IT audit Melbourne: your IT and cyber security, checked against ASD guidance
IT audit in Melbourne: see exactly what Key IT checks, from Microsoft 365 settings to backup restores, rated against ASD's Essential Eight. Free to start.
An IT audit checks every part of your business technology, from laptops and Microsoft 365 settings to backups, the firewall and the office printer, and tells you what is unsafe, unsupported or wasting money. Key IT's IT audit for Melbourne businesses is our free IT & Cyber Security Review: security-certified engineers check the live settings, rate findings against ASD's Essential Eight and rank what to fix first.
What is an IT audit, and how is it different from a cyber security audit?
An IT audit covers the whole environment, from hardware and licences to backups and access, and asks whether it is safe, supported and worth the money. A cyber security audit is narrower: it tests the controls that stop or catch an attack, such as multi-factor authentication (MFA), patching and admin rights, usually against the Essential Eight.
In a small business the two overlap almost completely. A leaver's account that still works is a security hole and an admin problem, so we do both in one pass and give you one list.
What does Key IT check?
Eight areas, checked on live systems wherever possible, not by asking.
Devices and patching
Operating system versions, whether updates actually install, encryption and security software on every PC and server. We flag PCs still on Windows 10, which reached end of support on 14 October 2025 (after which business PCs get security fixes only through Microsoft's paid Extended Security Updates), and servers on Windows Server 2016, which leaves extended support in January 2027.
Microsoft 365 tenant settings
MFA for every person who signs in, admins included.
Legacy authentication, which can't do MFA. Microsoft's analysis found more than 99% of password spray attacks use legacy protocols, and security defaults can block them even without Conditional Access licences.
External forwarding rules that send mail outside the business, whether set up by staff or by an attacker. Some older tenants still allow it by default, so Microsoft advises setting it explicitly.
Conditional Access
what each policy enforces, who is excluded, and which were left in report-only mode.
Device code flow, which Microsoft calls high-risk and recommends blocking wherever possible; attackers abuse it in device code phishing.
Admin rights
Who holds admin rights in Microsoft 365, on PCs and on servers; whether admins use a separate account for admin work; and whether anyone who has left can still log in. A free dark web scan shows staff emails exposed in known breaches.
Backups
What is backed up, whether one copy is out of an attacker's reach, and when a restore was last tested. A green tick in the backup console is a job log, not proof: ASD's assessment guide wants restores tested in disaster recovery exercises, and says recovering a user's deleted file day to day doesn't count. No test restore on record means we report the backup as unproven.
Firewall and external exposure
Firmware version, MFA on remote access, whether the admin page faces the internet, and which services anyone online can see. Our Akira ransomware write-up shows why firewall VPNs get the closest look.
Printers, CCTV and other connected devices
Default passwords, old firmware, camera recorders reachable from outside, and scan-to-email still signing in the old way: the devices nobody remembers owning.
Licensing waste
Licences assigned to leavers, paid seats nobody uses, and plans that cost more than the work needs or lack security features you assumed you had. We handle Microsoft licensing and procurement, so we can fix what we find.
Domain and email authentication
SPF, DKIM and DMARC records on every domain you own, including ones you never send from, plus who controls the registrar login and when each domain renews.
How are findings rated?
Essential Eight controls are rated using the Australian Signals Directorate's Essential Eight assessment process guide, which asks whether each control is in place and actually effective. Each control is recorded as effective, alternate control, ineffective, no visibility, not implemented, not applicable or not assessed. One ineffective control stops the whole strategy reaching that maturity level, and anything below Level One is Maturity Level Zero.
ASD also grades evidence, from testing a control (strongest) down to a policy document or verbal assurance (weakest). We aim for testing or live configuration and say when a finding rests on less.
Everything else (licensing, domain records, printers) is rated high, medium or low by likelihood and business impact, with a named owner for each fix.
A note on ASD Essentials. In October 2026 ASD launched ASD Essentials, the successor to the Essential Eight, and will maintain both frameworks during the transition. ASD's Essentials FAQ says it swaps maturity levels for priority phases, rates each action not, partially or fully effective, and doesn't convert old maturity levels automatically. It is aimed at Commonwealth entities, critical infrastructure and large organisations, though smaller businesses can use it where relevant. ASD advises starting with a recorded baseline of your current posture, which an audit report gives you.
What does the report look like?
A single findings page ranked by risk, then the evidence behind each line. This sample is for a fictional 20-person office, to show the format; it is not a real client.
| Area | What we found | Rating | Recommended fix |
|---|---|---|---|
| Admin rights | Global admin on everyday accounts used for email, including a former employee's that still works | Restrict administrative privileges: ineffective | Disable the leaver's account; give admins separate admin-only accounts |
| Inbox rule forwarding the accounts mailbox to a personal Gmail address | High | Investigate as a possible compromise; block external forwarding | |
| Backups | Nightly job succeeds, no test restore on record | Regular backups: ineffective | Run and document a test restore |
| Devices | 3 of 22 PCs on Windows 10 without Extended Security Updates | Patch operating systems: ineffective | Upgrade or replace |
| Licensing | 4 paid licences assigned to nobody | Low | Remove at renewal |
The report also has an Essential Eight summary, what already works and a suggested order of work. The findings are yours: fix them in-house, give them to your current provider or ask us. For a costed plan, see our IT strategy and consulting service.
Free check, health check or full audit: which do you need?
The quick options tell you whether to worry; the audit tells you what is wrong.
| Option | Who does it | Effort | What you get | Cost |
|---|---|---|---|---|
| The Australian Government's Cyber Health Check tool | You, online and anonymously | Under 5 minutes | A basic self-assessment | Free |
| Key IT's cybersecurity health check | A Key IT engineer, talking it through with you | About 30 minutes | Essential Eight snapshot and top three risks | Free |
| Key IT's full IT audit (the IT & Cyber Security Review) | Key IT engineers, on your actual systems | Depends on users, devices and sites | All eight areas, rated, with a report and walk-through | Free review; larger scopes quoted in writing first |
| Vulnerability scanning | Automated scans, triaged by Key IT's 24/7 SOC service | Monthly, ongoing | Prioritised remediation reports | From $149 per month |
| Penetration testing | A specialist tester, with your written permission | Scoped per test | Proof of what an attacker could reach | Quoted per scope |
For a quick Essential Eight read, try the free Essential 8 self-assessment. For evidenced maturity to show an insurer, tender panel or client, our Essential Eight compliance service starts with this audit.
How long does an IT audit take and what does it cost?
Time depends on your people, devices and sites, so we agree the timeline with you at the start. The review itself is free, with no obligation; multi-site work or a formal evidence pack is quoted in writing first. The steps:
Scoping call to list users, sites, systems and deadlines such as an insurance renewal.
Access to Microsoft 365, devices and the firewall, approved by you and removable once we finish.
Checks onsite in Melbourne where equipment needs a look, or remotely for regional Victoria.
Findings meeting to walk through the report in plain English.
Frequently asked questions
How much does an IT audit cost in Melbourne?
Key IT's IT audit starts as the free IT & Cyber Security Review, with no obligation to become a client. For multi-site businesses, or anyone needing a formal evidence pack for an insurer or tender, the extra work is scoped on a short call and quoted in writing first.
Will an IT audit disrupt my staff?
Barely. Most checks read settings in Microsoft 365, device management tools and the firewall, which staff never see. If a test restore is needed, it goes to a separate location, so live files are untouched. The visible part is an engineer looking at printers, cameras and network gear.
Can you audit us if we already have an IT provider?
Yes. The report belongs to you and is written so any competent provider can act on it. Use it as a second opinion before a contract renewal, or hand it to your current provider as a to-do list. You, as the owner, grant the access we need.
Is an IT audit the same as a penetration test?
No. An audit reviews how systems are set up and whether controls work, including licensing and unsupported hardware. A penetration test is a specialist trying to break in, with your written permission, to prove what an attacker could reach. Audit first, then test once the obvious gaps are closed.
Does the audit prove Essential Eight compliance to an insurer?
It shows where you honestly stand, with each control rated the way ASD's assessment guide sets out, so you can answer an insurance questionnaire truthfully. If an insurer or client wants evidenced proof of a maturity level, the audit is the first step of an Essential Eight program that gathers and maintains that evidence.
Do you audit businesses outside Melbourne?
Yes. Microsoft 365, device and firewall settings, domain records and licensing can all be checked remotely, so businesses in regional Victoria get the same audit. For Melbourne businesses an engineer can also come onsite from our Greensborough office to check printers, cameras and network gear.
150+ Melbourne organisations, looked after every day
From manufacturing and healthcare to finance, body corporate and professional services — a few of the businesses whose IT and security we run every day.
Book your free IT & Cyber Security Review
See exactly where your IT and security stand, and what to fix first. No jargon, no obligation.