Cybersecurity for care, disability and health providers.

Know exactly where you stand.

Review systems, accounts, devices and backups against the Essential Eight. Find the gaps that matter first.

• Assessment against the eight Essential Eight strategies, with maturity observations
• User, administrator and multi-factor authentication review
• Patching, backup and recovery checks, including restore evidence where in scope
• Walkthrough of findings with your team

You receive: a written assessment report and prioritised remediation roadmap.

Find it before somebody else does.

Authorised testing. Verified findings. Evidence your team can act on.

• External or internal network vulnerability assessment as scoped
• Web application testing against the OWASP Top Ten where applicable
• Manual verification of findings
• Severity, evidence and reproducible remediation guidance
• One retest after agreed fixes

You receive: technical findings, an executive summary and retest confirmation.

Harden the front door.

Harden websites, bookings and portals that collect client or payment data.

• TLS and security header configuration
• Platform, theme and plugin patching where applicable
• Administrator account cleanup
• Web application firewall configuration where supported
• Backup configuration and restore testing where in scope

You receive: a hardened site and a written record of changes.

Fix the settings nobody revisited after setup.

Review Microsoft 365 and cloud settings. Fix the priority gaps with your team.

• Administrator, dormant user and guest access review
• Multi-factor authentication and legacy sign-in review
• Access rules aligned to staff roles and operating needs
• Logging and backup checks

You receive: a review report, agreed changes and before and after evidence.

Make it harder to impersonate your organisation.

Reduce spoofing and payment redirection risk. Give finance a simple verification process.

• SPF, DKIM and DMARC review and configuration
• Audit of approved services sending email from your domain
• Mailbox forwarding and suspicious rule review where access permits
• Payment verification process for finance teams

You receive: configured email authentication, an audit summary and a one page finance process.

Train the people attackers target.

Short training. Realistic phishing simulations. Clear trend reporting.

• Training on phishing, invoice fraud and password practice
• Simulated phishing campaigns on an agreed schedule
• Team level trend reporting
• Simple internal reporting and escalation process

You receive: training, campaign results and a trend report suitable for management or insurer evidence.

Turn logs into something somebody acts on.

Connect the right systems. Tune the alerts. Agree who acts when something matters.

• Monitoring deployment for agreed systems
• Alert tuning to reduce noise
• Monthly activity and findings report
• Written escalation plan

You receive: a working monitoring setup, escalation runbook and monthly report. Monitoring is reviewed during Australian business hours, not 24/7.

Build the evidence insurers, tenders and customers ask for.

We prepare practical security documentation and help map gaps against an agreed framework. LYD AssistOS does not issue certifications.

• Information security, acceptable use and password policies
• Incident response plan with roles and contact paths
• Gap analysis against SMB1001 or ISO 27001 as scoped
• Support with insurer and customer security questionnaires

You receive: a policy pack, incident response plan and gap analysis.

Put security and human control into the AI design.

AI can move sensitive data fast. Set approved data, access, logging and human approval before launch.

• Data minimisation and approved data sources
• Identity, access and permission controls
• Logging and audit trail requirements
• Human approval and escalation points
• Privacy policy and automated decision transparency considerations where relevant

You receive: documented security controls aligned to the AI workflow and implementation scope.