We tell an Australian accounting or law firm exactly where its security stands against the Essential Eight, for a fixed price, and then we fix it and keep it fixed.
Accounting firms, law firms, SMSF auditors, financial advisers, insolvency practitioners and finance brokers. Typically five to fifty people. Usually Microsoft 365, one server, and no internal IT beyond whoever is best with computers.
A fifteen person practice carries the Privacy Act, professional standards and a practising certificate, the same as a firm of five hundred. Increasingly it also has clients, insurers and supply chain partners asking it to prove something in writing.
Comptrusence is led by a former accountant with six years of compliance advisory experience. We open a conversation as a fellow finance and compliance professional, not as a technology vendor. We know what an auditor contravention report is, why independence matters, and why a finding that cannot be traced back to a source document is worthless.
We are not a general IT provider. We do not fix printers, we do not sell hardware, and we do not run a helpdesk. We do one thing. We tell a firm where it actually stands, we fix what is wrong, and then we keep it that way.
Run it yourself against your own domain. It covers security headers, TLS configuration, DNS and email authentication including SPF, DKIM and DMARC, and exposed library versions, with every finding mapped to the Essential Eight.
This is not a product. It exists so you can see that we can do the technical work before you have paid us anything.
Fixed price. Two weeks. The engagement that starts most client relationships.
What we do: external attack surface review of every internet facing system, Microsoft 365 tenant configuration review, and an Entra ID access review covering who holds administrator rights, who has left and still has access, and where multi-factor authentication is missing. We check your backup posture, meaning what is backed up, whether a restore has ever been tested, and how long a recovery would genuinely take. We assess patch currency and your application control position.
What you receive: a written report rating you against each of the Essential Eight mitigation strategies at Maturity Level One, Two or Three. A named list of what is wrong, ranked by how likely it is to hurt your firm rather than by generic scanner severity. A costed remediation plan, so your next decision is a number rather than another conversation. And a one page summary written for a partners' meeting.
Fixed price. One week. A narrower assessment for firms that are entirely cloud based with no server. The same kind of output at a smaller scope, and a sensible way to test us before committing to anything larger.
The most common situation we find is a firm that has already had a penetration test, holds the report, and has not fixed anything.
| Stage | What happens | Duration |
|---|---|---|
| 1. Triage and plan | We validate every finding in your existing report against your actual environment. Most reports contain findings that are not exploitable in context, and findings far more serious than their rating suggests. We separate them, sequence the fixes and cost each one. You receive a remediation plan with a fixed price for Stage 2 and an honest statement of what can safely be deferred. | 2 weeks |
| 2. Remediation | Delivery against the plan, agreed in writing before work starts, against a ceiling you set. Sold in blocks of days rather than as an open engagement. | Agreed blocks |
| 3. Retest and closure | We verify each finding is closed and produce an evidence pack: what the finding was, what changed, and what proves it. Written so it can be handed to an insurer, a board, or a client conducting a supplier review. | 1 to 2 weeks |
| 4. Keep it fixed | Remediation decays. A firm that fixes everything and then changes nothing about how it operates is back where it started inside a year. Stage 4 is the managed service below. | Ongoing |
Multi-factor authentication enforced across the tenant. Conditional access configured. Administrator accounts separated from daily-use accounts. Departed staff removed. Access reviewed, documented and handed over as a register you can maintain yourself. This is the single highest value fix for most professional firms, and it produces an artefact an auditor can read. Where a baseline assessment finds nothing else, it almost always finds this.
Built on an enterprise continuity and security platform with all data in an Australian datacentre. Business hours support. Thirty days notice to cancel, no exit fee.
Microsoft 365 backup covering mail, OneDrive, SharePoint, Teams and OneNote, plus Microsoft Entra ID backup. Every backup is rescanned against current malware signatures, and you get a monthly restore test with a written result.
Everything above, plus email security scanning inbound mail before delivery, collaboration security across Teams, SharePoint and OneDrive, Microsoft 365 security posture management, AI data protection, and a quarterly report mapped to the Essential Eight and the Privacy Act.
Full machine backup, physical or virtual, agentless for VMware, Proxmox, Nutanix and vSphere, with Sydney hosted storage included. Backups are malware scanned, so a restore point can be proven clean before it is used. Quarterly recovery verification with a written result.
It stops client information and matter detail being pasted into ChatGPT, Copilot, Claude and similar tools, and it blocks prompt injection arriving inside documents, spreadsheets and emails. It runs in detect-only mode if you want visibility first, or block mode if you want the control enforced. For a firm that has just realised its junior staff are drafting with AI, this is usually the whole conversation.
Security awareness training is available alongside any package, with phishing simulation and quarterly click-rate reporting you can show an insurer or an auditor. Every engagement begins with a fixed onboarding: tenant connection, policy configuration, first full backup verified, and a baseline report.
This is the work our background actually sells, and it is what separates us from a managed service provider chasing the same firms.
| Service | What it is |
|---|---|
| SMB1001 readiness | Bronze, Silver or Gold. The Australian five tier cyber security standard for small and medium business. Recognised by insurers, government bodies and supply chain partners, and a far more realistic target for a fifteen person firm than ISO 27001. |
| Essential Eight uplift | A programme built directly from your baseline assessment, so the scope is known before it is priced. |
| Privacy Act and APP review | A compliance review against the Australian Privacy Principles, including your position under the Notifiable Data Breaches scheme. |
| ISO 27001 gap assessment | Gap assessment and preparation of the evidence you will be asked for. |
| APRA CPS 234 readiness | Scoped and quoted per engagement. |
We get firms ready for certification and build the evidence they will be asked for. We do not certify anybody and we are never the auditor. Where a firm needs certification, we say so and tell them who does that. On SMB1001, Bronze, Silver and Gold are self-attested, which is the work we deliver. Platinum and Diamond require independent audit and sit outside what we offer.
A system that reads documents before a professional does. It extracts the figures, reconciles them against the accounts, matches every assertion to the evidence supporting it, applies the compliance tests, and hands the reviewer a queue already ranked by risk.
We map how the work actually runs, look at real files, and state honestly what can and cannot be automated. The fixed price for the pilot is set at the end of this stage, not before it.
Built for a narrow slice and run against historical files whose outcomes are already known, so accuracy is measured against your own conclusions rather than against a claim we make.
Full system, integrated, security tested, documented, and your people trained on it. Agreed in writing against a ceiling you set.
We run it, monitor it, patch it, keep it current with regulation, and report monthly against agreed service levels.
The machine prepares. The professional decides. Every finding cites the document it came from. Nothing is asserted without a source. The registered professional forms and signs the opinion exactly as they do today. We are not building something that audits. We are building something that does the reading.
The technical commitment on this work: Claude via Amazon Bedrock in the AWS Sydney region, inside an account you own, encrypted with keys you control. Nothing retained. Nothing used to train any model. Every document processed and every action taken is logged in a form your own auditors can read.
These are not productised, and we will not price them in a first meeting. They are scoped against your specific environment and objectives.
Specialist led, scoped per engagement, and only ever run with written authorisation.
Specialist led, scoped per engagement, with evidence handling documented throughout.
Subject to licensing. Quoted per engagement, and only after the licensing position for that jurisdiction has been confirmed.
We commit to Australian data residency in writing, so we have to be precise about what that means. This section is written to be handed to a compliance officer or an external auditor without amendment.
| Where the work runs | Location |
|---|---|
| Managed services: backup, email security, collaboration security, AI data protection | Sydney datacentre |
| Advisory and AI engagements | AWS Sydney region, in an account you own |
| The scanning platform and assessment tooling | Australian infrastructure |
| Reports, evidence packs and working papers | Australian infrastructure |
Geo-redundant second copies are not available inside Australia on the platform we use, and Auckland is not an option either, so there is no compliant second copy available anywhere in the region from that platform. Where you require a second copy, we hold it ourselves on Australian infrastructure, or on storage you own and control. We will not silently replicate Australian data offshore to satisfy a redundancy requirement, and we will not describe a service as geo-redundant when the second copy would leave the country.
Available on request: the platform provider's SOC 2 Type 2 report and ISO 27001 certificate, a data processing agreement and current sub-processor list, breach notification terms as they relate to the Notifiable Data Breaches scheme under the Privacy Act 1988, and our retention and export position on termination.
Fixed price wherever the scope can genuinely be fixed, which is most of this page. Where scope cannot be fixed, an agreed day rate in blocks against a ceiling you set in advance. No open-ended engagements. Monthly services are billed monthly in advance, thirty days notice to cancel, no exit fee.
Assessment reports, evidence packs and any configuration built around your environment belong to you from the first day. Findings always go in writing: if we say something is wrong, there is a document that says why and what it is based on. We staff engagements with the principal, not a graduate. Where a specialist is required we bring one in and pay for them out of the agreed figure.
Two weeks, a fixed price, and a written report that tells you where your firm actually stands. If little is wrong, we will say so.