An audit shows you where your agency stands. It is a starting point, not a result. A report sitting in an inbox does not stop a redirected deposit or protect a single applicant file. What protects the business is acting on the findings, in the right order, over a sensible stretch of time.
We have already covered where the cyber risk sits for a Sydney agency: deposits and settlements moving through trust accounts, the deep pile of applicant data you hold, and a rent roll that lives in the cloud. This post is the follow-up. If an audit has just shown you the gaps, here is a practical 90-day plan to close them, built around how an agency actually operates.
You will not need to turn the office upside down. Most of this is tightening what you already run.
The First 30 Days: Protect the Transactions
In real estate, the deposit is the target, so the first month goes straight at payments and the accounts that hold them.
Start with multi-factor authentication on every mailbox and every cloud platform: the CRM, the trust accounting system, the property management software. MFA means a second step at login, usually a prompt on a phone, so a stolen password is not enough on its own. Payment-redirection attacks almost always begin with an attacker quietly reading a mailbox, learning the timing of a real settlement, then sending updated bank details at exactly the right moment. MFA makes that first break-in far harder. Our guide to business email compromise shows how the attack unfolds.
Then set one rule the whole office follows: any change to bank details, for a deposit, a settlement, or a landlord disbursement, is verified by a phone call to a known number, never by replying to the email. That habit stops most of what gets past the filters, and it costs nothing.
Because your rent roll and trust data are concentrated into a handful of logins, account hygiene matters here too: strong, unique passwords, and MFA enforced on the accounts that can move trust money.
Days 30 to 60: Tidy the Applicant Data and the Backups
Every rental application is a small pile of sensitive information: payslips, bank statements, identity documents, references. Multiply that across every applicant for every property and an agency holds a remarkable amount of personal data, often scattered through inboxes and shared drives that were never set up with privacy in mind. The second month brings that under control.
Decide where applicant data should live, restrict who can access it, store it somewhere appropriate rather than across email, and delete what you no longer need to keep. Under Australian privacy law that data is your responsibility, and a breach can mean notifying every affected person and the regulator.
Backups belong here too. The flaw to avoid is the backup that runs but has never been restored, because that is a guess rather than a safety net. Set up a proper 3-2-1 backup: three copies, two types of storage, one copy offsite and protected so an attacker cannot reach it. Then test a restore, so you know your rent roll and records could actually be recovered.
Days 60 to 90: Secure the Agents and Keep It Closed
Real estate is a mobile business. Agents work from open homes, cars, and cafes, on phones and laptops that move constantly. The final month makes sure that flexibility does not become an open door.
The basics need to travel with the device: a screen lock and encryption so a lost phone is not a breach, and the ability to remotely wipe a device that goes missing. Pair that with prompt offboarding, so when a property manager or sales agent leaves, their access is removed the same day rather than lingering as a forgotten login.
Then decide who owns security going forward. Controls drift the moment nobody is watching. MFA gets switched off for one account, a new login appears, a backup quietly fails. The agencies that stay secure are the ones where someone checks, month after month, that the controls held.
Everything in this plan lines up with Essential Eight, the baseline published by the Australian Cyber Security Centre. You do not need to learn the framework. You need the controls behind it working in your agency.
Where to Start
If you have not had an audit yet, that is the natural first move, because most of these gaps stay invisible until someone looks. An IT Audit gives you a documented picture of your agency’s setup and a clear order of priorities for $990, with no ongoing commitment. You will know what to fix first and what can wait.
We are a Sydney-based team in Bella Vista, and we work with real estate and property businesses across the metro area. We secure the systems your agency runs on without getting in the way of the deals. Talk to our team when you are ready.
