ISO 27001 certified
for Modern Work
Sources: ASD Annual Cyber Threat Report 2024-25, financial year 2024-25, and the Privacy Act 1988.
1. Application control
ThreatLocker on every computer we manage, with ringfencing so approved apps cannot be turned against you. How staff request an app.
2. Patch applications
Browsers, Office, PDF readers and other apps are updated automatically through Intune, in stages so a bad update does not reach everyone at once.
3. Configure Microsoft Office macro settings
Macros from the internet are blocked by Intune policy. Signed macros from trusted publishers are allowed only where the business needs them. When Excel blocks a macro.
4. User application hardening
Browsers and PDF readers are hardened, and Attack Surface Reduction rules are enforced through Intune. When an ASR rule blocks an app.
5. Restrict administrative privileges
Standard users do not have local admin rights. Privileged accounts are separate, with access granted only when it is needed, through Microsoft Entra ID.
6. Patch operating systems
Windows Update for Business is managed through Intune, with testing rings so updates do not disrupt your team.
7. Multi-factor authentication
Multi-factor sign-in on every account through Entra Conditional Access. Phishing-resistant methods such as FIDO2 keys and the Authenticator app are preferred over SMS. Moving Authenticator to a new phone.
8. Regular backups
Automated cloud backup of Microsoft 365, computers and servers, kept apart from your systems, with restores tested regularly. Backup and disaster recovery.
Weaknesses that leave the business open to common attacks.
Protects against opportunistic attackers using widely available tools. The right starting point for most small businesses.
Protects against attackers willing to spend more time and effort. Required for non-corporate Commonwealth entities.
Protects against more adaptive attackers who target specific organisations.
Source: ASD Essential Eight Maturity Model and the Protective Security Policy Framework.
Most small businesses should target Maturity Level One first. If you handle sensitive government data or health records, you may need Level Two or higher. We look at where you are now and recommend a target for your industry, size and risk.
Book a free consultationGovernment contracts and larger customers often ask for evidence of Essential Eight alignment, and they want it quickly. We assess your current controls, close the gaps and write a detailed report on every strategy. There is no ASD certificate, so the report is your proof.
Start with the Essential Eight Discovery Workshop, A$695 ex GST. You get a gap rating for each of the eight strategies and the blockers to fix before a formal assessment.
In episode 2 of Pax8’s Frameworks in Focus, our CISO Elliot Munro and Harry Morris talk through how Australian small businesses should approach the Essential Eight, with practical steps for 2026.
Elliot Munro, our CISO, is certified through TAFE Queensland’s Essential Eight Assessment Course (January 2026).
He holds Microsoft 365 Certified: Administrator Expert and Microsoft Certified: Identity and Access Administrator Associate. About Elliot
As at October 2026
The Gold Coast’s highest-rated MSP on Google. 166 reviews, more than any other Gold Coast managed IT provider rated 5.0.
Reviewed by Elliot Munro, CISO at GCIT.
