Essential Eight readiness assessment
from $1,850to 20 staff, one site
All eight controls, evidenced. A written finding on each, a plan ordered by what actually reduces risk first, and a 45-minute walkthrough with whoever runs your IT.
Fixed-scope security assessments · WA
Find out where you actually stand — a fixed-price security assessment for WA businesses.
Eight controls checked, the ones you already have named, the rest priced. Two principals in West Perth, for businesses of 10 to 150 staff.
The fee is on this page, not behind a discovery call. From $1,850, ten working days.
- A written finding on each of the eight
- No managed-service contract at the end
- Nine years between the two of us
The Readiness Check
Our fee, before you ringSet each of the eight to where you honestly are — tap to cycle. Add your numbers and this prints our fee and our turnaround.
Each control cycles between in place, not sure and no.
4 of 8 in place, 4 we would look at first
ASD Essential Eight control namesStandard
$3,175
10 working days
Priority
$4,127.50
5 working days
+$952.50
Priority costs $952.50 to halve a wait we do not think you need. Ten working days is usually fine, and we will say so on the phone.
Your second site adds a flat $650. One site instead of two would be $2,525 at the same headcount. Under 20 people the fee stops falling — $1,850 is the floor and it is the same figure on the services card above.
Three things this figure does not tell you
We do not tell you what your insurer will accept, what maturity level you need, or whether a law applies to your business. Insurers set their own terms, the ASD sets the framework, and your lawyer reads the Act. We tell you which of the eight are in place, what it costs to close the rest, and how long we will take.
Send this through
Seven or eight already in place? Tick the box in the form and we will say so on the phone rather than sell you an assessment.
Four things we do, and what they cost
Fixed scope, fixed fee, written before we start. If a job does not fit one of these four we will tell you rather than stretch one to fit.
Remediation, beside your IT provider
$1,450 a dayquoted as a number of days up front
We close the gaps we found, or sit beside whoever does. You get the day count before we start and we do not bill past it without asking you first.
Multi-factor rollout
from $980email, remote access, admin accounts
The rollout plan, the staff email, the fallback for the person who loses their phone at the airport, and a fortnight of picking up the stragglers.
Supplier questionnaire, answered
from $650per questionnaire, evidence attached
The forty-page spreadsheet a customer sent you. Answered in your words with the evidence attached, and a short note on which answers are weak and why.
Why people ring us instead of their IT provider
Your IT provider is marking their own homework. We are not selling you a platform, a retainer or a helpdesk, so the finding can say what it likes.
We are not your MSP and do not want to be
No managed service to upsell at the end. If the fix is a setting your existing provider can change on Tuesday, that is what the report says.
The fee is published
Every competitor in this town says “contact us for a quote”. We put the arithmetic on the page: a base, a rate per person over twenty, and a flat charge per extra site.
Every finding names its evidence
Not “MFA is partially implemented”. A screenshot, an export, the date we took it and the account it applies to, so you can hand it to anyone who asks.
You keep the plan
The remediation plan is yours whether we do the work, your provider does it, or nobody does. It is a document, not a login to something.
- A twenty-minute call, no chargeWe work out whether your job is the $1,850 shape or something else. If it is something else we say so on that call, before anyone signs anything.
- Two days on your systems, then the site visitsRead-only access to your identity, endpoint and backup consoles, and a walk around each site on the list. Nobody has to stop working.
- Day ten, the report and the walkthroughA finding on each of the eight, the evidence behind it, and a plan ordered by risk. Forty-five minutes on a call to go through it with your provider in the room.
What clients said
Written for this demonstration. On the real practice’s site these come from the review feed the business already uses.
“A customer sent us a security questionnaire with a deadline on it and we had no idea what half of it meant. Keystone answered it in our words, attached the evidence, and flagged the three answers that were weak so we were not blindsided later.”Operations manager, engineering firm — Osborne Park
“We had six of the eight already. They told us that on the phone before we booked, which cost them a job. We booked anyway, for the two we did not have.”Owner, wholesale supplier — Welshpool
“The report went to our IT provider and they did not argue with a line of it, because every finding had a screenshot and a date under it. Ten days, and the fee was the fee.”General manager, allied health group — Joondalup
These are demonstration reviews on a page that says it is fictional. They are deliberately not published as structured review data.
Where we go
Site visits across the Perth metropolitan area from West Perth. Regional WA by arrangement, quoted with travel as a separate line so you can see it.
Base — West Perth
Suburbs we visit weekly
Outer metro, visited on the day booked
- West Perth · Perth
- Subiaco · Osborne Park
- Balcatta · Malaga
- Wangara · Joondalup
- Midland · Bayswater
- Welshpool · Cannington
- Canning Vale · Myaree
- Fremantle · Bibra Lake
- Jandakot · Kwinana
- Rockingham · Mandurah
- Belmont · Redcliffe
- Bunbury by arrangement
Questions we get asked
Plain answers. Where the honest answer is “that is not ours to say”, we say that instead.
What do you actually look at?
The eight controls in the strip above, one at a time: application control, patch applications, configure Microsoft Office macro settings, user application hardening, restrict administrative privileges, patch operating systems, multi-factor authentication and regular backups. Those eight names are the ASD Essential Eight control set. We give you a written finding on each, with the evidence we relied on.
Can you tell us whether we meet our insurer’s requirements?
No, and we explain why beside the fee above. What we can do is give you an evidenced finding on each of the eight controls, in a document you can send to your broker, your customer or your board, so the person who does set those terms has something factual to read.
How long does it take, and what does “working days” mean?
Ten working days from the day we get access, for a standard assessment. That is business days, not calendar days, and the clock starts when the read-only accounts are live rather than when you sign. Priority halves it to five and costs thirty per cent more; the Readiness Check prints exactly how much that is for your numbers.
Does anyone have to stop working while you are in?
No. We work read-only. Nothing gets installed, no agent goes on a machine, and nobody gets locked out. The site visits are a walk around with whoever holds the keys — comms cupboard, the machine in reception, the laptop that lives in a ute.
We think we already have most of it. Is this worth doing?
Possibly not, and we would rather tell you that on the phone. Set the strip above honestly — if seven or eight come out as in place, tick the box in the form and we will call you and talk it through instead of booking an assessment you do not need.
Do you do the fixing as well, or just the finding?
Both, but never as a condition. Remediation is $1,450 a day, quoted as a number of days before we start. Most clients hand the plan to the IT provider they already have, and that is a perfectly good outcome for us.
What happens to our data?
Evidence stays in an encrypted store we control, is used only for your report, and is destroyed ninety days after we hand it over unless you ask us to keep it for the next round. You get the list of what we hold on the day we deliver.
Tell us where you are and we will price it
We answer within one business day, on the phone, with a person who has read what you wrote. No sequence of emails.
That is with us.
We would ring you within one business day.
This is a demonstration page, so nothing was sent anywhere — the summary above was assembled in your browser. On the real practice’s site this lands in their CRM with the Readiness Check attached.