Cyber Security Services in Brisbane

Security Solution Consultants provides cyber security services in Brisbane for Queensland Government agencies, statutory bodies, local councils and the suppliers who serve them, as well as the state’s resources and energy operators.

Queensland’s information security policy was reissued as IS18 version 10.0.0 on 17 June 2026 and carries mandated status. It is no longer the “IS18:2018” that many suppliers still cite in tender responses. It binds Queensland Government departments, accountable officers not otherwise in scope, and statutory bodies under the Financial and Performance Management Standard 2019. Local governments are encouraged rather than mandated.

IS18 v10 sets five requirements, including an ISO 27001 based information security management system and the Essential Eight at an agency-selected target maturity level. That differs from the fixed Maturity Level One in New South Wales, and it makes the target a governance decision rather than a technical default. Annual cyber incident simulations are required. The annual return goes to the Cyber Security Unit and is due 30 September, endorsed by the accountable officer through the audit and risk committee, with the attestation published in the agency’s annual report.

Our Cyber Security Services in Brisbane

• IS18 v10 readiness and annual return support. Gap assessment against the five requirements, ISMS design, and preparation of the return ahead of the 30 September deadline.
• Essential Eight target maturity advice. IS18 lets you select the target level. We help you set it defensibly and evidence it, rather than picking a number and hoping.
• Queensland Information Privacy Act breach readiness. Response plan, the 30 day assessment process and breach register, particularly for councils newly in scope from 1 July 2026.
• ISO 27001 ISMS certification. The direct route to the management system requirement in IS18 v10.
• AESCSF assessment for resources and energy. Framework version 2, relevant to Queensland’s electricity, gas and liquid fuel operators.
• SOCI and CIRMP advisory. For critical infrastructure asset owners, including the enhanced obligations that commenced on 10 June 2026.

Queensland cyber security and privacy updates for 2025 and 2026

Three changes have reshaped what Queensland public sector bodies, and the Brisbane businesses that supply them, need to show.

IS18 v10.0.0 (June 2026). The current version of the Queensland Government’s Information and cyber security policy keeps an information security management system based on the current ISO 27001 at the centre of every agency’s program. Agencies whose control mappings were built against the 2018 policy or the 2025 revision should re-check them against the new text before the next attestation. Councils are not bound by IS18 but are encouraged to adopt it.

IPOLA privacy reforms. The Queensland Privacy Principles and the mandatory notification of data breach scheme have applied to state agencies since 1 July 2025, and the breach scheme reached local government on 1 July 2026. Agencies must take reasonable steps to bind their contracted service providers to the QPPs (sections 35 and 36), so suppliers holding government personal information should expect privacy clauses and questions about how they would respond to a breach.

QAO on third-party cyber risk (26 March 2026). The Queensland Audit Office tested what happens when public entities skip third-party risk assessment. In its report Managing third-party cyber security risks (Report 13: 2025-26), QAO auditors were able to bypass controls, get into corporate systems and take sensitive data out at entities that had not done that assessment. Seven recommendations followed, and Brisbane suppliers should expect agencies to act on them in contracts and questionnaires.

If you need to test your position against any of these, our cyber security audits in Brisbane cover IS18, the QPPs and supplier risk.

GRCLens: Evidence Once, Report Many Times

GRCLens maps IS18, ISO 27001, the Essential Eight, AESCSF and SOCI to one shared control model, so the evidence you gather for the annual return also serves your certification audit and your customer questionnaires. For agencies facing a 30 September deadline, that difference is measured in weeks of effort.

EASMLens: see what attackers see

EASMLens continuously discovers and monitors your internet-facing assets from the outside, including domains, subdomains, cloud services, certificates and exposed services that are missing from your asset register. For Queensland Government suppliers and critical infrastructure operators, that outside-in inventory is useful evidence for the Essential Eight and the SOCI Act’s critical asset requirements. See external attack surface management in Australia.

Why Brisbane Organisations Choose Security Solution Consultants

• We work to IS18 v10.0.0, not the superseded 2018 policy still circulating in supplier templates.
• Genuine depth across the Essential Eight, ISO 27001, AESCSF and SOCI in one team, which matters in a state where energy and resources sit alongside government.
• Fixed-scope engagements, so cyber security services in Brisbane come with a defined deliverable and price.
• Remote-first delivery with on-site workshops in Brisbane and regional Queensland where it is warranted.

Cyber security risk assessment in Brisbane

The most common first engagement, and the one worth getting right, because everything else scopes off it.

A risk assessment establishes what you hold, what could go wrong, how likely it is and what it would cost. The output is a risk register you can actually govern from, rated and owned, not a generic threat list with your logo on the cover.

For Queensland Government agencies and statutory bodies, this is the artefact IS18 v10 expects you to maintain and report against. For private suppliers, it is usually what a government or resources-sector customer has asked to see before awarding work.

What it covers: asset and information identification, threat and vulnerability analysis against your actual environment, existing control effectiveness, residual risk rating, and a prioritised treatment plan with owners and dates.

What it is not: a penetration test. A risk assessment tells you what matters and why. A penetration test tells you whether a specific control holds. Buyers are often quoted one when their customer asked for the other.

ISO 27001, SOC 2 and Essential Eight for Brisbane organisations

Three different obligations that arrive for three different reasons, and are frequently confused in Brisbane tenders.

ISO 27001 certification in Brisbane

ISO 27001 is the certifiable international standard for an information security management system (ISMS), and it is what the Queensland Government’s information and cyber security policy, IS18, names as the basis for an agency ISMS. If a Queensland Government contract, a national customer or an enterprise tender is asking for certification, this is the route.

IS18 sets five requirements for Queensland Government agencies: implement an ISMS based on ISO 27001, apply a systematic and repeatable approach to security risk management, meet minimum information security requirements, obtain security assurance for systems, and have accountable officers attest to the appropriateness of the agency’s information security each year. Agencies increasingly pass these expectations on to suppliers through contracts and the Queensland Government’s supply chain cyber security risk management framework, so Brisbane suppliers that hold a certificate, or can show an ISO 27001-aligned ISMS, are easier to approve.

For Brisbane organisations we cover the whole path:

• a gap assessment against ISO/IEC 27001:2022 and the 93 Annex A controls, with IS18 and Essential Eight mapping where you supply Queensland Government
• scope, risk assessment, Statement of Applicability, policies and control implementation
• an independent internal audit and management review
• support through the Stage 1 and Stage 2 audits with a JAS-ANZ accredited certification body

We publish our ISO 27001 readiness and certification cost ranges rather than making you ask, and our ISO 27001 certification service explains each step in detail. If you need other standards alongside ISO 27001, see security certification and accreditation services.

SOC 2 for Brisbane SaaS and tech firms

SOC 2 is an attestation report produced by a CPA firm, not a certification. It is asked for most often by US-headquartered customers and SaaS buyers. If your driver is a North American client, SOC 2 is usually what they mean even when they say “ISO”.

Essential Eight and IS18 for Queensland Government suppliers

Essential Eight is a control baseline rather than a certification. IS18 v10 sets the target maturity level as an agency decision, which is different from the fixed Maturity Level One used in New South Wales, and it means the level itself is a governance choice you need to document.

You may need more than one. You rarely need all three at once, and sequencing them properly is usually the largest available saving.

Certifications Brisbane businesses ask us about

Small and medium businesses across Brisbane are commonly asked for the same six things by customers, tender panels and prime contractors. These are typical requests, not survey results.

• SOC 2. Brisbane SaaS and managed service providers selling to US or enterprise customers are commonly asked for a SOC 2 report. A licensed CPA firm issues it; we prepare your controls and evidence first.
• ISO/IEC 27001. IS18 bases agency security management on ISO 27001, so certification speaks the buyer’s language for suppliers to Queensland agencies. An accredited certification body issues the certificate; we build and internally audit the management system.
• ISO/IEC 42001. Queensland’s AI governance policy is aligned to ISO/IEC 38507 and treats ISO 42001 as a supporting tool, which makes 42001 a practical way for vendors to show agencies how their AI is governed.
• ISO 9001. Firms tendering for Brisbane 2032 work, about 1,500 tenders across 37 venues over six years through ICN Gateway, and suppliers to Queensland’s METS sector, worth about $3.8 billion and 32,000 jobs, are commonly asked for certified quality management.
• ISO 22000. Queensland’s agrifood exports reached $15.6 billion in 2024-25, including $8.4 billion of beef. Processors and exporters supplying international retailers are commonly asked for ISO 22000 or FSSC 22000.
• Critical infrastructure security. Suppliers to energy, water and port operators are asked to support their customers’ SOCI risk management programs, from secure remote access to prompt incident notice.

Critical infrastructure in Queensland

Queensland has already seen what a cyber attack on an energy business looks like. In November 2021 CS Energy was hit by Conti ransomware. The attack reached its corporate network, and generation continued. For other Queensland operators the lesson is to know exactly how corporate IT and operational technology connect, and to have a response plan that has been tested before it is needed.

The Port of Brisbane is one of the critical ports covered by the Security of Critical Infrastructure Act 2018, alongside energy, water and other regulated assets across the state. Responsible entities must maintain a critical infrastructure risk management program, report serious cyber incidents within 12 or 72 hours and provide a board-approved annual report by 28 September. The enhanced CIRMP rules commenced on 10 June 2026, with some obligations phased in over 12 and 24 month grace periods.

Brisbane 2032 adds another layer. Venues, transport and event technology will rely on suppliers chosen through about 1,500 tenders over six years. Some of those suppliers will connect to critical systems or handle personal information at scale, and they should plan for security questions in tenders and contracts rather than meeting them for the first time at contract signing.

We help operators and their suppliers build and audit risk management programs, separate OT from corporate networks and prepare for the enhanced CIRMP obligations. See our SOCI Act compliance and CIRMP audit service and energy sector security assessments, or arrange a cyber security audit in Brisbane.

What cyber security costs in Brisbane

Brisbane sits below Sydney and Melbourne on consulting rates, though the gap is narrowing as mining, energy and Queensland Government demand rises.

Current Brisbane market ranges are hourly rates of AUD 150 to 280 or more, day rates of AUD 1,000 to 1,400 or more, and monthly retainers from AUD 2,000 to 10,000 or more. Project work typically runs AUD 3,500 to 22,000 depending on service type and scope.

Full breakdown, including how Brisbane compares with Sydney, Melbourne, Auckland and Wellington, is in our guide to what a cyber security consultant costs in Australia.

Scope drives cost more than headcount does. A thirty-person fintech with three cloud environments and a payments integration is more work than a two-hundred-person firm certifying one office.

How to choose a cyber security provider in Brisbane

Whoever you work with, these five questions separate a provider that fits from one that does not:

• Regulatory depth. Can they work across the rules you actually face: APRA for financial services, AESCSF and SOCI for energy, IS18 and the Essential Eight for Queensland Government work, and the Privacy Act for everyone?
• Industry experience. Ask for examples from your sector, not generic case studies.
• Evidence that lasts. A one-off report goes stale. Ask how controls and evidence stay current between audits.
• Independence. A consultancy can prepare you for ISO 27001, but only an accredited certification body can certify you.
• Clear scope and pricing. Expect a written scope and a fixed or capped quote before work starts.

Penetration testing and security testing in Brisbane

When the Queensland Audit Office examined how public entities manage third-party cyber risk in March 2026, its auditors got past controls, reached corporate systems and took sensitive data out at entities that had not assessed their third-party risk. That is exactly what a penetration test is designed to show you before an attacker or an auditor does.

Penetration testing in Brisbane covers the systems Queensland agencies and their suppliers rely on: citizen and customer portals, APIs shared with partners, internal networks, and cloud and Microsoft 365 tenancies supporting IS18 programs. Brisbane SaaS companies selling to US customers pair testing with SOC 2 readiness, and suppliers bidding for Brisbane 2032 work increasingly need test evidence in their tender responses. For energy and water operators we run passive OT assessments, mindful of what Queensland learned from the 2021 ransomware attack on CS Energy. Secure code review and threat modelling are available for teams building their own software. See our penetration testing and security testing services, or arrange a cyber security audit in Brisbane.

Frequently Asked Questions

Is IS18 still called IS18:2018?

No. The current instrument is the Information and cyber security policy (IS18) version 10.0.0, issued 17 June 2026. Referencing the 2018 version in a tender response is a common and entirely avoidable error.

What Essential Eight maturity level does Queensland require?

IS18 v10 requires the Essential Eight but lets the agency select its own target maturity level, unlike the NSW policy which fixes Maturity Level One. The selection needs to be justified and documented.

Do Queensland councils have to notify data breaches?

Yes, since 1 July 2026 under Chapter 3A of the Information Privacy Act. State agencies have been in scope since 1 July 2025. The assessment must be completed within 30 days of becoming aware.

Does IS18 apply to us as a private supplier?

Not directly. It binds Queensland Government agencies and statutory bodies. Suppliers encounter it through procurement and contractual assurance, which in practice means you are asked to evidence equivalent controls.

When is the annual IS18 return due?

30 September, to the Cyber Security Unit, endorsed by the accountable officer through the audit and risk committee. The attestation is then published in the agency’s annual report, so it is a public document.

What does a cyber security risk assessment cost in Brisbane?

Project work in Brisbane typically runs AUD 3,500 to 22,000 depending on scope and service type, with risk assessments at the lower end of that band for a contained single-site scope. Scope drives the number, so we scope before quoting.

Do we need ISO 27001 or SOC 2?

It depends who is asking. ISO 27001 is a certification and is what IS18 v10 names for Queensland Government agency management systems. SOC 2 is a CPA attestation and is usually what US-headquartered customers mean. If a specific contract is driving the requirement, bring the clause and we will tell you which one it actually calls for.

Can you do the work remotely, or do you need to be on site?

Most of it is remote. Site visits are needed where physical security is in scope or where evidence cannot practically be produced any other way. We work across Brisbane and regional Queensland.

Get Started

If you need cyber security services in Brisbane ahead of the 30 September return, request an IS18 v10 gap assessment, an Essential Eight review, or a GRCLens demo. Contact us to talk it through. We also work in Melbourne, Sydney and across New Zealand.