Data Loss Prevention for ISO 27001 and SOC 2: What You Actually Need
What ISO 27001 and SOC 2 require for data classification and loss prevention, when you need DLP tooling, and the evidence Australian auditors ask to see.
Australian Penetration Testing and Compliance.
We specialise in CREST-accredited penetration testing and helping Australian organisations achieve ISO 27001 and ISO 42001 certification, as well as SOC 2 compliance. Delivered by our own Australian team, with fixed-price services and no offshore subcontracting.
CREST Accredited
SMB1001 Gold Level 3
Cyber Awards 2025/2026 Finalist
compliance PACKAGES
Compliance is complex. We make it simple and get you certified.
Every client we have taken to a SOC 2 or ISO 27001 audit has passed it. With a dedicated consultant guiding you at every step, we take the complexity out of certification. Fixed monthly costs over 12 months mean no surprises. Just a clear, proven path to compliance.
Our rapid-compliance packages are designed to get you audit‑ready in 3–9 months, without the need for a full-time internal resource. Most Australian businesses do not need a shelf of cybersecurity services. They need the two or three that answer the question in front of them, sized against the cyber threats their industry actually faces, and priced so the finance conversation is short.
CERTIFY
Rapid Certification
$3,750 P/M 12 Month Subscription
- Australia-based Compliance Team
- Customised Policies
- Employee ISMS Training
- Tabletop Exercise
- Risk Assessment
- Ongoing Compliance Support
- Incident Response Planning
- Disaster Recovery Planning
- Business Continuity Planning
- Internal Audit
- Host Management Committee Meeting
- External Penetration Testing
- Free Management Platform (No ongoing subscription costs)
- Add-On's available
- Discounted Penetration Testing
- Secure Cloud Review
- Additional Frameworks
- Terms
- One Framework
- Up to 50 Employees
- $1K/Month Per 50 Employees Thereafter
- Based on Siege Cyber Compliance Platform
- External Audit Not Included
- Pricing Exclusive of GST
MAINTAIN
Ongoing Maintenance
$2,450 P/M 12 Month Subscription
- Single-framework Compliance
- Australia-based Compliance Team
- Customised Policies
- Employee ISMS Training
- Risk Assessment
- Security Questionnaires
- Internal Audit
- Host Management Committee Meeting
- Annual Tabletop Exercise
- External Penetration Testing
- Free Management Platform (No ongoing subscription costs)
- Add-On's available
- Discounted Penetration Testing
- Secure Cloud Review
- Additional Frameworks
- Terms
- One Framework
- Up to 50 Employees
- $1K/Month Per 50 Employees Thereafter
- Based on Siege Cyber Compliance Platform
- External Audit Not Included
- Free Management Platform (Your tenant, your data)
- Pricing Exclusive of GST
DISP CERTIFY
DISP Certification
$3,750 P/M 12 Month Subscription
- Your Choice: DISP Entry Level | Level 1 | Level 2
- DISP Roadmap & Membership Strategy
- Australia-based Defence Compliance Team
- Four Domain Gap Analysis (Governance, Personnel, Physical, ICT & Cyber)
- ISM-Aligned Security Controls
- Customised DISP Policy & Procedure Suite
- Chief Security Officer (CSO) Advisory
- Security Officer (SO) Advisory Support
- Defence-aligned Incident Response Planning
- Annual Security Report (ASR) Preparation
- Add-On's
- Discounted Penetration Testing
- Secure Cloud Review (Microsoft 365 / Azure)
- Defence-Aligned Security Awareness Training
- Terms
- Entry Level, Level 1 or Level 2 DISP Membership
- Up to 50 Employees
- $1K/Month Per 40 Employees Thereafter
- External Audit & Defence Assessment Not Included
- Pricing Exclusive of GST
Why Australian Companies Choose Siege Cyber
| How we compare | Siege Cyber | The Other Guys |
|---|---|---|
| Time to audit ready | 3 to 9 months | 9 to 18+ months |
| Compliance team | Australian based team | Inexperienced and offshore |
| Effort required | Fully managed | Guidance provided |
| Cost | Fixed pricing, all included | Hard to forecast costs |
| Scope | Tailored to your business | One size fits all approach |
| Certification result | Every client has passed to date | Unsupported outcome |
| Support | Ongoing, you stay compliant | Ends at certification |
| What it comes down to | Dedicated team. Fixed price. With you every step of the way and beyond. | Rotating consultants, inflated scope, and costs that grow as the work progresses. |
Don't just take our word for it:
Our work speaks for itself, but our clients say it better...
Partner Network
PENETRATION TESTING PRICING
Uncover vulnerabilities before attackers do. Our fixed-price, CREST accredited penetration testing service identifies security gaps and provides clear, actionable recommendations to strengthen your defences.
Want to spread the cost and maintain ongoing protection? We can tailor a 12-month testing program to suit your requirements and budget. Every engagement covers the places attacks actually land: external and internal networks, web application security, APIs and cloud environments. You get identified vulnerabilities ranked by what they would let an attacker do to your business, not by a scanner score, plus a retest once you have fixed them.
WEB APP & API
Web Application
$5900-$16500
- Web App Penetration Testing
- Our Superpower
- Authenticated Testing
- SQL Injection Testing
- Cross-Site Scripting (XSS)
- Authentication Bypass
- API Security Testing
- OWASP Testing
EXTERNAL
External Network
$3400-$9500
- External Penetration Testing
- External IP Addresses
- External Cloud Pentesting
- External Microsoft 365 Testing
- Attack Surface Reconnaissance
- SSL/TLS Certificate Validation
- Remote Access Testing
- Open Port Verification
INTERNAL
Internal Network
$5900-$16500
- Internal Penetration Testing
- Internal Network Testing
- Active Directory Exploitation
- Privilege Escalation Attempts
- Backup System Security
- Credential Harvesting Attempts
- Endpoint Security Validation
- Insider Threat Simulation
WEBSITE
Basic Website
$3400-$6500
- Website Penetration Testing
- Unauthenticated Testing
- Default Credential Testing
- Plugin Vulnerability Scanning
- WordPress Vulnerabilities
- Brute-Force Protection Testing
- Information Disclosure
- Reputational Damage Protection
MOBILE
Mobile Application
$5900-$16500
- Mobile Penetration Testing
- Insecure Data Storage
- Reverse Engineering Resistance
- API Endpoint Testing
- Jailbreak/Root Detection
- Runtime Manipulation Testing
- Code Tampering Protection
- Insecure Authentication Testing
CUSTOM
Build Your Own
LET'S TALK
- Custom Pentesting Package
- External Pentesting
- Internal Pentesting
- Wireless Pentesting
- Cloud Pentesting
- Hardware Pentesting
- Mobile Pentesting
- Red Teaming
- Vulnerability Scanning
Our Valued Customers
We value our relationships with our customers and are committed to providing the best service to keep their businesses protected from online threats. Your trust is our top priority.
Partner with Siege Cyber
We work alongside MSPs, IT providers, auditors, and advisory firms, not against them. When your clients need penetration testing or help getting ISO 27001 or SOC 2 certified, we deliver the work, you keep the relationship.
Proven track record, not promises
We've delivered hundreds of penetration tests across Australian businesses, helping them find and fix vulnerabilities before they become incidents. On the compliance side, we've guided numerous organisations through ISO 27001 and SOC 2 certification, and every single one has passed their audit.
We don't just advise. We do the work, and we get results.
Want the full picture before we talk?
Download the Siege Cyber datasheet to see exactly what's included, how our packages work, and what to expect. And when you're ready, we're one click away.
Common questions
What does penetration testing cost in Australia?
Siege Cyber publishes fixed prices. External network testing runs from $3,400 to $9,500, web application and API testing from $5,900 to $16,500, basic website testing from $3,400 to $6,500, and mobile application testing from $5,900 to $16,500. The figure depends on scope, which is agreed in writing before the engagement starts, and the price in the proposal is the price on the invoice.
Is Siege Cyber CREST accredited?
Yes. Siege Cyber is a CREST-accredited company for penetration testing. Accreditation is assessed and held at company level, and it can be verified on the CREST Australia New Zealand approved companies register. CREST accredits companies and certifies individuals, and accreditation is granted separately by discipline, so it is worth checking the discipline as well as the logo when comparing providers.
How long does ISO 27001 or SOC 2 certification take?
Siege Cyber's CERTIFY programmes are designed to get an organisation audit ready in three to nine months, against a typical market timeline of nine to eighteen months. The programme runs as a fixed monthly cost across a twelve month subscription at $3,750 per month, with ongoing maintenance available afterwards at $2,450 per month.
Where is Siege Cyber based and do you work outside Brisbane?
Siege Cyber is based at Level 27, 32 Turbot Street, Brisbane, Queensland, and works with clients across Australia. Testing of networks, web applications, APIs and cloud environments is delivered remotely, with on-site attendance planned into the scope where the environment genuinely requires it, such as operational technology work.
Do you work with MSPs and other IT providers?
Yes. Siege Cyber works alongside managed service providers, IT providers, auditors and advisory firms rather than competing with them. Siege Cyber delivers the penetration testing or the ISO 27001 and SOC 2 certification work, and the partner keeps the client relationship.
Latest Intelligence
Vulnerability Management for ISO 27001 and SOC 2: Scanning, Patching and Evidence
What ISO 27001 and SOC 2 require for vulnerability scanning and patching, how it maps to the Essential Eight, and the evidence Australian auditors ask to see.
ISO 27001 and SOC 2 Logging and Monitoring Requirements: What Auditors Actually Ask For
What ISO 27001 and SOC 2 actually require for logging and monitoring, which controls map to what, and the evidence Australian auditors ask to see.