Why security questions arrive with growth
Growth brings bigger clients, and bigger clients send security questionnaires before they sign. Cyber insurers ask about MFA, backups and patching at renewal. Tenders sometimes ask how you measure up to the ACSC Essential Eight. An organisation that grew from a handful of people often has no ready answers, because nobody was ever asked before.
What "a recognised baseline" means here
We use the Australian Cyber Security Centre's Essential Eight as the reference point. Your environment is mapped against it, so you can see where you stand on each of the eight strategies and what is left to do.
Be wary of anyone who promises a certificate, or full alignment with a framework, from installing a product. We don't issue certifications and won't claim one on your behalf. What we do is put the controls in place, keep records of them, and help you answer questionnaires accurately.
The baseline on every tenant
- Conditional Access with MFA enforced and legacy authentication blocked.
- Device encryption and patching through Intune on every managed laptop and computer.
- Microsoft Defender for Endpoint P2 on every managed device, with attack surface reduction rules.
- Independent Microsoft 365 backup held outside your tenant, restore-tested on a schedule.
- A 24/7 cybersecurity remediation SOC covering endpoints, identity and phishing simulation, triaging alerts at night and on weekends.
- A mapping to the ACSC Essential Eight, kept with your records.
How the baseline lines up with the Essential Eight
A summary of where the baseline comes in for each strategy. Your mapping shows your actual position, which depends on the whole environment.
| Essential Eight strategy | Where the baseline comes in |
|---|---|
| Multi-factor authentication | Conditional Access enforces MFA, and legacy authentication that bypasses it is blocked. |
| Patch operating systems | Intune keeps managed devices patched and reports the ones that fall behind. |
| Patch applications | Intune covers Microsoft 365 apps on managed devices. The mapping shows any other software still to cover. |
| Regular backups | Independent Microsoft 365 backup held outside the tenant, with restore tests on a schedule. |
| Restrict administrative privileges | Admin accounts are listed in your register, which is reviewed monthly. |
| Application control | Defender for Endpoint P2 supports App Control for Business. It is a lengthy process: we audit first, then work towards it over time. The mapping shows where you stand. |
| Configure Microsoft Office macro settings | Shown in the mapping, with any changes scoped in your roadmap. |
| User application hardening | Attack surface reduction rules are switched on. The mapping shows what remains. |
How quickly
The baseline goes on during cutover, between day 8 and day 21 of onboarding. Devices are enrolled in stages so nobody loses a working day, and from then on the SOC is watching.
Answering questionnaires
Because the baseline, the register and the restore-test results are written down, questionnaire answers come from records. Where a client contract asks for more than the baseline provides, the extra work is scoped in your quarterly roadmap.