Cybersecurity Posture Assessment of 450+ Firms
How BCyber undertook cybersecurity assessment attestations across 450+ Australian financial services firms to evaluate security posture and establish an initial foundation process for ongoing improvement.
The Challenge
An industry association responsible for overseeing 450+ authorised representative firms needed to understand the collective cybersecurity posture across their network. With increasing regulatory scrutiny and the need to demonstrate due diligence, they required a scalable assessment program.
The firms varied significantly in size, from sole practitioners to larger advice businesses. Each firm had different technology setups, varying levels of security awareness, and inconsistent documentation. The association needed to establish a baseline understanding and create a foundation for ongoing improvement.
Program Objectives
- Assess cybersecurity posture across all 450+ firms
- Establish a consistent baseline for comparison
- Identify common gaps and industry-wide risks
- Create a foundation process for ongoing attestation
- Provide individual firms with actionable improvement plans
BCyber's Approach
We developed a scalable assessment methodology using the GRACE framework, enabling consistent evaluation across firms of varying sizes and complexity.
- • Designed 87-point assessment criteria aligned with APRA standards
- • Created 5-level maturity model (Initial → Optimised)
- • Built self-assessment questionnaire for initial data collection
- • Developed scoring methodology and benchmarking approach
- • Self-assessment completion by each firm
- • Verification calls to validate responses
- • Evidence collection for key controls
- • Individual maturity scoring and gap analysis
- • Aggregated industry-wide analysis
- • Individual firm reports with improvement recommendations
- • Benchmarking against industry averages
- • Priority risk identification across the network
- • Annual reassessment framework
- • Continuous improvement tracking
- • Resource library for common remediation activities
- • Escalation pathways for high-risk findings
Industry-Wide Findings
Most Common Issues
- • Lack of formal incident response plans
- • Inconsistent backup verification
- • Limited security awareness training
- • Outdated access management practices
Maturity Distribution
- • Level 1 (Initial): 23% of firms
- • Level 2 (Developing): 41% of firms
- • Level 3 (Defined): 28% of firms
- • Level 4-5 (Managed/Optimised): 8% of firms
- • Strong adoption of cloud-based security tools
- • Good endpoint protection across most firms
- • High awareness of phishing risks
- • Willingness to invest in security improvements
Program Outcomes
For the Association
- Complete visibility of network security posture
- Regulatory evidence of due diligence
- Annual attestation process established
- Industry benchmarks for performance tracking
For Individual Firms
- Clear understanding of their security gaps
- Prioritised roadmap for improvements
- Benchmarking against peers
- Access to resources for remediation support
“BCyber's program gave us the visibility we needed across our entire network. We now have a foundation for continuous improvement and can demonstrate to regulators that we take cybersecurity seriously. The individual firm reports have been invaluable for driving change.”