A cyber security audit is an independent assessment of how well an organisation's security controls, practices and readiness stand up against a stated benchmark. Done properly, it answers the question boards actually ask, which is not "are we secure?" but "where are we exposed, how much does it matter, and what should we fix first?" This article sets out what a proper audit covers, how it differs from the things that get sold under the same name, how the process runs, and what the report at the end should tell you.

What a cyber security audit is, and what it is not

The term gets used loosely. Three things are regularly called an audit and are not one.

A vulnerability scan is an automated tool run against your systems that lists known weaknesses. It is useful, cheap and shallow. It tells you nothing about whether your staff would click the link, whether your administrator accounts are shared, or whether anyone has tested the backup restore.

A penetration test is a controlled attempt to break in through a defined set of systems on a defined day. It is a point-in-time test of technical defences, valuable when you already know your controls are in reasonable shape and want them pressure-tested.

A vendor security review is an assessment run by a managed service provider, reseller or security vendor, and it ends in a quote. The findings may be accurate, but the person producing them is paid when you buy the remediation, so the gap has a way of being exactly the size of their product.

An audit sits above all three. It assesses controls, configuration, process, people and readiness against a benchmark, produces evidence rather than assertions, and ranks what it finds by risk and effort. Its usefulness rests entirely on the auditor having no stake in what the findings turn out to be.

The types of audit Australian organisations commission

Scope follows the decision in front of you. In our experience the engagement usually falls into one of four shapes.

Essential Eight maturity assessment

The Australian Signals Directorate's Essential Eight is the most common benchmark for Australian organisations, and the one most boards have heard of. The audit establishes which maturity level you genuinely sit at for each of the eight strategies, with evidence behind each rating rather than a self-assessment. Worth noting: the ASD has signalled a move away from the Essential Eight toward outcome-based expectations, so a current audit should record the evidence in a way that survives the change. We cover that shift in The Essential Eight is being retired.

Information security and privacy health check

Broader than the Essential Eight. It takes in platform configuration (most often Microsoft 365), identity and access management, controls over staff use of AI tools, network and device access, end-user awareness, and whether a response plan exists with clear roles. It is the right shape when the question is "how exposed are we, overall?" rather than "how do we rate against one framework?"

Compliance-driven review

Some audits are shaped by an obligation: the Privacy Act and the reforms landing in 2026, APRA's prudential standards for regulated entities, the Security of Critical Infrastructure Act for designated operators, or a client contract that requires ISO 27001 or SOC 2 alignment. Here the benchmark is set for you, and the audit's job is to show where you stand against it and what closing the gaps would take.

Incident readiness review

Sometimes the prompt is not a framework but a fear: what happens on the day. This audit tests the response plan, the roles, the communications, the backups and the recovery, usually through a walkthrough or a simulated incident. It tends to be the one that changes behaviour fastest, because it makes the gap concrete.

What a proper cyber security audit covers

Whatever the shape, a credible audit looks at the same seven areas. If a proposal skips several of them, ask why.

• Security posture against the benchmark. Where you sit against the Essential Eight or the standard you have chosen, with evidence for each rating.
• Core platform configuration. For most Australian organisations that means the Microsoft 365 tenancy: how it is set up, what is switched on, and what is switched off that should not be.
• Identity, credentials and access rights. How identities are managed, how credentials are protected, whether multi-factor authentication actually covers the accounts that matter, and who still holds rights they no longer need.
• AI controls. Whether staff use of generative AI tools is governed at all, and what organisational data is leaving through them.
• Network and device access. Access control and countermeasures across the network and every device on it, including the ones nobody remembers connecting.
• People. Whether staff know what suspicious looks like and what to do about it. Most incidents start with a person, so this is not the soft part of the audit.
• Response readiness. Whether a response plan exists, whether roles and responsibilities are clear, and whether any of it has been tested outside a document.

How the audit runs

A well-run audit has a rhythm to it, and the rhythm matters more than the tooling.

1. Scope. Agree the questions the audit must answer and the benchmark it is measured against. This is where cost is set, so it should be a conversation, not a form.
2. Evidence. Gather configuration exports, access lists, policies, training records, incident logs and the response plan. Interviews with the people who run the systems and the people who use them.
3. Assessment. Test what the evidence shows against the benchmark and, just as importantly, against what the organisation actually needs. A control that meets the standard but that nobody follows is a finding.
4. Prioritisation. Rank findings by the risk they carry and the effort to close them. Two columns, not one. A high-risk gap that costs an afternoon to fix goes to the top; a low-risk gap that needs a new platform goes to the bottom, however impressive the platform.
5. Report and walkthrough. Findings in plain language, presented to the executive or board, with the auditor in the room to answer the questions the document raises.
6. Act, then re-audit. The findings become a plan with owners and dates. Twelve months later the audit runs again, because the threat environment will have moved even if you have not.

What the report should tell you

The report is the product, so judge the audit by it. A useful one has five properties.

It states the benchmark and the scope plainly, so nobody later argues about what was and was not assessed. It gives each finding a risk rating and an effort rating, and explains both in a sentence a non-technical director can follow. It separates configuration gaps (fixable by the people you already pay) from process gaps (fixable by a decision) from capability gaps (which may need spend). It records the evidence behind each rating, so the next audit can measure movement. And its recommendations are sized to your organisation: budget, staff, appetite for change.

If the report reads like a product proposal, it is one. If every recommendation resolves to a purchase from the firm that wrote it, you have paid for a sales document.

Internal, external, or independent?

Internal audits, run by your own IT or risk function, are valuable for continuity and cheap to repeat, but they inherit every blind spot the organisation already has. External audits bring outside eyes, but "external" is not the same as "independent". The question to ask any external auditor is simple: what do you sell? If the answer includes the products, licences or managed services that the findings might recommend, the audit is conflicted before it starts.

Independence means the auditor has no financial interest in the outcome. No reseller margin, no implementation contract, no managed service to protect. It is the single property that makes the findings trustworthy, and it is the reason Beyond Technology sells nothing but the advice.

How to choose an auditor

Five questions sort the field quickly.

• What do you sell besides the audit? The right answer is "nothing".
• Which benchmark will you assess us against, and can we see a sample report?
• Who does the work: senior consultants who have run technology functions, or a junior with a checklist?
• Will the findings be ranked by risk and effort, and will you present them to the board in person?
• What happens to the findings afterwards? The right answer is "they are yours: act on them internally, hand them to your provider, or engage us. All three are fine."

What drives the cost

We do not publish a price for an audit because scope sets it, and scope is a conversation. The variables are the breadth of the benchmark, the number of platforms and sites in scope, how much evidence already exists (a well-documented environment audits faster), the number of people to interview, and whether you want a walkthrough or a simulated incident included. A focused Essential Eight check is a different engagement from a full information security and privacy review across several business units. Any credible auditor will give you a fixed proposal before starting, and none of it should depend on what you buy afterwards.

Preparing for the audit

Preparation is mostly about access and openness. Nominate one person who can grant read access to the platforms in scope and reach the people who run them. Pull together whatever exists: policies, the last risk register, the response plan, training records, the contract and reporting from your managed service provider. Do not tidy up first. An audit of the environment you wish you had is worthless; the point is to see the one you have.

Frequently asked questions

How often should a cyber security audit be done?

Annually is standard practice for Australian organisations, and some regulated industries have mandatory assessment cycles. The threat environment changes fast enough that an organisation which has not materially improved its position in twelve months has usually gone backwards in relative terms.

What is the difference between a cyber security audit and a cyber health check?

Mostly scope and depth. A health check is a lighter, faster assessment designed to give an executive team a quick read on posture and priorities. An audit goes deeper on evidence and is the right choice when a regulator, insurer, client or board needs a defensible position.

Does a small organisation need one?

If technology decisions land on an owner, a finance manager or an operations lead with a full-time job already, yes, and the audit should be sized accordingly. Smaller organisations are targeted precisely because attackers expect the controls to be thin.

Can the audit be scoped to one thing, like our Microsoft 365 set-up?

Yes. A narrow, well-chosen scope is often the right first step, provided the report is clear about what it did not look at.

What happens after the audit?

The findings become a prioritised plan with owners and dates. You can run that plan internally, hand it to your provider, or engage us to help govern it. What we will not do is sell you the remediation, because that would make the next audit worthless.