at whether a Conditional Access policy exists, which is a Microsoft 365 rule that decides who can sign in, from where and on what device. We also count how many people hold admin rights. In a 20-person business the answer is often far too many.
Devices and updates
We look at whether every laptop and desktop is patched, encrypted and managed. Unmanaged devices are the usual surprise: a personal laptop that someone set up with their work email two years ago and nobody remembers. The Essential Eight guide expects an automated method of asset discovery to run at least fortnightly at Maturity Level One, so that you know what devices exist before you try to patch them.
Email and data
We check mail filtering, how external forwarding is handled and who can share files outside the business. In SharePoint and OneDrive, “anyone with the link” sharing is a common finding. It starts as a convenience for one client and quietly becomes the default.
Backups
We ask when you last restored something. Not when the backup last ran, when you last got a file or a whole system back. A backup that has never been restored is a hope, not a control.
Cloud configuration
The Office of the Australian Information Commissioner (OAIC) has said that cloud security is a shared responsibility and recommends regular security assessments of cloud configurations to reduce the risk of misconfiguration. Your provider secures the platform. You are responsible for the settings. If you run workloads in Azure, those settings belong in the audit as well.
People and process
Who is accountable for protecting your data? What happens when someone leaves? Cyber.gov.au says businesses should know who is accountable for protecting their data and what mitigation strategies are in place. In small firms the honest answer is often “whoever set it up”, and that person may have left.
Where the data and reality do not match
The published advice is consistent. Business Queensland’s list for small businesses is Essential Eight Maturity Level One, MFA, strong passphrases, limited access, updates, backups and staff training on scam messages. Nothing on that list is exotic.
In practice, the gap is rarely knowledge. It is follow-through. Here is a hypothetical, but a pattern we see regularly: a 30-person professional services firm buys a good security tool, switches on MFA for staff at the start and then adds contractors and new starters over the next year without applying the same rule. Eighteen months later, a handful of accounts have no second step, and nobody notices because the dashboard shows “MFA enabled” for the majority.
That is what an audit catches. Not a lack of tools, but drift.
Do you need a formal audit or a lighter review?
Here is where we are opinionated.
A scoped review against the Essential Eight suits most Queensland businesses with 5 to 100 people. It is practical, it uses a framework Australian insurers and clients recognise, and it produces a list you can act on.
A formal assessment by an ASD-endorsed assessor is worth it if you hold government data, contract to a government agency or a customer requires it. The Infosec Registered Assessors Program (IRAP) gives organisations access to suitably qualified, ASD-endorsed professionals who can assess and verify security measures. If nobody has asked you for it, do not pay for it. It is the wrong tool for a 15-person accounting practice.
Penetration testing is not worth paying for before you have the basics in place. Testers will walk straight through the same unlocked doors a basic review would have found for less.
If you are a government agency or public sector entity, this article is not for you. The Queensland Government and the Queensland Audit Office publish separate material for that audience.
Rules that can make an audit relevant
No single law says every small business must have a cybersecurity audit. But several obligations make one sensible.
Businesses with turnover of $3 million or less are exempt from some parts of the Privacy Act, but Business Queensland notes they still have additional privacy obligations and should voluntarily comply to maintain customer trust. The exemption does not apply across the board. The OAIC says small businesses must comply with the Australian Privacy Principles and the Notifiable Data Breaches scheme if they provide health services and hold health information, trade in personal information or provide services to the Commonwealth under contract.
In Brisbane that catches more firms than owners expect: allied health clinics, physios, some marketing and data businesses, and any firm with a federal government contract. If that is you, treat an audit as routine.
Online businesses have their own duties too. Business Queensland says those that collect and store customer information must explain what they store and why, and customers can ask for access and correction.
Even where no law applies, contracts often do. We regularly see larger clients add a security questionnaire to supplier onboarding. Having a recent audit report ready makes that conversation short.
How to prepare
Preparation takes a few hours, not a few weeks. Here is what we ask clients to do before we start.
- Write down the systems that hold business data: email, file storage, accounting, practice or case management, and any industry software.
- List every person with access, including contractors and anyone on leave.
- Find out who has admin rights in Microsoft 365 and who holds the credit card on the account.
- Locate your last backup restore test. If there is none, say so. That is a finding, not an embarrassment.
- Decide the scope with the assessor. The Essential Eight process starts with planning and preparation, then agreeing scope and approach, then assessing controls and producing a security assessment report.
Do not clean things up first. Fixing the obvious problems the night before defeats the audit. Let the reviewer see the normal state.
What the report should look like
A useful report is short. For a small business we would expect a summary on one page, a list of findings ranked by how much risk each carries and how hard each is to fix, and a plain statement of what to do first.
Be wary of a 70-page document where every finding is “high”. If everything is urgent, nothing is. A good report separates the quick wins (turn on multi-factor sign-in for every account, remove ex-staff accounts, restrict external sharing) from the longer projects (replace unmanaged devices, redesign the backup).
What to do with the findings
This is the part nobody likes. We suggest this order.
- Fix anything that exposes accounts directly. Missing MFA and unused admin accounts come first because they are free to fix and carry the most risk.
- Test a restore from backup and write down how long it took you and what broke.
- Deal with devices that are not managed or not patched.
- Put the remaining findings on a simple list with an owner and a date each.
- Brief your staff on what changed and why.
The people part is where most of the lasting benefit sits. Our guide to user security awareness training for Brisbane businesses covers what that looks like in practice. If you want to go further on building skills inside the business, workforce upskilling in Australia is a useful angle on why employers invest in training.
If you handle personal information, also check that your breach response is written down. Knowing who calls whom matters more on the day than a polished document.
How often to repeat it
There is no single rule for small businesses, so here is what we recommend.
Do a full review once a year. Do a smaller check whenever something major changes: a new office, a move to Azure, a merger, a new line-of-business app or a wave of new staff. Between those, a monthly look at the Microsoft 365 sign-in and admin reports catches drift early. This is the cheap routine that keeps audits boring.
The Essential Eight itself is built around ongoing checks. Asset discovery that runs at least fortnightly is one example in the assessment guidance. If your audit is once every three years, the gaps have had a long time to grow.
Our perspective
We have sat through plenty of audit conversations with Brisbane businesses. The ones that go well share a few habits. The owner treats the findings as a to-do list, not a verdict. Someone inside the business owns the follow-up. And the audit is part of a routine that includes patching, backup testing and onboarding and offboarding checks all year.
Our view is blunt. If you have not yet turned on multi-factor sign-in for every account, do that before you pay anyone for an audit. If your backup has never been restored, test that first. An audit is most useful when you have done the obvious work and want an independent view of what you missed.
We would also say that audits work best when the reviewer understands how you actually work. A rule that makes sense for a bank can wreck a ten-person design studio. Local knowledge matters: we know that Brisbane firms often run a mix of Microsoft 365, a cloud accounting platform and one industry application that is older than anyone wants to admit, and that is where the interesting findings usually sit.
— IT Start
How we can help
We are a Brisbane Managed IT team and we look after Microsoft 365, security, backups and networking for businesses of 5 to 100 people, from the Sunshine Coast to the Gold Coast. Our cyber security service includes reviewing your setup and building the fix list with you. If most of your risk sits in email and file sharing, our Microsoft 365 support and management is the place to start. One-off projects such as an audit follow-up are covered by Business IT Support, from $145 an hour ex GST.
FAQ
How much does a cybersecurity audit cost in Queensland?
It depends on scope: the number of users, systems and the standard you are measured against. A scoped review for a small office is a very different job from a formal government-style assessment. We do not publish a fixed audit price, so ask any provider for a written scope and a fixed fee before work begins.
Is a cybersecurity audit compulsory for small businesses?
Not as a general rule. But privacy obligations, government contracts and customer requirements can make one expected. If you hold health information, trade in personal information or serve the Commonwealth under contract, the Privacy Act’s breach rules apply even to small firms.
What is the difference between an audit and a penetration test?
An audit checks your setup against a standard. A penetration test tries to get in. For most small businesses, an audit first is cheaper and more useful.
Will an audit disrupt my staff?
Usually very little. Most checks are done by reviewing settings in Microsoft 365 and on your devices. Staff might be asked a few questions or need to restart a machine after a fix.
Your next step
Book a free consultation with our Brisbane team. We will look at your Microsoft 365 sign-in settings, admin accounts and backup status, and tell you straight whether you need a full audit or just a few fixes. Start at itstart.com.au.
Sources
- Keeping your business cyber secure, Business Queensland
- Protecting privacy and information in your business, Business Queensland
- Legal obligations for online businesses, Business Queensland
- Essential Eight assessment process guide, Cyber.gov.au
- Ten things to know about data security, Cyber.gov.au
- Part 4: Notifiable Data Breach (NDB) Scheme, OAIC
- Inspiring Vacations enforceable undertaking, OAIC
- Workforce upskilling in Australia, Canterbury Training and Development Institute
