Proportionate
Controls are considered in the context of organisation size, clinical dependence, remote work and business impact.
Podium IT Readiness Standard
A practical baseline for technology that people can rely on.
The framework behind our private readiness report—published so organisations and their existing IT providers can understand what is assessed and why.
Podium IT serviceSupport with a clear next step
LOCALQualified technicianDirect, practical assistanceSecurity-awareCareful access and clear consentAccountable follow-throughDocumented work and outcomes
Melbourne support team
The purpose
Evidence before reassurance.
A product licence or written policy does not prove that a control is working. The Podium IT Readiness Standard looks for practical evidence, accountable ownership and a recovery path that has been tested.
Evidence-led
Configuration, reports, monitoring and test results carry more weight than unsupported assumptions.
Actionable
Findings are translated into immediate, 30-day, 60-day and 90-day priorities that an IT provider can implement.
Six readiness domains
The environment is assessed as one connected system.
A weakness in identity, remote access or recovery can undermine otherwise strong technology. The score therefore considers how controls work together.
Secure access & identity
MFA, approved staff and vendor remote access, individual accounts, reliable offboarding and known service ownership.
Devices & protection
Supported operating systems, monitored AV and EDR, managed patching, encryption and screen locking.
Network & internet
Managed firewalls, suitable capacity, conditional network separation and tested failover where a cloud practice system depends on it.
Backup & recovery
Recovery matched to local or cloud systems, secure off-site copies where applicable, protected data and demonstrated restoration.
Governance & response
Email protection, current documentation, incident and breach contacts, and a responsive accountable provider.
Clinical systems & continuity
Supported applications, documented integrations, vendor escalation and safe continuity during disruption.
How scoring works
A score guides priority—it does not certify compliance.
Relevant core controls are scored consistently. Conditional questions appear only when the technology profile makes them applicable. Phishing practice and duress planning are useful indicators but do not reduce the core score. Foundational gaps are called out separately.
YesControl is understood and operating4PartlySome capability exists but a material gap remains2Not sureEvidence or ownership has not been confirmed1NoThe control is not currently in place0
What strong looks like
Controls that remain effective after the project ends.
A strong environment has named owners, current records, monitored exceptions and a repeatable way to test that important protections still work.
- Identity and access reviewsMFA enforcement, vendor access, administrators and staff changes can be demonstrated.
- Managed operational evidenceUpdates, security alerts, backup failures, integrations and device coverage are actively reviewed.
- Recovery evidenceRepresentative restoration or continuity exercises are completed, timed and followed by documented improvements.
Receive your private report
Apply the standard to your organisation.
Complete the secure assessment yourself or work through it with an authorised representative. Research participation is optional and never changes the private report.