CyberSafeCheck Free · No sign-up · Instant score, action plan and PDF report · Mapped to Essential Eight, ISO 27001, Privacy Act, SMB1001
Why professional services firms are targeted
Professional services firms are attractive because of who their clients are. Getting into a smaller supplier is often the easiest way to reach a larger organisation's data, or to send convincing fake invoices to it.
Hybrid work and a growing list of cloud tools make it hard to know where client data lives and who can see it. Former staff and contractors who still have access are a common gap.
What the professional services check asks about
The quick check has 20 questions and the full assessment 43. Both cover the fundamentals every business needs (access and passwords, devices and updates, email and phishing, backups, governance and data protection), plus questions specific to your sector:
- Client data confidentiality
- Contractual security obligations
- Remote & hybrid work security
- SaaS / cloud governance
- Work-product & IP protection
You get a score out of 100, a breakdown by area and a prioritised action plan that shows which framework each recommendation relates to.
Obligations that may apply to you
- Client contracts. Many clients now include security clauses and send security questionnaires before they engage you. Being able to show evidence, such as SMB1001 or ISO 27001 certification, can win or lose work.
- Government work. Government buyers commonly expect suppliers to align with the Essential Eight.
- The Privacy Act. Firms with annual turnover above $3 million, and contractors handling personal information for the Commonwealth, must meet the Australian Privacy Principles.
- Ransomware payments. Firms with turnover above $3 million must report a ransomware payment to the Australian Signals Directorate within 72 hours.
Four things to do first
- Turn on multi-factor authentication for every cloud tool that holds client data
- Remove access promptly when staff and contractors leave
- Limit each client's files to the people working on that client
- Keep a simple record of the security controls you have, ready for client questionnaires
Start the free professional services check
Frequently asked questions
Why do clients send us security questionnaires?
Because suppliers are a common route into larger organisations. Clients want evidence that you protect their data. A short, honest summary of your controls, or a recognised certification such as SMB1001 or ISO 27001, answers most questionnaires.
Which certification should a small firm start with?
For many small Australian firms SMB1001 is a practical first step, because it is designed for small and medium businesses and has tiered levels. ISO 27001 is more demanding and suits firms whose clients specifically ask for it.
Is this check an audit?
No. It is a free self-assessment with an instant score and action plan. It is not a formal audit, certification or legal advice.
This page and the assessment are general information and an educational guide to your security posture. They are not a formal audit, certification or legal advice.