Assess your current maturity, implement high-impact controls in Microsoft 365, and capture audit-ready evidence in SharePoint — aligned to ISO 27001 and the ISM.
The Australian Cyber Security Centre (ACSC) recommends the Essential Eight to mitigate common cyber threats, including ransomware. Government and many regulated industries expect uplift to defined maturity levels. We align Essential Eight with your ISMS (ISO 27001) and ISM requirements so you get one coherent program — not competing frameworks.
Increasingly required in public sector and supplier contracts.
Maps cleanly to Annex A controls and ISM hardening.
Targets the highest-impact mitigations for real-world attacks.
Each strategy addresses a specific attack path — together they form layered defence.
Only approved software runs. Example: Staff can use Office; unknown apps are blocked.
Keep browsers/Adobe/Zoom updated. Example: Auto-updates enforced and tracked weekly.
Allow only trusted, signed macros. Example: Finance macros approved; others blocked.
Disable risky browser/PDF features. Example: Block scripts/pop-ups in Edge/Chrome.
Least privilege & just-in-time access. Example: Break-glass accounts only for emergencies.
More than a password. Example: M365 and VPN require MFA for everyone.
Keep Windows/macOS/servers current. Example: Devices >14 days overdue are blocked.
Secure, offline, tested restores. Example: Immutable daily copies, monthly restore tests.
Together these controls prevent malware from running, limit its blast radius, and ensure you can recover quickly.
ACSC measures how consistently the strategies are applied — from basic protection to proactive resilience.
Stops opportunistic attacks; controls exist but may be inconsistent.
Standardised controls across the business; detects common attacks.
Resists targeted attacks; integrated monitoring and continuous improvement.
Most organisations aim for ML2. ML3 is typically required for government/defence systems.
Evidence-based assessment against ML0–ML3, gap analysis, and a risk-prioritised roadmap.
Pragmatic uplift mapped to Microsoft 365, Azure and endpoints — Intune baselines, Defender hardening, application control and admin reduction.
Repeatable test scripts, exports and screenshots stored in SharePoint with retention & versioning — easy to hand to auditors or IRAP assessors.
Essential Eight strengthens your ISMS and ISM compliance. We map each strategy to Annex A controls and ISM hardening so uplift benefits multiple frameworks without extra effort.
Benchmark with live tenant data; confirm scope, risks and quick wins.
Harden controls and automate evidence capture inside Microsoft 365.
Run repeatable tests; prepare artefacts for ISO/ISM or IRAP reviews.
Assess → Implement → Validate — with audit-ready evidence.
Compliance365 