How do you protect us from ransomware?

In layers: phishing-resistant sign-in and patching to keep attackers out, endpoint detection and continuous monitoring to catch them early, application control and least privilege to limit the spread, and immutable, tested backups so you can recover without paying.

What is a security control assessment?

An independent check that each security control in scope is designed properly and operating as intended, tested against evidence. You get an assessment report and a plan of action with owners and dates.

Practice 03 · Cyber resilience

Cyber resilience

Some attacks will get through. Resilience is how fast you see them, how little they reach and how quickly you are back. We build all three.

Talk to us about cyber resilience Services in this practice

Cyber resilience

Why it matters

Ransomware is still the attack that stops businesses, and it rarely arrives at a convenient time. Resilience is not one product: it is detection that never switches off, email and devices locked down, backups that restore, and a team that has practised the bad day.

Our resilience practice puts the pieces together: the ASD’s baseline controls, ISO/IEC 27001 and independent control assessments that prove they work, staff who spot the fake invoice, a virtual CISO to lead it all and incident responders ready to take charge, with our Security Operations Center watching around the clock.

Cyber resilience

What we do

Incident response

Responders who take charge: contain, recover, investigate and handle the reporting.

See the service

Ransomware protection

Early detection, application control and immutable, tested backups, so ransomware is stopped early or recovered from fast.

See the service

ASD Essentials and Essential Eight

The ASD’s baseline controls assessed and put in place, with the evidence clients and insurers ask for.

See the service

ISO/IEC 27001 and compliance

Scope, risk assessment, Statement of Applicability and controls, ready for certification and kept there.

See the service

Security control assessment

Independent, evidence-based testing of whether your controls are designed well and work in practice.

See the service

Virtual CISO

A senior security leader, part-time, with cyber risk explained to the board in dollars.

See the service

Security awareness training

Five-minute lessons and realistic phishing tests that make staff a strong last line of defence.

See the service

Cyber resilience

What you get

An example of what lands on your desk. The client details are invented.

Each control rated effective, partly effective or not effective, with the evidence.

Security control assessment: summaryExample

27

effective

8

partly effective

3

not effective

Control	Rating	Evidence
Multi-factor authentication	Effective	Policy, configuration, sign-in logs
Patching of internet-facing systems	Partly effective	3 of 41 systems past 14 days
Privileged access	Not effective	Shared admin account in use
Event logging and monitoring	Effective	Alert rules, 12 months of logs
Backup and restoration	Partly effective	Restore never tested

38 controls assessed. Illustrative example.

Cyber resilience

Platforms and standards

The platforms we design, deploy and run, and the standards and laws we measure against.

ASD EssentialsThe Essential Eight’s successor
Essential EightASD maturity model
ISO/IEC 27001Information security management
NIST CSF 2.0Cybersecurity Framework
ASD ISMInformation Security Manual
Microsoft 365Email, files and Copilot

Cyber resilience

Services in this practice

Incident response

If you are under attack, call now. We take charge: contain the attack, get you running again and handle the reporting.

See the service

ASD Essentials and Essential Eight

On 15 October 2026 the ASD published ASD Essentials, the successor to the Essential Eight. We show you where you stand and fix the gaps in order.

See the service

Compliance and ISO 27001

Win the contract, satisfy the auditor and answer the questionnaire. We get you compliant, keep you there and collect the proof as we go.

See the service

Security control assessment

A policy says a control exists. We check that it does, and that it works, with evidence your auditor, regulator or client will accept.

See the service

Virtual CISO and board advisory

A senior security leader for your business, part-time. Strategy, budget and board reporting, with cyber risk explained in dollars.

See the service

Security awareness training

Your staff are the last line of defence against a fake invoice. Short, regular training and realistic phishing tests make them a strong one.

See the service

Cyber resilience

Questions

Security tries to stop attacks. Resilience assumes some will succeed and makes sure you detect them early, limit the damage and recover quickly. You need both, and most controls serve both.

Free · No obligation

Book a free refinement

A 30-minute call with a senior consultant about cyber resilience, then a written summary of your top risks. No cost and no obligation.

Prefer to talk? Call 0422555187 · Use the full form

Cyber resilience

Why it matters

What we do

Incident response

Ransomware protection

ASD Essentials and Essential Eight

ISO/IEC 27001 and compliance

Security control assessment

Virtual CISO

Security awareness training

What you get

Platforms and standards

Services in this practice

Incident response

ASD Essentials and Essential Eight

Compliance and ISO 27001

Security control assessment

Virtual CISO and board advisory

Security awareness training

Questions

What is the difference between cyber security and cyber resilience?

How do you protect us from ransomware?

What is a security control assessment?

Book a free refinement

Cyber resilience

Why it matters

What we do

Incident response

Ransomware protection

ASD Essentials and Essential Eight

ISO/IEC 27001 and compliance

Security control assessment

Virtual CISO

Security awareness training

What you get

Platforms and standards

Services in this practice

Incident response

ASD Essentials and Essential Eight

Compliance and ISO 27001

Security control assessment

Virtual CISO and board advisory

Security awareness training

Questions

What is the difference between cyber security and cyber resilience?

How do you protect us from ransomware?

What is a security control assessment?

Book a free refinement