Run a cyber security gap assessment once a year at minimum, and again whenever the business changes materially — new systems, new premises, a merger, a major client with security requirements, or a move toward certification. Annual is the floor, not the target: controls decay faster than most businesses expect, and the assessment is only worth its report if the gap list is current when a real incident or an insurer asks about it.
TL;DR
- Annually is the minimum cadence for every business holding customer data.
- Re-run off-cycle after material change: new systems, mergers, cloud migrations, major contracts.
- Always run one before starting Essential Eight, SMB1001 or ISO 27001 work — you cannot close gaps you have not scored.
- The human layer goes stale fastest; measure it continuously rather than waiting for the annual review.
- Pair the annual assessment with monthly training and phishing data so the gap list stays honest between reviews.
The short answer by situation
| Situation | Recommended cadence |
|---|---|
| Business holding customer or client data | Annually |
| Business pursuing Essential Eight, SMB1001 or ISO 27001 | Before the programme starts, then annually after certification |
| Business under a major client's security questionnaire | Before signing, then each renewal cycle |
| Business after a merger, migration or new premises | Within 90 days of the change |
| Business that just had an incident | Within 30 days of closing the response |
| Businesses with no customer data and no compliance pressure | Annually still recommended; controls decay for everyone |
The table's first row covers most Australian businesses, because almost every business holds someone's data. The last row exists because the most common excuse — "we're too small to need it" — does not survive contact with the numbers: the average self-reported cybercrime cost to an Australian small business is $56,571 per incident, up 14% year on year (ASD, Annual Cyber Threat Report 2024-25).
Why annual is the floor, not the target
A gap assessment is a photograph of a moving subject. Between assessments, the picture goes stale in three ways:
- Controls decay. Staff leave and take their configurations with them; the MFA rollout that covered everything except one legacy account quietly grows exceptions; a contractor gets system access that nobody revokes. Each of these is a gap that existed at the last assessment or appeared after it — either way, the report no longer shows it.
- The environment changes. Every new SaaS tool, every device, every integration adds surface the previous assessment never scored. Australian government guidance through the Essential Eight frames mitigation as a maturity model precisely because "done once" is not a maturity level.
- The threat moves. Attackers adapt faster than annual review cycles. Roughly 60% of breaches involve a human element — an error, a clicked link or a manipulated employee (Verizon, 2025 DBIR) — and the lures that fool staff this year are not the ones the last assessment measured.
If you read what a cyber security gap assessment is, the framing is the same: the assessment scores your controls against a framework and produces a ranked remediation plan. A ranked plan against year-old evidence is a plan against the wrong target.
The five triggers that force an off-cycle assessment
Calendar aside, five events should trigger a re-assessment regardless of when the last one ran:
- A new system or major migration. Moving email to the cloud, adding an ERP, standing up a customer portal — each introduces controls nobody has scored.
- A merger or acquisition. Inheriting another company's environment means inheriting their gaps, and the assessment is how you find them before they become your incident.
- A significant contract or certification push. Enterprise clients and certification bodies (SMB1001, ISO 27001) ask for evidence of a current baseline. An assessment within the last 12 months is the evidence; an older one restarts the conversation.
- A security incident. After the response closes, a re-assessment shows what the incident revealed about the wider control set — attackers rarely exploit only the gap they used.
- Rapid headcount change. Growing from 15 to 40 staff in a year multiplies endpoints, accounts and onboarding paths. The assessment scored 15 people's environment; 40 is a different control problem.
The cadence mistake: annual everything, continuously nothing
The most common failure is treating the gap assessment as the whole measurement programme — one thorough review a year and silence in between. The technical findings genuinely can wait a year; patching posture and backup configurations move slowly. The human layer cannot wait, because it changes with every hire, every phishing email and every busy month:
- Continuous: security awareness training completion and phishing simulation click and report rates, reviewed monthly.
- Continuous: human risk reporting against a benchmark, so drift shows up in weeks rather than at the next annual review.
- Annual: the full gap assessment across policy, people and technology, feeding the 90-day remediation plan.
This split is why the human-risk rows of the annual assessment stay honest: they are corroborated — or corrected — by twelve months of live data rather than a single self-reported answer.
What a well-paced programme looks like across a year
A practical rhythm for a 10-100 person business:
- Month 1: run the gap assessment; rank the gaps; set the 90-day plan with owners.
- Months 2-4: remediate the top gaps; run monthly simulations and training in parallel.
- Month 6: mid-year check-in against the plan — the two or three rows still open get escalated or consciously deferred.
- Months 7-12: continuous human-risk monitoring; track whether the month-1 click and report rates hold.
- Month 12: re-assess. The comparison between this year's scores and last year's is the board-level output — not either report alone.
The cost profile supports the rhythm: a structured self-assessment costs days of internal time, and an external assessor a few thousand dollars for a small business — against the $56,571 average incident cost above, one prevented incident pays for years of assessments.
How often is too often?
Full assessments more frequently than annually add cost without much signal, because the technical controls they score move slowly. Two exceptions:
- Businesses under fast-moving compliance pressure — a certification audit pending, a client's security review on a short clock — may run a scoped re-assessment of only the affected controls rather than the full framework.
- Businesses that had an incident should re-assess the controls the incident touched within 30 days, which is a scoped exercise, not a second annual review.
Everything else stays on the annual cycle, supplemented by continuous human-risk data.
FAQ
How often should a small business do a gap assessment? Annually, with a re-run after any material change. A structured self-assessment keeps the cost near zero for the years when nothing has changed.
Is annually enough if we're chasing certification? During an active certification or audit programme, assessments run at the cadence the programme demands — often more frequently, scoped to the controls under review.
Who should run it — internal or external? Either. Internal self-assessments surface most gaps cheaply and build ownership; an external assessor adds independence and evidence weight for insurers, auditors and enterprise clients.
What if the last assessment is more than a year old? Run a new one rather than refreshing the old report. The controls, systems and staff have all changed; scoring against an old baseline produces a falsely confident gap list.
Does the gap assessment replace phishing simulations and training? No. The assessment measures controls at a point in time; training and simulations change behaviour continuously. The annual report should cite the monthly data, not stand in for it.
How long does an assessment take? Days for a structured self-assessment; one to two weeks with an external assessor, most of it evidence-gathering.
One last thing
The assessment cadence that works is the one that produces a gap list someone still trusts at month eleven. For most businesses that means annual full assessments, event-triggered re-runs, and monthly human-risk data filling the space between — three dials, in that order of frequency.