Melbourne · Business services
Implementation, internal audits and certification support.
Aegentra helps Melbourne businesses build an information security management system that works in daily operations and can be assessed independently. Whether a customer has asked for certification, your implementation has stalled or an internal audit is due, we help you define the work, assign responsibilities and organise the evidence.
Teams in Melbourne and Sydney. Delivered across all Australian states and territories, remotely or onsite by arrangement. New Zealand and Asia Pacific by arrangement.
03 9956 9399Google rating: 5.0/5 from 16 reviews
Business-wide feedback covering Aegentra consulting and Academy training. Checked 4 November 2026.
Read Aegentra’s Google reviews
Start with the work your organisation needs—not a package that assumes you are starting from scratch. We review your existing documentation, systems, evidence and deadline before confirming the scope and fee.
Starts fromA$12,000–15,000 + GST.
For suitably scoped companies with fewer than 10 people. We help establish the ISMS scope, risk assessment, Statement of Applicability, working procedures and agreed controls, then prepare the organisation for independent assessment. Your proposal defines consultation and support through the certification process; internal audit is separately scoped unless included.
Explore the implementation deliverablesStarts fromA$2,300 + GST.
For a smaller organisation with one clear ISMS scope and straightforward evidence access. A separately scoped audit evaluates your management system against the agreed criteria through interviews, document review and risk-based evidence sampling. You receive traceable findings and an audit report; corrective-action follow-up is defined in the scope.
See internal-audit scope and reportingStarts fromA$15,000–18,000 + GST.
For suitably scoped companies with fewer than 10 people that need a coordinated programme. Your package includes an implementation consultant, a different internal auditor and a third consultant managing the project, with assistance arranging the certification body and preparing for its Stage 1 and Stage 2 assessments. Auditor assignment is subject to documented impartiality checks.
These are starting budgets, not fixed quotes for every organisation. Your fee depends on scope, locations, existing controls, evidence, technical remediation and client participation. Certification-body fees are separate. The proposal identifies applicable travel, licences, additional technical work and other exclusions before you commit.
Discuss the right scope for my businessMelbourne delivery
A Melbourne office does not necessarily mean a Melbourne-only information system. Your employees may work from home, your IT provider may operate elsewhere and your customer information may pass through cloud applications and suppliers. We help define an ISMS boundary that reflects those connections.
Discovery, document reviews and delivery meetings can run remotely. Where the scope requires onsite work, we agree the location, purpose, consultant availability and any travel costs in advance. Being local does not mean every task needs a site visit; the delivery method should fit the work and the evidence needed.
We work with your nominated business sponsor, control owners and existing IT provider. Your team approves the scope and risk decisions, provides access and evidence, and operates the agreed arrangements. Aegentra coordinates its assigned work without assuming responsibilities already held by your employees or service providers.
Client feedback
Medical clinic · ISO 27001
“We certified our medical clinic for ISO 27001 through Aegentra, and the entire process was smooth and well managed.”
Google review excerpt, reproduced with permission.
Practical work
ISO 27001 implementation is more than producing documents. A useful ISMS connects each important risk to a decision, an accountable owner, an implemented control and evidence that can be reviewed.
For example, consider an employee leaving a hybrid team. A policy may require access to be removed, but the evidence needs to show what happened across business applications, devices and third-party systems. A record of approval, account changes, returned equipment and unresolved exceptions gives the process owner something meaningful to check.
This is an illustrative example of the work—not a claim about a client result.
For Microsoft 365 environments, identity, email, device or information-protection work can be included where agreed. We identify what Aegentra will configure, what stays with your IT provider and what requires additional licensing. A tenant snapshot or compliance platform is supporting evidence, not proof that the whole organisation conforms to ISO 27001.
Explore Microsoft 365 security upliftFast-track
For an appropriately scoped business with fewer than 10 people, the fast-track option targets implementation and internal-audit completion in 5–7 weeks. This depends on timely decisions, evidence availability and no major remediation blockers. Certification-body availability and findings can extend the time before a certificate is issued.
The implementation consultant builds the agreed system. A different competent auditor assesses it without auditing their own work. The project manager coordinates milestones and certification arrangements without directing audit judgements.
Documented conflict-of-interest and impartiality checks determine whether the audit can be delivered by a separate Aegentra consultant. If objectivity cannot be protected, a separate provider is required. The independent accredited certification body conducts Stage 1 and Stage 2 and decides whether to issue the certificate.
Delivery team
Harry Sidhu, Aegentra’s Director and Principal Consultant, is accountable for engagement scoping and delivery oversight. Your proposal identifies the assigned consultants, their responsibilities and the experience relevant to your work.
Aegentra’s delivery team brings experience in IT audit, cybersecurity governance, risk and internal controls. We match the assigned roles to your scope and confirm relevant competence evidence before work begins.
Qualifications, professional credentials and formal training held across Aegentra’s delivery team.
Further training and audit qualifications across the team include ISO/IEC 42001 Lead Implementer training, ASD ISM General and Technical audit codes, ISO/IEC 27017 and ISO/IEC 27018 audit codes, and ISO 9001 and ISO 19011 audit qualifications.
Credentials are held across the delivery team and matched to assigned roles. The proposal identifies the consultants, responsibilities and relevant qualification evidence before work begins.
Published audit evidence
In a published Australian technology-company engagement, Aegentra recorded 73 lines of enquiry and sampled 47 Annex A controls. The case study explains how the evidence, findings and conclusions were connected.
It describes one anonymised engagement, not a Melbourne client claim or a guaranteed result for another organisation.
Read the ISO 27001 internal-audit case studyBefore you decide
Define the scope, assess risks, implement the necessary arrangements and collect evidence that they operate. Complete an objective internal audit and management review, address findings, and undergo Stage 1 and Stage 2 with an independent accredited certification body. Aegentra can support the agreed preparation and assessment process; it does not issue your certificate.
No. Internal audit evaluates your ISMS against agreed criteria and helps management understand its performance. Certification is a separate assessment and decision by an independent certification body. Buying consultancy or an internal audit does not automatically result in certification.
Yes. We review the responsibilities, systems and evidence already in place. The proposal records which activities remain with your provider and which Aegentra will perform. A platform can support the process, but it does not replace business decisions, operating controls or independent audit judgement.
We scope the engagement separately. The published implementation starting ranges and fast-track assumptions apply to suitably scoped companies with fewer than 10 people; they are not a quote for larger or more complex organisations. Staff count is one factor alongside services, sites, technology, risk and existing maturity.
The scope needs to describe the actual services, information, interfaces and dependencies being assessed. A local office cannot be considered in isolation if essential work or information handling takes place elsewhere. We help identify those boundaries before implementation and certification arrangements are agreed.
Check the scope, named responsibilities, deliverables, client workload and exclusions. Establish who implements controls, who performs internal audit, how impartiality is protected and what Stage 1 and Stage 2 support includes. Compare the whole engagement, not a headline price with unspecified inclusions.
Use our practical guides to prepare for a discussion or compare your options.
Let’s talk
Tell us what you need to achieve, your approximate team size and any customer deadline. We will discuss your starting point and the information needed for a written proposal.
Overseas: +61 3 9956 9399
Contact@aegentra.com.auWe typically respond within 1–3 business hours.