When someone asks how you're protected

Cyber insurance

Insurers ask detailed questions about multi-factor sign-in, backups and admin access. We help you answer them honestly, and fix the gaps before renewal.

Client and supplier questionnaires

Larger clients and head contractors often send a security questionnaire before they'll work with you. We help you answer it and give you the evidence.

The Essential Eight

The Australian Signals Directorate's eight basic security strategies. On Microsoft 365 with Windows computers, our managed IT plan aims for Maturity Level One on seven of the eight, for the systems we manage. There's no official Essential Eight certificate, but we can help you arrange an independent assessment. In October 2026 ASD published ASD Essentials, which builds on the Essential Eight, and is keeping both during the transition.

Privacy and data breaches

The Privacy Act covers businesses turning over more than $3 million, and some smaller ones whatever their size, including health providers, businesses that trade in personal information and, since 1 July 2026, accountants, lawyers, conveyancers and real estate agents for the information they handle under anti-money laundering laws. Covered businesses must report serious data breaches. A serious breach involving tax file numbers must be reported whatever your turnover.

Ransomware payments

Since 30 May 2025, businesses turning over more than $3 million must report any ransomware payment to the Australian Signals Directorate within 72 hours.

We're an IT provider, so we can't give legal advice. We can make sure the technical side is in order and help you prepare before anything goes wrong.

The security checklist

The security settings we put in place

This is what our managed IT plan sets up on Microsoft 365 with Windows computers. Show it to your insurer or your current IT provider.

Show the full checklist

Signing in

Passwordless, phishing-resistant sign-in with passkeys for every staff member
Old sign-in methods that skip multi-factor are blocked
On computers, Microsoft 365 only opens on company devices that meet our security rules
Sign-ins from unexpected countries are blocked, with exceptions when you travel
Staff can reset their own passwords securely
Admin accounts kept separate from everyday accounts
An emergency admin account, locked away and monitored
A secure password management solution for your shared business passwords

Computers

New computers set up automatically when they're first switched on
Drives encrypted with BitLocker
Local admin rights removed, and admin passwords changed automatically
Microsoft Defender antivirus, with tamper protection turned on
Attack surface reduction rules turned on, to block common tricks used by malicious files
Updates go to a small group first, then to everyone

Phones

Work apps on personal phones are protected, so company data stays separate from personal data. We don't manage the rest of the phone.

Email and files

Microsoft's link and attachment scanning across email, Teams, SharePoint and OneDrive
Impersonation protection for your key people
A warning on emails from outside the business
Staff can't set email to forward automatically to outside addresses
SPF, DKIM and DMARC set up, which makes it harder for someone to send email pretending to be you
File sharing limited to people who sign in

Apps and browsers

Office macros from the internet blocked
Microsoft Edge security settings applied
PDF reader and Office settings hardened
PowerShell activity logged

People

Security awareness training and practice phishing emails, with results in your monthly report

Cyber security and compliance

What attacks on businesses look like