The most expensive security decision you can make is the wrong one.
The Cyber Maturity Assessment rates your preparedness across six dimensions, benchmarks each against the standards and obligations that apply to you, and ranks what to fix first. Fixed scope and fee. Independent of any vendor.
- First step
- A 45-minute scoping conversation with a partner. Free.
- Format
- Fixed scope and fixed fee, agreed at scoping
- Benchmarks
- ISO 27001, NIST CSF, Essential Eight, CPS 234 and CPS 230, SOCI, Privacy Act, as they apply to you
- You get
- A six-dimension maturity profile, ranked findings, a roadmap with owners, board reporting
The Australian numbers, from the regulators
- $97,200
- average self-reported cost of a cybercrime report for a medium business in 2024–25, up 55% on the year before. For a large business, $202,700.
- Source: ASD Annual Cyber Threat Report 2024–25 (self-reported, per report)
- 1,205
- data breaches notified to the OAIC in 2025, the most since the scheme began and 8% more than 2024. 716 were attributed to malicious or criminal activity.
- Source: OAIC, Notifiable Data Breaches statistics, calendar year 2025 (media release, 6 July 2026)
- 21%
- of Australian businesses reported a cyber security incident in 2024–25. 28% reported having no measures in place to prevent one.
- Source: ABS, Characteristics of Australian Business, 2024–25 (released June 2026)
The questions the assessment answers
Where do we stand?
- You receive recommendations constantly, but no reading of how mature your security is, so you cannot set a target or defend a budget
- Progress is reported once or twice a year, by whoever is asked, with no consistent measure behind it
- You want to compare your maturity with ISO 27001, the NIST framework or the Essential Eight, and there is no baseline to compare from
Can we show it?
- The board asks whether the organisation would hold up in an incident and the answer is a list of tools
- Assessments against CPS 234, SOCI or customer requirements are slow and expensive, and the findings arrive after the budget is set
- Awareness training has run for years and behaviour has not changed
Measure, Benchmark, Prioritise
- 01
Measure
Preparedness rated across six dimensions, from interviews, documents, recent findings and a review of the controls as they run.
- 02
Benchmark
Each dimension compared with the standards and obligations that apply to you: ISO 27001, the NIST framework, the Essential Eight, CPS 234 and CPS 230, SOCI.
- 03
Prioritise
Vulnerabilities and organisational gaps ranked by the exposure they carry, with the remediation, its owner and its order.
Six dimensions of cyber maturity
Technical preparedness is one dimension of six. The others are the people who carry out security tasks, the processes behind them, how risk is governed, how the organisation keeps operating through an incident, and whether any of it can be evidenced to a regulator or a customer. All six are rated, so a strong firewall and a weak board report are both seen.
- Security governance
- How management owns and steers security
- Risk appetite, roles and reporting
- Human factors
- Culture, knowledge and practical skill
- Whether awareness changes behaviour
- Information risk management
- Protection of sensitive information
- Across the organisation and its suppliers
- Business continuity
- Incident handling and crisis management
- Damage limitation and recovery
- Technology and operations
- Controls designed into systems and platforms
- Operated to the level the risks demand
- Compliance and audit
- The framework against legal requirements
- Evidence a regulator or customer accepts
What you leave with
A maturity profile you can repeat. The first sets the baseline; the next shows whether the program is moving. Written so a director can read it and a security lead can act on it.
- Maturity profileone rating per dimension
- Initial
- Developing
- Defined
- Managed
- Optimised
- Benchmarksthe ones that apply to you
- ISO 27001
- NIST CSF
- Essential Eight
- CPS 234 and CPS 230
- SOCI
- Privacy Act
- Findingsranked by exposure
- Technical vulnerabilities
- Organisational gaps
- Quick wins
- Regulatory gaps
- Roadmapwhat to fix first
- Prioritised actions
- Named owners
- Sequence and effort
- Board reporting
How the assessment works
The method combines the international information security standards with what Kode-1 has learned on cyber strategy, risk and governance engagements for Australian organisations. We look past technical readiness to the people carrying out security tasks and the processes behind them, and present the vulnerabilities, the organisational gaps and the remedial steps together, rated on one scale. You also get a plain reading of the legal and regulatory requirements that apply to your data and what each asks of you.
Our approach
Assess
- Interview the owners of risk, security, technology and the business, and the people who do the work
- Review policies, recent findings, incidents, audit outcomes and the security budget
- Rate the six dimensions on the five-level scale, with the evidence behind each rating
- Benchmark against ISO 27001, the NIST framework, the Essential Eight and your CPS 234, CPS 230 and SOCI obligations
Report
- The maturity profile, dimension by dimension, written for the board
- Vulnerabilities and organisational gaps in one view, ranked by exposure
- A prioritised roadmap with named owners, process and people changes before purchases
- Reporting the board can use to track the program between assessments
From first conversation to roadmap
The first conversation is free. The assessment is a fixed scope and fee agreed at the end of it.
- 1
Scoping conversation
Forty-five minutes with a Kode-1 partner: the decision in front of you, your obligations, recent findings, and which dimensions worry you most.
- 2
Documents and interviews
Policies, recent audit and test results, the incident log and the security budget, then interviews with the owners of each dimension and the people doing the work.
- 3
Rate and benchmark
The six dimensions rated with evidence, benchmarked against the standards and obligations that apply to you, and the gaps ranked by exposure.
- 4
Report and roadmap
The maturity profile, the findings and the roadmap, walked through with your executive and, if you want, your board.
A cyber strategy the whole business could execute.
A globally operating, ASX-listed resources company needed structure and insight in its cyber risk management: stakeholders across the business held different views of the priorities, the roadmap ahead was unclear, and internal capability needed lifting from within rather than replacing from outside. The goal was a cyber program the organisation could align on and execute with confidence.
The results exceeded the targets set at the outset. Stakeholders now work from a shared set of priorities, internal capability has been measurably lifted, and the practices introduced during the engagement are embedded in the company's governance processes, running as part of how the business operates, not as an initiative that ended when the engagement did.
Read the engagementFind out where you stand before you buy the fix.
Forty-five minutes with a Kode-1 partner on the decision in front of you, your obligations and which dimensions to measure first. A partner replies within one business day.
Why get in touch
- Independent of any vendor
The rating and the roadmap are tested against the evidence, not a product list. Technology is recommended only where the model needs it.
- Fluent in your obligations
CPS 234 and CPS 230, SOCI and the Essential Eight are part of the method, so the findings map to what your board must attest to.
- From assessment to fix, if you want it
Kode-1 covers strategy and governance through security engineering to managed assurance. The assessment stands on its own; there is no obligation to continue.
Frequently asked questions
A test or a scan tells you what is exposed today, in the technology. The Cyber Maturity Assessment rates six dimensions, of which technology is one, and explains why the exposure exists: governance, people, process, continuity and compliance alongside the controls. Where a technical test is warranted the report says so.
No. A certification audit asks whether a control exists on paper. The assessment asks how prepared the organisation is across six dimensions, how that compares with what is expected of you, and what to change first.
ISO 27001, the NIST Cybersecurity Framework and the ACSC Essential Eight, plus the obligations that apply to you: APRA CPS 234 and CPS 230 for regulated entities, the SOCI Act for critical infrastructure, and the Privacy Act. You are not graded against a standard you are not bound by.
The person who owns the decision and whoever owns cyber risk if that is someone else: a CEO or owner, a CIO or CISO, or the technology leader accountable for the result. One or two people.
The scoping conversation is free. The assessment is a fixed fee, agreed at the end of that conversation and sized to the scope you choose.
Yes, where you want us to. Kode-1 covers strategy and governance, security engineering, detection and response and managed assurance, delivered by Kode-1 or a specialist partner where that is the better fit. The assessment stands on its own; there is no obligation to continue.
The advice is vendor-neutral. Where we partner with a platform for delivery it is published on this site, and it never decides a recommendation.