Measured. Not attested.

Essential 8 that stays evidenced.

ACSC-aligned cybersecurity maturity for Brisbane businesses. Measured monthly by our platform — not attested annually by a consultant’s spreadsheet. Two clear paths, published pricing, and evidence you can hand to an insurer, auditor or procurement officer on demand.

See the two paths
Book a free 30-min audit
cyber security services Brisbane
5.0★
from 44 Google reviews
24 yrs
Brisbane MSP since 2002
2026
MSP to Watch — Channel Futures
6
Essential 8 engagements delivered
ONE ASSESSMENT, TWO SCOPES

Same measurement. Choose whether we stop at the roadmap or execute it.

Every engagement starts with the same read of your Microsoft 365 environment against the Essential 8. What differs is how far you want us to go — hand the roadmap to your own team, or have us execute the tenant-side remediation and keep the maturity in place with monthly evidence.

Recommended
PATH A — Assess, fix, evidence

We assess, execute, and keep it evidenced.

Everything in Path B, plus tenant-side remediation and full onboarding onto continuous ML1/ML2 with monthly evidence.

Assessment + tenant remediation$2,300 fixedThe Path B read, plus we execute the M365 fixes and re-verify
Endpoint onboarding$110 / PCDeploy security stack + Essential 8 baseline per device
Managed Secure — ongoing$110 / PC / moContinuous evidence, monthly reports, self-heal, full managed IT

EVERYTHING IN PATH B, PLUS

  • Full endpoint scoping (not just M365 tenant)
  • Execution of tenant-side remediation: external sharing lockdown, guest access controls, admin role reduction, MFA enforcement, account lockout policy
  • Post-remediation verification report showing what closed against the baseline
  • Continuous ML1 or ML2 posture with self-healing controls
  • Monthly re-issuable evidence report — hand to insurer, auditor or procurement on demand
  • Full managed IT support included at the same monthly fee
Book a free audit
PATH B — Assess only

The read and the roadmap. Your team does the rest.

One-off assessment of your Microsoft 365 environment. Suitable for businesses with capable internal IT or an existing MSP that will execute the remediation themselves.

Essential 8 tenant assessment$1,500 fixedRead-only M365 environment audit, maturity score, prioritised roadmap
Optional annual re-assessment$1,500 / yrFresh maturity score for insurance renewals, tenders, DISP renewals

WHAT YOU GET

  • Point-in-time maturity score against ML1 or ML2 (your target)
  • Evidence pack showing current posture across all 8 controls
  • Prioritised remediation roadmap your team can execute
  • Independent second opinion on your existing MSP's work
  • Documented findings suitable for board or insurer submission
Honest scope: we don't touch endpoints, we don't execute the fix, and we don't produce ongoing evidence. Your team owns enforcement. Maturity degrades if not actively maintained.
Book a scoping call

All prices in AUD and include GST.

Upgrade path: starting on Path B and deciding you'd rather we execute? Your $1,500 assessment fee credits toward Path A — you pay the $800 difference plus endpoint onboarding.
WHY ESSENTIAL 8 MATTERS NOW

Three forces converging on Australian SMBs in 2026.

Essential 8 is no longer optional for a growing set of Australian businesses — even though there's no single piece of legislation naming it.

DISP mandate (November 2025)

Every member of the Defence Industry Security Program now requires Maturity Level 2 across all 8 controls. That's dragging the rest of the supply chain with it — customers in DISP-aligned procurement now push the same evidence requirements to their vendors.

Cyber insurance underwriting

Australian cyber insurers now routinely require Essential 8 evidence — particularly MFA coverage and patching cadence — and price accordingly. Policies increasingly exclude losses on unsupported operating systems entirely.

Procurement questionnaires

Larger Australian customers now include Essential 8 maturity self-attestation in vendor questionnaires. Being asked to self-attest without evidence to back the claim is a legal and reputational risk your smaller clients hand back to you.

WHAT WE DO DIFFERENTLY

Measured every day, not attested once a year.

Most Essential 8 assessments produce a PDF. Ours produces a live evidence layer. Every control that can be verified from telemetry is checked daily against your Microsoft 365 tenant and every managed endpoint — and where it drifts, our platform puts protective settings back automatically.

The compliance report re-issues on demand: an insurer asks for current MFA coverage, we press a button. A procurement officer wants to see your patch cadence, same thing. No "we'll do a quarterly review and get back to you."

The distinction matters most at renewal time. Competitors sell you a certificate — a snapshot of a moment. We sell you a state, maintained.

Sample Netcomp Essential 8 review report — showing 52% Microsoft Secure Score and roadmap
THE 8 CONTROLS AT EACH LEVEL

What actually changes between maturity levels.

The ACSC's full maturity matrix runs dozens of pages. This is the summary a decision-maker needs.

ControlMaturity Level 1Maturity Level 2
Application ControlUser profiles + temp directoriesAll workstations + servers, ASD block rules
Patch ApplicationsInternet-facing in 1 month, others 1 monthInternet-facing in 48 hrs, weekly vulnerability scans
Configure Office MacrosBlocked from internet originTrusted location and vetted publisher required
User Application HardeningFlash, Java, ads blocked+ PowerShell logging, .NET v3.5 disabled
Restrict Admin PrivilegesSeparate privileged accounts+ Privileged Access Workstations, credentials not cached
Patch Operating SystemsInternet-facing in 1 monthInternet-facing in 48 hrs, weekly scans, unsupported OS removed
Multi-Factor AuthenticationAll remote access + privileged actionsPhishing-resistant MFA for privileged accounts (FIDO2/certificate)
Regular BackupsPerformed + offsite retention+ Quarterly coordinated restore test, immutable retention

Most Brisbane SMBs need ML1 as a baseline. ML2 becomes relevant if you sell into DISP, hold government clients, or have cyber insurance that references it. ML3 is rare outside government and critical infrastructure. Whatever you target, the ACSC's guidance is unambiguous: all eight controls at the same level, or your exposure defaults to the lowest one.

WHERE WE'VE DELIVERED THIS

Essential 8 across regulated and compliance-sensitive sectors.

Three formal Essential 8 reports delivered with prioritised remediation roadmaps and evidence packs — plus three further clients at the technical implementation stage.

// AVIATION

Aviation design organisation

Delivered gap analysis, tenant remediation and continuous evidence pack — used as the technical component of the client's regulatory information-security submission.

// EQUIPMENT SERVICES

Industrial equipment operator

Essential 8 evidence pack integrated with existing operational tooling, mapped to insurance and customer procurement requirements. Ongoing monthly evidence via Managed Secure.

// MANUFACTURING

Metals & manufacturing SMB

Assessment against ML1 baseline with prioritised uplift to close highest-value findings. Continuous evidence retained via ongoing managed service.

Frequently asked questions

Not under general Australian legislation. It is mandatory for DISP members at ML2 as of November 2025, and it’s functionally mandatory if you sell into defence supply chains, hold government contracts, or maintain cyber insurance that references it — your customers and insurers will require evidence whether the law does or not.
ML1 is the right baseline for most 5–40 seat Brisbane businesses without government or defence exposure. ML2 is required if you sell into DISP, hold government clients, or your cyber insurance references it. ML3 is rare outside government and critical infrastructure. The free audit tells you where you sit today.
A structured read of your current cybersecurity posture against the Essential 8, based on what you can tell us about your environment plus a quick read of your public-facing infrastructure. You get a rough maturity indication, the two or three highest-priority gaps, and honest guidance on which path (A or B) fits your situation. No obligation and no upsell scripts.
A questionnaire takes claimed controls at face value. Our assessment reads directly from your Microsoft 365 tenant and — for Path A clients — every managed endpoint. Every finding shows the measured value and where you can confirm it in your own admin portals. That’s the difference between a rating you can defend at an audit and one that unravels the moment someone asks for evidence.
Then Path B is the honest fit. We give you the assessment, the roadmap and independent evidence at handover; your team owns day-to-day enforcement. Come back annually (or when an insurer or tender asks) for a fresh assessment. If maintenance turns out to be harder than expected, moving to Path A later is straightforward — your $1,500 assessment fee credits toward Path A.
No. Continuous evidence requires our security stack (application control, patching, EDR, backup infrastructure) to remain deployed and enforcing. When those tools come off at Path B handover, the evidence layer goes with them. Pretending otherwise would sell you a service we can’t honestly deliver. If continuous evidence matters, Managed Secure is the right route.
Essential 8 is a set of technical controls; ISO 27001 and SOC 2 are broader management-system frameworks that include Essential 8-style controls inside a governance wrapper. We focus on the technical control layer and the evidence beneath it. If you need a full ISMS with formal certification, we work alongside a governance specialist rather than pretend to be one.
Path B: assessment delivered within 2 weeks of scoping call. Path A: onboarding assessment within 2 business days of engagement, tenant remediation within 3 business days of your approval, endpoint onboarding within 2 business days of each device arriving with our software loaded. Full ML1 typically 30–60 days end to end; ML2 typically 90–180 days depending on the scope.

Find out where you actually sit.

A free 30-minute audit against the Essential 8. No obligation, no sales script — just an honest read of your posture and which path makes sense.

Book my free audit Call 1300 363 127