ISO 27001 certified
for Modern Work
Email is where most business attacks start. In 2024-25, 19% of business cybercrime reports to ASD were email compromise with no money lost, and 15% were business email compromise fraud where money was lost. That is why the Security Pack watches mailboxes closely.
Sign-in locations
Every sign-in is tracked by location, and we are alerted when one comes from outside the countries your business works from. Compromised accounts often show an overseas sign-in before any damage is done.
Impersonation
We flag outside emails that try to pass as someone inside your business. A message that looks like it came from your director or your accountant can fool even careful staff.
Forwarding rules
One of the first things an attacker does in a mailbox is add a rule that copies email to an address outside the business. We watch every mailbox for new forwarding rules and are alerted when one appears.
Admin roles
More access is what attackers want. If an account is made a Global Administrator or Exchange Administrator, we report it, because an unexpected admin role can hand someone control of your whole tenant.
Multi-factor sign-in turned on and enforced for every user, with Microsoft Authenticator set up and staff shown how to use it. Conditional Access policies handle high-risk sign-ins, and backup methods are in place for account recovery.
Multi-factor authentication blocks more than 99% of unauthorised access attempts, even when the attacker has a valid username and password (Microsoft Digital Defense Report 2025).
Unified audit logging across Microsoft 365, mailbox audit logging in Exchange Online, and Microsoft Entra ID sign-in and activity logs. If something goes wrong, there is a record of what happened, which helps with a breach notification or an insurance claim.
Every mailbox is backed up to independent third-party storage, separate from Microsoft 365. We can restore a single email or a whole mailbox to a point in time after a deletion or ransomware, including mail from staff who have left.
Your Microsoft Secure Score and what to improve, sign-in locations and anything unusual, guest and external user access, admin role and forwarding rule changes, and the improvements we recommend next.
01
We review your Microsoft 365 tenant: Secure Score, multi-factor sign-in take-up, mailbox settings, admin roles and current policies. That shows what needs attention first.
02
Multi-factor sign-in for every user, audit logging, anti-phishing policies and mailbox backup. These are the minimum for any business running Microsoft 365, not optional extras.
03
With the baselines in place, we turn on monitoring for sign-in locations, forwarding rules, impersonation attempts, admin role changes and suspicious sign-ins, with alerts sent to our team.
04
When someone leaves, our offboarding process backs up their mailbox, blocks their sign-in, sets up mail forwarding and removes licences. Our offboarding checklist shows the safe order.
05
Each month you get a clear report on what happened, what changed and what we recommend next. Your team, your setup and the threats all change, so security is never set and forget.
06
If monitoring finds a real threat, we lock the account, sign it out everywhere and investigate. You get a plain summary of what happened, how it happened and what we did about it.
Security Pack reporting comes through the monthly IT report in the GCIT customer portal. Every section explains how to read it in plain English.
Secure Score is Microsoft’s configuration score, not a compliance certification, and the report says so. It is the share of Microsoft’s recommended security settings that are switched on.
Across the tenants we manage, our clients’ average Microsoft Secure Score is about 1.8x the Microsoft average for organisations with 101 to 1,000 seats (October 2026).
Businesses with an annual turnover over $3 million are covered by the Privacy Act, and some smaller ones are too. A covered business must report a data breach that is likely to cause serious harm to the OAIC and the people affected.
Since December 2022, the maximum civil penalty a court can order against a company for a serious interference with privacy is the greater of $50 million, three times the benefit obtained or, if the benefit can’t be worked out, 30% of its adjusted turnover during the breach period.
The Australian Signals Directorate’s Essential Eight is the baseline for cyber security in Australia. Several Security Pack controls support it, such as multi-factor sign-in, watching for new admin roles and regular backups. Cyber insurers and government contracts increasingly refer to it.
GCIT holds ISO/IEC 27001:2022 certification. The controls in the Security Pack come from the same information security management system we run internally. If you are working towards your own certification, or need to show your controls to partners and insurers, our records give you documented evidence.
Cyber insurers increasingly want evidence of specific controls before they issue a policy, such as multi-factor sign-in on every account, email backup, audit logging and an incident response plan. The Security Pack covers the IT controls on that list, which can make renewals simpler.
As at October 2026
The Gold Coast’s highest-rated MSP on Google. 166 reviews, more than any other Gold Coast managed IT provider rated 5.0.
Reviewed by Elliot Munro, CISO at GCIT and Microsoft Certified: Cybersecurity Architect Expert.
