Security Solution Consultants (SSC) provides cyber security audit services in Melbourne for organisations that need to show a customer, a regulator or their own board that security controls exist and work. We are based in Tarneit, in Melbourne’s west, and audit against the Australian and Victorian requirements our clients actually face: the Essential Eight and ASD Essentials, ISO/IEC 27001, the SOCI Act, VPDSS, APRA CPS 234 and PCI DSS.
Most organisations asking for a cyber security audit want one of three quite different things. Knowing which one you need before you buy saves a great deal of money and disappointment. This page sets out what an audit covers, what it does not, how long it takes and what you receive. If you already know what you need, talk to us directly.
Three things people mean by “cyber security audit”
The word covers a wide range in practice, and providers are not always careful about the difference.
1. A compliance audit
Assessment against a defined standard or obligation: the Essential Eight, ISO/IEC 27001:2022, a SOCI Act critical infrastructure risk management program, VPDSS, APRA CPS 234 or a customer’s contract schedule. The output is a statement of conformity with findings against specific clauses. This is what you need when a customer, regulator or board is asking for evidence.
2. A technical security assessment
Examination of how systems are actually configured and exposed: patching, access control, multi-factor authentication, network segmentation and internet-facing services. The output is a prioritised list of technical weaknesses. This answers “are we actually secure”, not “can we prove we are compliant”.
3. A penetration test
An authorised attempt to exploit weaknesses, not merely observe them. Narrow, deep and time-boxed. A penetration test is not an audit and will not satisfy a compliance requirement on its own, though the two are often confused and sometimes sold as the same thing. Organisations frequently buy the second when a customer has asked for the first. If a penetration test is what you need, see our penetration testing and security testing services.
How a cyber security audit in Melbourne runs
Scoping. Which entities, systems, sites and obligations are in scope. This is the single largest cost driver and the one you control. Auditing one business unit or one critical system rather than a whole group can change the effort by more than half.
Documentation review. Policies, procedures, the risk register, asset inventory and supplier agreements. Where documentation does not exist, that is itself a finding, and usually the most common one.
Control testing. Sampling to establish whether documented controls operate in practice. A policy nobody follows is worse than no policy, because it evidences awareness without action.
Interviews. Control owners, IT, and whoever actually performs the task. This is where the gap between the documented process and the real one becomes visible.
Reporting. Findings rated by severity, mapped to the relevant clauses, with remediation guidance specific enough to act on and a walkthrough with the people who will do the work.
Which standard should your audit be against?
Start with the reason you are being asked. The obligation decides the yardstick, and the yardstick decides the scope.
- Essential Eight and ASD Essentials. The Essential Eight is mandatory at Maturity Level Two for non-corporate Commonwealth entities under PSPF Release 2026, and widely imposed on suppliers through contracts. ASD published its successor, the ASD Essentials series, on 15 October 2026. We run Essential Eight compliance assessments and map results to the new Essentials actions.
- ISO/IEC 27001:2022. An internal audit or certification readiness review before the certification body arrives. See our ISO 27001 implementation and advisory service.
- SOCI Act CIRMP. An independent review of a critical infrastructure risk management program before the board approves the annual report, including readiness for the enhanced CIRMP rules. See our SOCI Act compliance advisory and CIRMP audit service.
- VPDSS V2.0. For Victorian public sector agencies and the suppliers they must assure under sections 88 and 89 of the Privacy and Data Protection Act 2014 (Vic).
- APRA CPS 234 and CPS 230. Testing of information security controls and operational resilience for banks, insurers and superannuation trustees. See APRA CPS 230 and CPS 234 advisory.
- PCI DSS v4.0.1. Readiness for merchants and service providers, ahead of a QSA assessment or self-assessment questionnaire. See PCI compliance advisory.
- A customer’s contract or questionnaire. Bring the clause. The scope only needs to be as wide as the clause requires.
What you receive
- A findings report mapped to the standard or obligation being assessed, clause by clause
- Severity ratings with the reasoning behind each one, not just a colour
- Remediation guidance specific to your environment, with owners and priorities
- An executive summary a board or audit and risk committee can read without translation
- A working session to walk through the findings, because a report nobody understands changes nothing
- Optionally, the findings and evidence loaded into GRCLens, so remediation is tracked against the same controls next year
How long it takes
For a single organisation with a contained scope, fieldwork is typically a matter of days rather than weeks, with reporting following. Multi-entity, multi-site or heavily regulated scopes take proportionately longer. The honest variable is not our effort. It is how quickly your team can produce the evidence requested. Audits that stall almost always stall waiting on documentation, not on the auditor.
What it costs
Audit cost is driven by scope, not by organisation size. A forty-person software company with three cloud environments and a payments integration can be more work than a three-hundred-person firm with one office and a simple network. Rather than publish a number that would be wrong for most readers, we scope first and give a fixed quote for what is actually in scope. If your driver is ISO 27001, we have published our readiness and certification cost ranges.
One thing worth knowing before you compare quotes: if you need certification rather than assurance, the certification audit must be performed by an accredited certification body independently of whoever prepared you. A single quote covering both preparation and certification is worth questioning.
Victorian specifics that change the scope
VPDSS reaches suppliers through contracts. Victorian agencies must ensure their contracted service providers do not contravene the Victorian Protective Data Security Standards, so an agency’s assurance problem becomes its supplier’s evidence request. Agencies attest through a Protective Data Security Plan to OVIC every two years; the 2026 plans were due by 31 August 2026, so supplier assurance for the next cycle starts now.
Victoria has no state breach notification scheme for private organisations. A private organisation’s duty is the Commonwealth Notifiable Data Breaches scheme under the Privacy Act 1988. Private health providers in Victoria also carry obligations under the Health Records Act 2001 (Vic). Businesses with turnover above $3 million must report a ransomware payment within 72 hours under the Cyber Security Act 2024.
Critical infrastructure is concentrated here. Victorian water corporations, energy networks, ports and freight operators run critical infrastructure risk management programs under the SOCI Act. For nine asset classes the enhanced CIRMP rules that commenced on 10 June 2026 add obligations from June 2027 and June 2028, including a framework uplift such as Essential Eight Maturity Level Two, phishing-resistant multi-factor authentication and segregation of critical systems.
Cyber security audits across Victoria and Australia
The same approach applies wherever you are. Most audit work, from documentation review to control testing and interviews, can be done remotely, so organisations in Geelong, Ballarat, Bendigo and the outer Melbourne corridors get the same scope, reporting and remediation plan as clients in the Melbourne CBD. We also audit for organisations in Sydney, Brisbane, Perth, Adelaide, Canberra, Hobart, Darwin and Auckland.
For ongoing advice rather than a point-in-time audit, see our cyber security compliance and consulting services in Melbourne.
Frequently asked questions
Is a cyber security audit the same as a penetration test?
No. An audit establishes whether controls exist and operate, measured against a standard or a contract. A penetration test attempts to exploit weaknesses. A penetration test on its own will not satisfy an Essential Eight, ISO 27001, SOCI or VPDSS requirement, and the two are scoped and priced differently.
How much does a cyber security audit cost in Melbourne?
It depends on scope rather than headcount, so we scope before we quote and then fix the price. Narrowing the scope to what your customer, regulator or board actually requires is usually the largest saving available. For ISO 27001 specifically, our published readiness and certification ranges are the closest guide.
Can you audit us against the Essential Eight now that ASD Essentials has been published?
Yes. ASD published the Essentials series on 15 October 2026 as the evolution of the Essential Eight, but obligations that name the Essential Eight, such as PSPF Release 2026 for Commonwealth entities, still name it until they are updated. We can assess against the Essential Eight Maturity Model, against the new Essentials actions, or map one to the other so your existing investment carries forward.
Can you audit us and then certify us for ISO 27001?
Not for ISO 27001, and no legitimate firm can. Certification must be performed by an accredited certification body independently of whoever prepared you. We prepare you, run the internal audit the standard requires, and support you through the certification body’s audit.
Is a SOCI Act audit mandatory?
No. The SOCI Act requires responsible entities to keep a critical infrastructure risk management program and give a board-approved annual report, not to commission an external audit. An independent audit gives directors evidence that the program is in place and working before they approve the report.
Do you come on site in Melbourne?
Yes, when it adds value. Most documentation review, control testing and interviews can be done remotely. We come on site in Melbourne and regional Victoria for workshops, physical security, data centres, operational technology and the findings walkthrough.
How long does a cyber security audit take?
For a single organisation with a contained scope, fieldwork usually takes days rather than weeks, with the report following. Multi-entity, multi-site or heavily regulated scopes take longer. The variable that matters most is how quickly evidence can be produced, not the auditor’s effort.
Next step
Tell us what triggered the question, whether it is a customer contract, a regulator, a board request or an incident, and we will tell you which of the three types of work you actually need, including if that turns out to be none of them. Get in touch or email info@secsolutionshub.com.
