Independent cyber risk and security maturity assessment for New Zealand and Australian business. We map your assets and the threats acting on them, score your maturity against the standard you will be judged by, and hand you a plan ordered by what actually reduces risk.
Book an assessment conversation →Plenty of assessments produce a long list of findings and no way to act on them. Two hundred items, every one marked important, and no sense of which three matter most or what they will cost to fix. Others are vendor scans dressed up as assurance, where the findings map neatly onto the product the assessor happens to sell.
A useful assessment answers three questions. What are we protecting. What is realistically coming for it. And where do we stand against the standard we will be judged by.
A risk and maturity assessment looks at your business from two directions at once. Risk works outward from your assets: what you hold, what it is worth, and the threats acting on it. Maturity works inward from a recognised framework: how capably you manage those threats today, scored so you can see movement year on year.
Both matter. Risk alone tells you what to worry about but not how good you are. Maturity alone tells you how you score but not what is actually at stake.
We establish what matters most: the systems, data and services the business genuinely cannot operate without.
Threats act upon assets. We map the ones realistically facing your business and your sector, rather than a generic list.
Evidence-based scoring against the framework that fits, across cloud and on-premise.
A roadmap ordered by risk reduction, with effort, owners and dependencies made clear.
Your obligations under the NZ Privacy Act 2020 sit alongside these rather than as a framework, and we assess against them wherever personal information is in scope.
An assessment is worth what the assessor has to gain from its findings. Mosaic sells no tooling and takes no product commissions, so nothing in the report is there to set up a sale. You get a prioritised view of your own risk, and a document you can hand to a client, an insurer or a board without it reading like a sales proposal.
A risk assessment identifies what could go wrong, how likely it is, and what it would cost you. A maturity assessment scores how capably you manage those risks against a recognised framework. We run them together, because each one is incomplete without the other.
It depends on who judges you. Essential Eight for fast, measurable progress. NIST CSF 2.0 where the audience is your board. ISO 27001 where a client has asked for certification. NZISM where you supply government. SMB1001 where you are small and need something achievable. We recommend one in the first conversation rather than selling you all of them.
Most are measured in weeks rather than months. Scope drives it: the number of systems in play, how much documentation already exists, and how many people we need to speak to.
Usually not. The work is evidence based: documentation, configuration exports your provider supplies, and interviews with the people who run things. Where we do need to see a system directly, we agree that access in advance and in writing.
An assessment report with findings, risk ratings and a prioritised roadmap, plus a short executive summary you can take to a board or a client. Findings always say what to do next, not just what is wrong.
We advise, govern and verify. We do not operate tooling or administer systems, so remediation is delivered by your IT provider or your internal team, with us setting the standard and checking the result.
Annually for most businesses, or whenever something material changes: a new platform, an acquisition, a significant new data set, or a serious incident. Re-scoring against the same framework is what makes progress visible.
Essential Eight scores each of its eight strategies from maturity level zero through to level three. Most smaller businesses are better off reaching level one across all eight before pushing any single strategy higher, because an even baseline removes more risk than one excellent control sitting beside seven weak ones.
A no-obligation conversation about what you hold, what you are judged against, and what an assessment would cover for a business your size.
Book an assessment conversation →