A sensible cyber baseline for a growing Australian business

Begin with identity, device management, backups, patching and incident ownership. Confirm that access is removed when people leave, privileged accounts are protected with strong authentication, recovery is tested and someone knows what to do when an incident occurs.

Strengthen the operating basics

Prioritise controls that protect everyday work:

• multi-factor authentication and limited administrator access;
• supported, patched devices and applications;
• tested backups separated from normal user access;
• a simple joiner, mover and leaver process; and
• named responsibility for responding to an incident.

The Essential Eight is a valuable reference, but implementation should still reflect your risks, systems and contractual obligations. Aim for balanced improvement across controls instead of making one area look mature while basic gaps remain elsewhere.