Every number is on this page
These are the prices, not starting points. If one of them is wrong for your business you know it now, rather than after three emails and a meeting, and the three things that change a number are listed further down.
Prices in Australian dollars. IN-SEC is not registered for GST, so no GST is added and your invoice will state that none was included.
What does an Essential Eight assessment cost in Australia?
Here, the Readiness Check is $2,950, fixed price. It is a review of your controls aligned to the ASD Essential Eight (current model), with the evidence for every finding attached. The second tier, for 80-150 staff or multi-entity, is $3,950.
The number is the same for every business that fits the scope. If yours does not fit, the call is where that gets said, before anything is signed.
| Work | Price | Basis |
|---|---|---|
| Cyber Insurance & Client Questionnaire Readiness Check An independent review of your security controls, producing evidence you can hand to an insurer, a tender panel or a customer running a vendor assessment. | $2,950 | fixed price |
| Client Questionnaire & Compliance Evidence Pack Takes a completed assessment and assembles the artefact set needed to answer one specific insurer or customer questionnaire. | $2,950 | fixed price |
| Micro-vCISO Retainer A security function for a business that needs one but cannot justify a hire. | From $1,500 | per month |
| Tabletop Incident Simulation A facilitated walk-through of a real incident, to find out who freezes, who does not know the number, and whether the backup actually restores. | $1,400 | per exercise |
| Annual re-check A yearly re-assessment for retainer clients, so the evidence stays current for the next renewal. | $2,065 | per year, retainer clients |
Three things, and none of them is how worried you sound
How many staff
More people means more accounts, more devices and more to assess. The Readiness Check has a second tier for that reason rather than one price stretched across every size of business.
How many entities
Two companies sharing an office are still two tenants, two sets of controls and two sets of evidence. That is assessed as what it is.
What you already have
This one does not move the price. A business with documented controls is faster to assess, so the report reaches you sooner, but the number is the same either way. Bring what you have to the call and it shortens the work, not the invoice.
What you are not paying for here
The remediation. We do not quote the fixes we find. That is what keeps the assessment independent, and it is why the number above does not grow once the work starts.
Penetration testing. Not offered, not implied, not included. If that is what a client or insurer is asking you for, it is a different piece of work and a different firm.
Ongoing monitoring. A one-off assessment is a photograph, not a security function. If you want someone watching it month to month, that is the Micro-vCISO Retainer.
Legal, insurance or tax advice. Never, at any price. We explain rules and link to the primary source; your adviser tells you what it means for you.
Terms, in full
- 50% on signature. Work does not start until it clears.
- 50% on delivery of the report.
- Retainers are billed monthly in advance, with 30 days notice either way.
- Invoices are due within 7 days.
Prices in Australian dollars. IN-SEC is not registered for GST, so no GST is added and your invoice will state that none was included.
Which one is this?
Find the line that sounds like your week. One of them ends with "you do not need us yet", and that one is not there for decoration.
-
01 An insurer or a broker has sent us a security questionnaire.
Readiness Check, $2,950 fixed price. An independent review of your controls against the ASD Essential Eight, with the evidence for every finding attached, so the answers you give are answers you can show.
If the questionnaire is already filled in and what you are missing is the evidence behind it, the Evidence Pack is the narrower and cheaper piece of work.
-
02 A client is running a vendor assessment on us and we are in their process.
Readiness Check first, then the Evidence Pack if their form wants the artefacts in their own format and numbering.
The order matters. There is nothing to assemble into a pack until something has been assessed, and we will not invent it.
-
03 Nobody here actually owns security, and nobody is checking month to month.
Micro-vCISO Retainer, from $1,500 per month. The same handful of things looked at every month, and a plain answer when one of them has drifted.
Capped at three retainer clients. When the three are taken, the answer is that the three are taken.
-
04 We have a plan on paper and no idea whether anyone would follow it.
Tabletop Simulation, $1,400 per exercise. A facilitated walk-through of a real incident built on your systems, your suppliers and your people, to find out who freezes and whether the backup actually restores.
-
05 Nobody has asked us for anything. We just think we should probably do something.
Then you probably do not need us yet. Every piece of work on this page is bought because someone outside the business is asking a question. Without that question there is no deadline, no audience for the evidence and no reason to spend the money this quarter.
What is worth doing now costs nothing: turn on multi-factor authentication everywhere it will go, check that your backups restore rather than just run, and read the reporting rules before you need them. If you want a second opinion on whether that is enough, the call is free and the answer is sometimes yes.
Still not sure?
That is the normal position, and it is what the call is for. Twenty minutes, and if the answer is that you do not need any of this yet, you will be told that.