Skip to main content
Testing & Assurance · Assessment Guide

Cybersecurity
assessments:
which ones actually
matter.

Most Australian organisations are running cybersecurity assessments in the wrong order. They commission a penetration test before they have basic controls in place, run a compliance gap analysis without knowing what framework their regulator actually expects, or treat an annual vulnerability scan as a substitute for genuine risk management. The assessment itself is not the problem. The sequencing, scope, and intent behind it usually is.

With the Security of Critical Infrastructure Act tightening, the Cyber Security Act 2024 now in force, APRA intensifying enforcement of CPS 234, and ASD recording over 1,100 cyber security incidents in 2023-24 alone, the question is no longer whether to assess. It is what to assess, when, and against what standard.

Written by practitioners who are ISO 27001 certified, CREST accredited, and conduct cybersecurity assessments across Australian industries.

01 / Why most assessments fail to improve security

The assessment is rarely the problem. The thinking behind it usually is.

There is no shortage of cybersecurity assessment activity in Australia. ASD's Annual Cyber Threat Report 2023-24 recorded over 1,100 cyber security incidents responded to by the Australian Signals Directorate, an 11% increase on the prior year. The average self-reported cost per incident reached $49,600 for small businesses and $62,800 for medium businesses. These are organisations that, in many cases, had undergone some form of security assessment.

The issue is that most assessment programmes are built around compliance calendars and vendor sales cycles rather than actual risk. An annual penetration test becomes a checkbox exercise. A framework gap analysis produces a 200-page report that no one reads. A vulnerability scan runs monthly but the findings queue never gets shorter because no one has the authority or budget to remediate.

Effective cybersecurity assessment is not about running more tests. It is about running the right assessment, at the right maturity level, against the right standard, at the right time. That requires understanding what each assessment type actually does, what it does not do, and where it fits in a broader security programme.

The core problem: Assessment without intent is just documentation. If the output does not change a decision, influence a budget, or close a gap, the assessment has failed regardless of how thorough the report looks.

02 / The seven assessment types that matter

Each assessment serves a different purpose. Using the wrong one for your situation wastes money and creates false confidence.

The cybersecurity assessment landscape includes dozens of branded methodologies and vendor-specific offerings. Strip away the marketing, and there are seven distinct assessment types that Australian organisations should understand.

1
Risk Assessment
A structured process to identify threats, evaluate the likelihood and impact of security events, and prioritise risk treatment based on business context. This is the foundation that every other assessment should build on. Without a risk assessment, you are making security decisions based on assumptions, vendor recommendations, or whatever the last breach in the news was about. A well-executed risk assessment uses a recognised methodology (ISO 27005, NIST SP 800-30, or AS/NZS ISO 31000) and produces a risk register that maps threats to business impact.
When to use
Before any other assessment. Annually. After significant business changes (mergers, new products, cloud migration, office moves). After a major incident. Typical duration: 2-4 weeks depending on organisational complexity.
2
Framework Gap Analysis
A structured comparison of your current security controls against a recognised framework or standard. The output is a gap register showing where you meet, partially meet, or fail to meet each requirement. The most common frameworks for Australian organisations are the ASD Essential Eight, ISO 27001, NIST CSF, and APRA CPS 234. The value of a gap analysis depends entirely on choosing the right framework. Assessing against the wrong standard produces a technically accurate but strategically useless report.
When to use
When preparing for certification (ISO 27001), regulatory compliance (CPS 234, SOCI Act), or when you need a structured baseline of your current maturity. Typical duration: 2-6 weeks depending on framework scope and organisational size.
3
Vulnerability Assessment
Automated and semi-automated scanning of systems, applications, and infrastructure to identify known vulnerabilities. Produces a broad catalogue of findings ranked by severity (typically using CVSS scores). Vulnerability assessments are wide but shallow; they tell you what is exposed, but not necessarily what an attacker could do with it. They are essential for maintaining visibility across your environment, particularly as new vulnerabilities are disclosed at a rate of over 29,000 CVEs per year globally.
When to use
Continuously or at least monthly. Before and after major changes. As a prerequisite to penetration testing. Typical duration: 1-3 days for a point-in-time scan; ongoing for continuous programmes.
4
Penetration Testing
Skilled testers simulate real-world attacks against your environment to identify exploitable vulnerabilities and demonstrate realistic attack paths. Unlike vulnerability assessments, penetration testing involves manual exploitation, chaining of vulnerabilities, and assessment of business impact. A good penetration test tells you not just what is vulnerable, but what an attacker could actually achieve: lateral movement, privilege escalation, data exfiltration, or full domain compromise. The scope can range from external network testing to web application testing, internal network testing, wireless assessment, and social engineering.
When to use
Annually at minimum. After major infrastructure changes. After basic controls and vulnerability remediation are in place. Not as your first assessment. Typical duration: 1-4 weeks depending on scope (external only vs full internal, web apps, wireless, social engineering).
5
Security Architecture Review
An evaluation of the design and implementation of your security architecture, examining network segmentation, identity and access management, data protection controls, cloud configuration, and how security is integrated into your technology stack. This assessment identifies structural weaknesses that vulnerability scans and penetration tests may not catch, such as missing network segmentation, over-privileged service accounts, or inadequate logging and monitoring coverage.
When to use
During or after cloud migration. When modernising infrastructure. When integrating acquisitions. When your environment has grown organically without deliberate security design. Typical duration: 2-4 weeks for a focused review; longer for complex multi-cloud or hybrid environments.
6
Compliance Audit
A formal, structured examination against specific regulatory or contractual requirements with a defined outcome: compliant or non-compliant. Compliance audits differ from gap analyses in rigour, formality, and consequence. An ISO 27001 certification audit is conducted by an accredited body. An APRA tripartite assessment is conducted by APRA-appointed auditors. The output carries legal or commercial weight. Compliance audits verify adherence; they do not necessarily measure security effectiveness.
When to use
When pursuing certification. When required by regulators. When contractual obligations demand independent verification of controls. Typical duration: 1-2 weeks for the audit itself; preparation and remediation can extend the overall process to several months.
7
Breach Simulation & Red Teaming
The most advanced form of offensive testing. Red team exercises simulate a real adversary operating against your organisation with specific objectives (accessing sensitive data, compromising critical systems, achieving persistent access). Unlike penetration testing, red teaming tests your detection and response capabilities as well as your technical controls. It is scenario-driven and typically runs over weeks rather than days. Red teaming is only valuable for organisations that already have mature security controls and an active detection and response capability.
When to use
Only when you have mature controls, a SOC or managed detection capability, and an incident response plan. This is an advanced assessment, not a starting point. Typical duration: 4-8 weeks including planning, execution across multiple attack scenarios, and debrief.
03 / Getting the sequence right

Assessment order matters more than assessment quality. Here is what to run and when.

The single most common mistake in cybersecurity assessment is running assessments out of sequence. A penetration test on an environment with unpatched systems, default credentials, and no MFA is not a test of your defences. It is an expensive way to confirm what a basic controls review would have found for a fraction of the cost.

The right sequence depends on your current maturity. The table below maps assessment types to three broad maturity stages.

Maturity stage Priority assessments Why this order
Foundation
No formal programme
Risk assessment, then Essential Eight gap analysis, then vulnerability assessment Establish what you are protecting, identify the biggest gaps, and build visibility of your attack surface before testing defences that do not exist yet.
Developing
Basic controls in place
Framework gap analysis (ISO 27001 or NIST CSF), penetration testing, security architecture review Validate that your controls work in practice, identify structural weaknesses, and build toward a formal management system.
Mature
Formal programme, SOC, IR plan
Red teaming, compliance audit, continuous assessment and monitoring Test detection and response capability, achieve or maintain certification, and shift from periodic to continuous assurance.

The expensive mistake: Commissioning a $40,000 penetration test when you have not implemented MFA, your patching cycle exceeds 30 days, and local administrator accounts share the same password. The tester will find dozens of critical findings in the first hour. You did not need a penetration test to discover them.

04 / Choosing the right framework

The framework you assess against determines the value of the assessment. Choose based on your industry, obligations, and maturity.

Australian organisations face a crowded framework landscape. The four most relevant frameworks each serve a different purpose, and most mature organisations will eventually need more than one.

ASD Essential Eight
Eight prescriptive technical controls designed to prevent malware, limit the impact of incidents, and maintain data availability. Mandated for Commonwealth Government agencies under the PSPF. Increasingly treated as a de facto technical baseline across regulated industries. Practical, specific, and measurable.
Essential Eight services →
ISO 27001
The international standard for information security management systems (ISMS). Risk-based, covering governance, people, processes, and technology across 93 controls in 4 domains. Certifiable by accredited bodies. Provides the management system that technical frameworks like the Essential Eight sit inside.
ISO 27001 services →
NIST Cybersecurity Framework
A risk-based framework organised around six functions: Govern, Identify, Protect, Detect, Respond, and Recover (CSF 2.0). Not certifiable, but widely used as a maturity and communication tool. Useful for reporting to boards and aligning with international business partners.
NIST CSF services →
APRA CPS 234
Mandatory for all APRA-regulated entities (banks, insurers, super trustees). Covers board accountability, information asset classification, controls, testing, incident notification (72-hour rule), and third-party risk. Backed by real enforcement, including Medibank's $250 million capital charge.
CPS 234 services →

The Essential Eight and ISO 27001 are complementary, not competing. The Essential Eight provides the technical control baseline. ISO 27001 provides the management system, governance structure, and continuous improvement framework. Organisations pursuing ISO 27001 certification will find the Essential Eight maps naturally to several Annex A controls. Similarly, APRA-regulated entities increasingly find that CPS 234 compliance is significantly easier to demonstrate when underpinned by an ISO 27001 management system.

05 / The Australian regulatory context

Assessment is no longer optional for many Australian organisations. Here is what the law requires.

The Australian regulatory landscape has tightened significantly since 2020. Organisations that treated cybersecurity assessment as discretionary now face mandatory obligations under multiple overlapping regimes.

SOCI Act
Amended 2022
The Security of Critical Infrastructure Act 2018 (as amended) applies to 22 asset classes across 11 sectors. Responsible entities must adopt and maintain a risk management programme covering cyber and information security. The Critical Infrastructure Risk Management Programme (CIRMP) rules require annual reports to boards and annual assessments against recognised frameworks.
Cyber Security Act
2024
The Cyber Security Act 2024 introduced mandatory ransomware payment reporting (72 hours), security standards for smart devices, a Cyber Incident Review Board, and a limited use obligation for information shared with the National Cyber Security Coordinator. Adds another reporting clock alongside existing obligations.
APRA CPS 234
Since 2019
Mandatory for approximately 680 APRA-regulated entities. Requires boards to take ultimate responsibility for information security, mandates control testing (at least annual, independent for critical assets), 72-hour incident notification, and 10-business-day material weakness notification. APRA tripartite assessments have found widespread gaps.
Privacy Act
Since 1988
Australian Privacy Principle 11 requires entities to take reasonable steps to protect personal information from misuse, interference, loss, and unauthorised access. The Notifiable Data Breaches scheme (since February 2018) requires notification of eligible breaches. The 2024 Privacy Act reforms are strengthening enforcement and introducing a statutory tort for serious privacy invasions.
PSPF
Updated 2024
The Protective Security Policy Framework mandates that Commonwealth Government entities achieve Essential Eight Maturity Level 2 as a minimum baseline. Compliance is reported through the annual Commonwealth Cyber Security Posture survey. ASD data shows only 22% of entities achieved ML2 across all eight strategies in 2025.

The practical implication: most Australian organisations of any significant size now operate under at least two of these regimes. A cybersecurity assessment programme that does not account for regulatory obligations is incomplete by definition.

06 / Six mistakes that waste assessment budgets

We see the same patterns across industries. These are the mistakes that turn assessment spend into wasted money.

  • × Penetration testing before foundational controls
    Running a penetration test when you have not implemented MFA, your patching is behind, and you lack basic network segmentation. The results are predictable, the findings are severe, and you have spent $30,000 or more to learn what a controls review would have told you. Fix the basics first, then test.
  • × Assessing against the wrong framework
    An APRA-regulated entity assessing only against the Essential Eight when their regulator expects CPS 234 compliance. A critical infrastructure provider running an ISO 27001 gap analysis without addressing SOCI Act CIRMP obligations. The assessment itself might be competent, but it answers the wrong question.
  • × Annual assessment as a substitute for continuous visibility
    Treating a once-a-year penetration test or vulnerability scan as your entire assurance programme. Your environment changes daily. New vulnerabilities are disclosed constantly. An annual snapshot tells you what your posture was on the day of the test. It tells you nothing about the other 364 days.
  • × Assessment without remediation authority
    Commissioning assessments that produce findings no one has the budget, authority, or mandate to fix. If the assessment report sits in a drawer, you have documented your risk without reducing it. The assessment is only as valuable as the remediation programme behind it.
  • × Confusing compliance with security
    Passing a compliance audit and concluding you are secure. Compliance demonstrates that you meet a defined set of requirements at a point in time. Security is the ongoing ability to protect your assets against real threats. Medibank was subject to CPS 234 when it suffered its breach. Optus operated under the Privacy Act. Compliance and security are related but not the same thing.
  • × Self-assessment overconfidence
    ANAO audits of Commonwealth agencies consistently show a significant gap between self-assessed and independently verified Essential Eight compliance. Across multiple audits, 60% of agencies self-assessed as compliant while only 29% were independently verified. If government agencies with dedicated programmes overestimate their maturity, your self-assessment is almost certainly doing the same.
07 / What a good assessment programme looks like

Effective assessment is not a single event. It is a structured programme aligned to risk, regulation, and maturity.

Organisations with effective assessment programmes share several characteristics. None of these are complicated, but they require deliberate design and executive commitment.

Risk-driven, not calendar-driven

Assessment scope and frequency are determined by risk, not by arbitrary annual cycles. High-risk systems and critical assets receive more frequent and more rigorous assessment. Low-risk systems receive proportionate attention. The risk assessment drives everything else.

Sequenced to maturity

Assessment types match the organisation's current maturity level. Foundational organisations focus on risk assessment and basic controls. Developing organisations add penetration testing and framework alignment. Mature organisations incorporate red teaming and continuous assurance. Skipping stages wastes money and creates false confidence.

Remediation is built into the programme

Every assessment has a defined remediation pathway before it begins. The budget for fixing findings is allocated alongside the budget for finding them. Assessment findings are tracked against risk-based timelines with clear ownership. If you cannot remediate, you accept the risk formally and document it.

Independent verification

Critical assessments are conducted or validated by independent parties. Self-assessment has a role in continuous monitoring, but independent assessment is essential for compliance, certification, and honest reporting to boards. Security governance frameworks typically require a mix of both.

Board-relevant reporting

Assessment results are translated into business-risk language for board and executive consumption. A 200-page vulnerability scan report is not a board paper. A one-page summary showing risk posture, trend over time, material gaps, and remediation progress is. A virtual CISO can help organisations that lack a dedicated security executive to bridge this gap.

The test of a good assessment programme: Can you explain your organisation's current security posture, its biggest risks, and the plan to address them in under five minutes? If you cannot, your assessment programme is producing data, not insight.

08 / How Cliffside approaches cybersecurity assessments

We start with your risk and regulatory context, not a service catalogue.

Every engagement starts with a Lighthouse Assessment, a structured conversation about your business, your threat profile, your regulatory obligations, and your current security maturity. The Lighthouse Assessment determines which assessments will deliver the most value for your situation and recommends a practical sequence.

We do not sell assessments you do not need. If your organisation needs foundational controls before a penetration test will deliver value, we will say so. If your regulatory obligations require a specific framework assessment, we will scope against that framework. If a self-assessment is appropriate for your maturity level, we will help you build one.

Cliffside delivers cybersecurity assessments including penetration testing, compliance audits, framework gap analyses, risk assessments, and security architecture reviews. We are ISO 27001 certified, CREST accredited, and have been advising Australian organisations since 2014.

If you are unsure where to start, that is exactly what the Lighthouse Assessment is for.

Not Sure Which Assessment You Need?

Start with a Lighthouse Assessment. We will review your risk profile, regulatory obligations, and current maturity, then recommend the assessments that will actually improve your security posture.

Book a Lighthouse Assessment →