Southern ShieldCyber

01 · Small & medium business

Security support sized to the team you have.

The organisation holds customer data, and a small number of people cover technology, suppliers, and incident response. The engagement must be specific enough to approve in a single meeting.

Typical conditions

  • 01

    Limited internal capacity. One or two people cover technology. A provider performs the operational work. Security has to fit that arrangement.

  • 02

    Systems the business depends on. Customer data, payments, identity, and email. If they fail, operations stop.

  • 03

    An external assurance request. An insurer, a customer, or a board asks for evidence that currently exists only as a spreadsheet.

How the engagement is structured

  • 01

    A defined scope, so a founder or general manager can approve it

  • 02

    Findings written for the provider as well as for the organisation

  • 03

    A short list of what to fund this quarter

  • 04

    Governance that fits a monthly meeting

Relevant services

01Penetration testingAuthorised testing of the applications, networks, and identities in operational use: the public portal, staff remote access, the API behind a form, and privileges that should not extend. Findings are ranked by what an attacker can reach, then written so an engineer and an executive can both act.TestingLearn more02AWS configuration reviewAccounts, identity, logging, network boundaries, and data guardrails, assessed against the settings around the workloads in production. The review separates a guardrail that can be closed promptly from a design change that requires a project.TestingLearn more06ComplianceEssential Eight, the Information Security Manual, the Privacy Act, SOCI, and the sector duties that already apply, mapped to evidence you hold. Gaps are ranked by obligation and effort, in language an auditor or a board can read.AdvisoryLearn more03Incident response readinessPlans, roles, and a facilitated exercise that shows whether an incident can be contained: ransomware during business hours, a misused mailbox, exposed personal information, or failure of a public portal. The engagement concludes with an after-action record that names owners and dates.TestingLearn more05AdvisorySenior advice on architecture, procurement and the next four quarters, with no product attached. We help founders, general managers and executives reach a decision they can explain to their board.AdvisoryLearn more

Contact

Talk to us about small & medium business.

Book a call about your organisation and the system you need to protect. We will come back with a scope, or with a question that makes the scope clearer.

Book a call