For Gold Coast & Brisbane businesses · Limited sessions each month
How exposed is your business? See for yourself with a free Essential 8 Gap Analysis.
“Secure” is only meaningful against a standard. In 60 minutes, our team scores your business against the ASD Essential 8 and hands you a plain English scorecard showing where you're protected, where you're exposed, and what to fix first.
ISO 27001 Certified · Supporting QLD businesses since 1999 · Essential Eight specialists
Your Essential 8 Scorecard
Example scorecard. Yours is built from your actual systems in a free 60 minute session, with your top three gaps and a prioritised roadmap.
The problem
“Our IT provider says we're secure”
It's the answer we hear most, and it's usually said with confidence. But secure against what, exactly, and measured against which standard? Good IT support keeps you running day to day. It is not the same as a measured, evidenced position against the Essential 8. That gap is where most businesses get caught out:
You have no proof
Your IT is looked after, but nobody can show you where you actually stand against the Essential 8, or what evidence you'd hand an auditor, insurer or client who asks.
Insurers check before they pay
Renewals ask harder questions every year about MFA, patching, backups and admin access. If your policy says you do these and a claim proves otherwise, cover can be refused when you need it most.
Clients are asking
Government and larger buyers ask suppliers for evidence of their security baseline, today usually the Essential 8 and increasingly ASD's new Essentials. “We think we're fine” doesn't win tenders. A documented baseline does.
The uncomfortable truth: you can't manage a risk you've never measured. The Gap Analysis turns “we think we're secure” into a maturity level you can show your board, your insurer and your clients.
Why now
Why 2026 is the year to get measured
ASD has published its new Essentials series
In October 2026 the Australian Signals Directorate released its ASD Essentials series, which it says will replace the Essential Eight, written mainly for government, critical infrastructure and large organisations. ASD hasn't set a transition date, and it has confirmed that Essential Eight work carries forward. For most small and medium businesses the Essential 8 is still the practical baseline, so a documented maturity level now means you're ready for insurers and clients today, and for the new framework when it reaches you.
Reporting is now law
Ransomware payment reporting is mandatory for many businesses under the Cyber Security Act, and privacy penalties have never been higher. Directors are now expected to know their cyber posture, not assume it.
Small business is the target
Attackers automate their way to whoever is easiest, and mid-sized Australian businesses are firmly in range. Waiting until after an incident to find your gaps is the most expensive way to learn them.
The offer
What your free Gap Analysis includes
Your Essential 8 Scorecard
A one page rating of your business against all eight controls, using ASD's Essential Eight maturity levels (0 to 3). No jargon: red, amber, green.
Your top three gaps, explained
What they are, what could actually go wrong, and how urgent each one is, in language you can take to your board, partners or insurer.
A prioritised remediation roadmap
The order to fix things for maximum risk reduction per dollar, with indicative costs. Yours to keep whether or not you work with us.
60 minutes with a certified team
Run by CSG's ISO 27001 certified security team, the same team trusted by Queensland healthcare, legal, accounting and construction firms.
How it works
Three steps. Zero disruption.
Book a time
Pick a 60 minute slot that suits you, remote or at your premises. Bring whoever looks after your IT.
We measure
We walk through the eight controls with you. No interruption to your systems, no software to install for the initial analysis.
You get the roadmap
Within 48 hours you receive your scorecard and prioritised action plan. What you do with it is entirely up to you.
Who it's for
Built for businesses that can't afford to guess
We work with the industries where a breach costs more than money: medical and allied health practices, aged care providers, law and accounting firms, construction, engineering and architecture firms, and professional services across South East Queensland. If you hold client data, patient records, or payment details, this is for you.
Why CSG
Trusted since 1999
- ISO 27001 certified: we hold ourselves to an independently audited security standard, with a certified Lead Implementer on staff.
- Service delivery built on ASD's Essential Eight.
- Local, plain-speaking team in Nerang. Straight answers, not tech speak.
Not ready to book?
Score yourself in 5 minutes.
Download the free Essential 8 Self-Assessment: 24 plain English questions that show you where your business stands, instantly. No technical background needed.
Get the free self-assessment
FAQ
Fair questions, straight answers
Is it really free?+
Yes. The Gap Analysis and roadmap are free, no strings. We offer it because some businesses ask us to fix what we find. That's our business model, and we're upfront about it. There is zero obligation, and the roadmap is yours either way.
Will you need access to our systems?+
No. The initial analysis is a guided conversation. We don't need to touch your systems. If deeper technical verification is useful, we'll recommend it in the roadmap and you can decide.
We already have an IT provider. Is this still relevant?+
Yes, and it isn't a criticism of them. Everyday IT support and security assurance are different disciplines. Many clients share the scorecard with their existing provider as a checklist.
What is the Essential 8?+
Eight baseline security controls defined by the Australian Signals Directorate, covering patching, multi-factor authentication, backups, admin access, application control and more. It's been ASD's baseline for years and remains the yardstick most insurers and supply chain questionnaires use. ASD's new Essentials series builds on it.
Isn't the Essential 8 being replaced?+
Over time, yes. ASD published its new Essentials series on 15 October 2026, written mainly for government, critical infrastructure and large organisations. ASD hasn't set a transition timeline and will advise on expectations in due course. It has also said work already done under the Essential Eight "will directly support alignment" with the new series. For most small and medium businesses the Essential 8 remains the practical baseline, so knowing your maturity now is time well spent.
How long until we get results?+
The session takes 60 minutes. Your scorecard and roadmap arrive within 48 hours.
Find out where you stand before someone else does.
Free 60 minute Essential 8 Gap Analysis. Limited sessions available each month.