Questions we hear all the time.

Reach out through the contact form with a plain description of what you're experiencing, whether that's a specific problem or a general "something feels fragile" concern. We review what you've shared and reply to confirm whether we're a good fit before any paid work begins. There's no pressure and no obligation, and most people who reach out are glad they did.

Every review and project is quoted after a short discovery conversation, once we understand your environment and what actually needs doing — a church running three volunteers and a shared inbox is a different job to a business with fifty staff and a dozen cloud subscriptions. We don't publish fixed price lists publicly, but we're happy to talk through indicative pricing directly if you get in touch and ask.

Yes. Login problems are often a symptom of a bigger issue: an expired password reset process, an admin account nobody remembers the details for, or multi-factor authentication (MFA) tied to a phone that no longer exists. We can recover access and, more importantly, fix the underlying account and recovery setup so it doesn't happen again.

If you have a documented "break-glass" admin account, a reset can often be done safely in minutes. If nobody is sure who the administrator even is, that's a sign the tenant needs a proper hygiene review before it becomes a lockout. Either way, it's worth getting sorted properly rather than patched again.

Most organisations that have "a backup" have never actually tested restoring from it. A backup that has never been tested is a guess, not a safety net. Part of a Leadership Technology Review is checking that backups exist, cover what actually matters, and can genuinely be restored when needed.

Suburban Secure provides fixed-scope technology reviews, separately quoted implementation projects and optional ongoing services for defined needs. Managed email administration and Virtual CIO engagements have their own agreed scope. A review does not include continuous monitoring, a general helpdesk or an emergency response service; any support hours and response arrangements must be agreed explicitly. We can work alongside your existing MSP or internal IT team.

You can keep your existing provider. Our review gives you documented findings and priorities that your team, your MSP or Suburban Secure can act on. Implementation and any ongoing service are separate choices, with responsibilities agreed before work begins.

No, and we don't sell one brand either. Most of what we do is untangling technology decisions made piecemeal over years — a router bought on special, an access point added when the Wi-Fi "felt slow", a switch nobody remembers configuring. We work across Ubiquiti, TP-Link Omada, Netgear and GLiNet, among others, chosen for what actually fits the site, budget and complexity — a small office and a multi-building campus rarely want the same gear. The goal is a network that's secure, manageable and scalable, not a particular logo on the box.

The free check is a quick, public-signal snapshot — email, DNS, domain and website security signals, run in minutes with no signup. A full Leadership Technology Review goes further into everything a public check genuinely can't see: administrator access, backup health, MFA coverage, device and network setup, and vendor handover. The free check is a real, honest starting point; the review is where the whole picture gets mapped into a staged plan.

The work is remote-first by design — identity, email and cloud security don't need someone on-site to fix properly, and staying remote is part of what makes fixed-scope, upfront-quoted pricing possible. If you need hands-on desktop or hardware support, that's a good complement to run alongside an existing onsite provider or Townsville Computer Man, not a replacement for either.

GRC stands for governance, risk and compliance — in plain terms, having a documented policy for how your organisation handles technology and data, a real picture of what could go wrong, and a clear answer to what you're actually required to do. Most small organisations already do some of the technical work (MFA, backups, updates) but have never written any of it down, which becomes a problem the moment a funder, insurer, board member or auditor asks for evidence rather than an assurance. See Cyber Security Governance, Risk and Compliance.

They're stages of the same work, not three separate products. A Leadership Technology Review produces the first cyber security strategy — a staged, prioritised roadmap based on what actually exists. GRC documents that into a policy, a risk register and a clear answer on compliance obligations. A Virtual CIO engagement keeps all of it current on an ongoing basis instead of letting it go stale a year after it's delivered. Most organisations start with the review and add the others only if and when they're actually needed.

Email and cloud accounts, administrator access, domains, websites, networks, Wi-Fi, phones, cameras, backups, devices, suppliers and service costs can all be included. The exact scope is agreed with you before the review begins, so there are no surprise inclusions once it's underway.

No. The objective is to improve what you already have sensibly. Recommendations may include securing, simplifying, documenting, reusing or gradually replacing systems — replacement is one option among several, not the default answer.

Yes. You can engage Suburban Secure for the review only, or request a fixed-scope proposal for selected implementation work once you've seen the findings. Nothing is bundled in advance — you decide what happens next.

Yes. Findings are explained in plain English and organised into priorities, decisions and staged actions rather than delivered only as a technical report, so a board, owner or leadership team can approve a plan without needing to be technical first.

No. Suburban Secure is based in Townsville and works with organisations across Australia. Most of the work is remote by design; some infrastructure work may need an on-site visit or coordination with a local technician.

The first conversation is to understand your situation and work out whether a review or project would genuinely help. If Suburban Secure isn't the right fit, that gets said plainly rather than turned into a pitch.

A single administrator can become a point of failure, while a shared administrator login makes activity difficult to attribute. We review named accounts, appropriate role separation, MFA and documented emergency access. These reduce the risk of account loss or misuse; they cannot guarantee access during every provider outage.

We first confirm the organisation’s ownership and what access still exists, then assess the available recovery options. Recovery depends on the circumstances and the provider’s verification process. A tenant review can improve administrator access and recovery documentation afterwards.

Not automatically. The Privacy Act 1988 generally only applies to businesses with annual turnover over $3 million, but there are common exceptions that catch smaller organisations anyway — including businesses that trade in personal information, provide health services, or are contracted to deliver services for the Australian Government. Charities registered with the ACNC have separate governance standards regardless of size. This isn't a substitute for legal advice, but it's exactly the kind of question a GRC review or Leadership Technology Review works through with you.

Usually, yes — not because a cable is inherently insecure, but because a tangle of cabling and patchy Wi-Fi is almost always evidence of a network that grew one decision at a time rather than being planned. That kind of setup typically comes with outdated firmware, no separation between guest and internal devices, and no one person who fully understands it anymore — right down to an old printer still running factory firmware because nobody thought to check it. A network review maps what's actually there and gives you a clear, staged plan to simplify it.

This is genuinely the most common starting point we see, not an unusual problem. Whoever set things up years ago made reasonable decisions at the time; almost nobody ever goes back and checks whether they're still right. A good first step is often the free cyber security check for a quick public snapshot of your email and domain signals, followed by a proper review that maps the whole environment — accounts, network, devices — into a staged, practical plan rather than a pile of disconnected fixes.

Only if it's genuinely separated from the network your files, printers and staff devices sit on. Many volunteer- or staff-configured guest networks skip that separation entirely, which means a guest could potentially see what's being printed or reach other devices on the network. It's a quick thing to check properly — ask whether your guest Wi-Fi is on its own VLAN or subnet, and if nobody's sure, that's the answer.

No. Suburban Secure is built around a "pay it forward" approach — the first conversation is genuinely useful even before any paid engagement, and reviews and projects are scoped and fixed-price so you know the cost upfront. The goal is practical, right-sized security, not enterprise theatre your organisation doesn't need.

We use the ACNC's public charity register, which lists basic details for every registered charity in Australia. When you search your charity by ABN or name, we're matching against that public list, not any private data we've collected about you. Nothing beyond public register and public DNS/website information is used, and running the check doesn't sign you up to anything.

No. Apple Business Manager links your organisation, eligible devices and app licences to a separate device-management service. The mobile device management (MDM) platform is what actually applies the settings and management actions.

For an eligible device correctly assigned by Apple or a participating reseller, Automated Device Enrolment can begin when the user first turns it on and connects it to the internet. The user still completes the organisation's Setup Assistant steps. We confirm the supplier workflow during planning — it depends on the supplier participating in Apple Business Manager and correctly submitting the order.

Often, yes, but the pathway depends on the model, current setup and proof of ownership. Some devices may need Apple Configurator and an erase before they can be supervised and managed as intended — we'll explain that before any device is changed.

Apple supports a privacy-preserving User Enrolment model for appropriate BYOD cases. Its controls are deliberately more limited than management of a supervised, organisation-owned device. We recommend the model that matches ownership and risk rather than treating every device the same.

Available actions depend on how it was enrolled. Supported supervised devices can offer stronger lost-device controls, including Managed Lost Mode and remote erase. The response process, authorised contacts and backup assumptions are agreed and documented during the project.

No. It's a scoped monthly subscription for a specific function — account requests, domain changes, scheduled security reviews and day-to-day Microsoft 365 or Google Workspace admin tasks, handled remotely — not an open-ended retainer covering everything IT. You can stop at any time, and because the scope is narrow and named upfront, it's simple to compare against what you're getting from any other provider.

They're DNS records that prove an email claiming to be from your domain actually came from a system you authorised. Without them configured properly, it's straightforward for a scammer to send a convincing fake email that appears to come from your business, your bank or a supplier — and your own outgoing mail is more likely to land in spam. Setting them up, then confirming they're enforced rather than just present, is part of every setup we do.

No. Elevated access is time-boxed and used only for the task at hand, then logged and removed rather than left standing. The tenant, its documentation and its administrator accounts are yours — we're not a provider that holds the keys forever, whether or not you keep the subscription running.

Each cycle produces a plain-English report on your Microsoft 365 or Google Workspace tenant — administrator accounts and access, MFA and sign-in activity, DKIM/DMARC/SPF status, mailbox and file-sharing exposure, and anything that's drifted since the last review. It's a working document, not a sales pitch for more hours — if everything checks out, the report says so.

Yes — that's the point of doing it properly. Before touching production DNS we document the current records, confirm what depends on them and agree a change window, so mail flow and the live site keep working while ownership and configuration get tidied up.

You do. We're brought in for a specific technical problem, not to build an ongoing relationship with your client at your expense. We won't present ourselves as the designer or developer, and we won't turn a small referral into a pitch for a broader engagement without your knowledge.

Yes. Plenty of engagements are introduced to the client as part of the broader project team, with Suburban Secure never mentioned by name if that's what works best for you. We're comfortable being visible or invisible — whichever keeps the client relationship clean.

Yes, this is core work for us. We review records across whichever platforms are involved — website host, email provider, marketing platform — find what's actually breaking delivery or authentication, and fix it without guessing.

Yes. Email and hosting are separate systems even when a client assumes otherwise, and moving one doesn't require touching the other. We'll confirm exactly which records and services are involved before anything changes.

Often, yes. Recovering access to a domain, registrar account or admin login that's fallen out of contact — a previous developer, a long-gone staff member, an old agency — is one of the more common reasons we get brought in.

Yes. We review who actually controls the hosting account, domain, backups, staging environments and any abandoned plugins or logins, then help establish clean, client-owned access and a documented handover.

Yes. We configure domains, accounts, administrator access and security for both platforms, without making your agency responsible for ongoing email support you never signed up to provide.

We say so and explain what's involved, rather than quietly expanding the job. If it needs separate technology work, that gets scoped and quoted directly with the client — your project stays exactly as big as you intended it to be.

Not as a starting point. We'd rather build a track record of successful introductions first and decide later, together, whether a formal arrangement actually improves things — not complicate the trust that makes referrals work.

Yes. Many brokerages rely on offshore processing or support staff, and aggregators are increasingly specific about how that access needs to be structured. We can review and configure conditional access, MFA and permissions so offshore or outsourced roles have exactly what they need — documented in a way that holds up when an aggregator asks.

Both. A solo broker usually needs a tighter Microsoft 365 or Google Workspace setup and a straightforward answer to aggregator questions. A larger brokerage with loan writers, admin staff and offshore support needs role separation and access review as well. The engagement is scoped to the size of the brokerage, not sold as a one-size package.

If you're moving from an existing IT provider, the main things to get right are admin access, documentation and a clean handover — which is exactly the kind of work we do. A short review can confirm what you currently have before anything changes, so nothing gets missed in the switch.

No. Reviews and projects are fixed-scope and quoted upfront. Where an ongoing arrangement genuinely helps — for example keeping Microsoft 365 administration current — it's a scoped subscription you can stop at any time, not a term contract.

Yes. Whether the requirement comes from an AFSL licensee, a dealer group, the Tax Practitioners Board or a professional association, the underlying work is usually the same — documented administrator access, MFA, secure file sharing and a written record of what's in place. We translate the requirement into the actual technical controls and document it so you have a clear answer when it's asked for.

We don't build or support the practice management platform itself, but we regularly work around it — securing the Microsoft 365 or Google Workspace tenant it connects to, reviewing who has administrator access, and making sure client financial data held in email and file storage is properly protected.

Often, yes. Professional indemnity insurers and licensees are increasingly asking for evidence of MFA, backups, a documented incident response process and a risk assessment before they'll renew or approve. A Leadership Technology Review or GRC engagement produces exactly that kind of documentation.

Both. A sole practitioner usually needs a tight, well-documented Microsoft 365 or Google Workspace setup and a clear answer for their licensee. A larger firm with several advisers, para-planners or support staff needs role separation and access review on top of that. The engagement is scoped to the size of the practice.

Yes. This is core work for us — connecting Apple Business Manager or an equivalent Android or Windows platform with mobile device management so tools, quoting apps, Wi-Fi and security settings are ready on a device from first setup, and can be locked or reassigned cleanly when someone leaves or a device is lost. See Apple Device Management and Device Management.

Covered as part of the same review. Separating staff, guest, office and site devices onto the right network, cleaning up who can actually get onto it, and making sure it holds up when the depot or office moves is standard network and infrastructure work.

With clear, documented access that's easy to switch off. Shared logins and long-forgotten subcontractor access are some of the most common risks we find in trade and construction businesses — the fix is usually named accounts, defined permissions and an offboarding step that actually happens when the job or contract ends.

Often, yes. Head contractors, principal builders and cyber insurers are increasingly asking subcontractors and trade businesses to demonstrate MFA, backups and basic security practices before they'll award work or renew a policy. A review gives you a documented answer instead of a guess.

Yes. Auditors and the NDIS Quality and Safeguards Commission increasingly expect documented evidence of information management and privacy controls, not just a verbal assurance. A Leadership Technology Review or GRC engagement produces exactly that — administrator access, MFA, backups and data handling documented in a form you can show an auditor.

Participant records often include health, disability and financial information, which raises the bar well above a typical small business. We review who can actually access that data — in email, case management software and shared files — and tighten it to what each role genuinely needs, rather than leaving broad access as the default.

Yes. Support coordination and care provider teams often have high staff turnover and a lot of mobile, casual and support-worker access. We set up named accounts, appropriate permissions and a clean offboarding process, plus device management for phones and tablets used in the field — see Apple Device Management.

We don't build or support the case management, rostering or claims platform itself, but we regularly work around it — securing the Microsoft 365 or Google Workspace tenant it connects to, reviewing administrator access, and making sure participant data held in email and file storage is properly protected.