Remote SupportWhat are IT security services?
The ACSC Essential Eight remains the baseline mitigation framework Australian businesses are expected to implement, and ASD is evolving it into a new Essentials series grounded in the Information Security Manual, so the eight mitigation strategies stay current guidance throughout the transition and IT security services are still scoped against them. ACSC, Essential Eight maturity model.
IT security services are the combination of tools, processes and ongoing management that protect your business information from unauthorised access, theft, ransomware and data breaches. For an Australian business, that means controls aligned to the ACSC Essential Eight, obligations under the Privacy Act 1988, and the specific requirements your cyber insurer, clients and industry regulators ask for.
The confusion for most business owners is that IT security is not one thing. It is a stack of different controls working together. A firewall alone does not stop phishing. Antivirus alone does not stop ransomware. MFA alone does not stop a compromised contractor account. You need the layers working together, and you need someone watching them. That is what an IT security service delivers.
The other thing worth knowing is that most IT security services are not sold as individual tools anymore. They are delivered as a managed service by an MSP (managed service provider) or MSSP (managed security service provider), who installs, configures, monitors and responds on your behalf. You do not log into the security console. You get the outcome: fewer breaches, faster response, and evidence on file for insurers and auditors.
The six layers of IT security
Multi-factor authentication is the single control insurers assess first because around 80 per cent of ransomware attacks originate from compromised remote access, and Microsoft now enforces MFA on all admin centre sign-ins from February 2026, so the identity and access layer is no longer optional even for small tenants. Microsoft, mandatory MFA for Entra admin portals.
Every IT security service worth having fits into one of these six layers. If any layer is missing or unmanaged, that is the gap an attacker will find.
Identity and access
MFA, conditional access, privileged access management, and clean joiner and leaver workflows. This is the layer most attacks now target. Stolen credentials are the number one entry vector for Australian SMBs.
Specific controls:
Multi-factor authentication on every account, conditional access policies blocking risky sign-ins, least-privilege admin, and quarterly access reviews.
Endpoint protection
Managed detection and response (EDR or MDR) on every laptop, desktop and server. Not traditional antivirus. EDR watches behaviour and catches fileless attacks, ransomware and credential theft that signature-based tools miss.
Specific controls:
EDR on every endpoint with 24/7 monitoring, application allowlisting on shared PCs, patch management for OS and applications, and full disk encryption.
Email and web security
Email is how most attacks start. Advanced threat protection on Microsoft 365 or Google Workspace, DMARC enforcement to stop email spoofing, DNS filtering to block malicious sites, and phishing-resistant MFA.
Specific controls:
Microsoft Defender for Office 365 or equivalent, DMARC at p=reject, SPF and DKIM aligned, DNS filtering, and regular phishing simulations.
Network security
Firewall management, network segmentation between office IT and operational technology, secure remote access without legacy VPN, and Wi-Fi security. Particularly important for multi-site businesses and those running OT environments.
Specific controls:
Cloud-managed firewalls, segmented VLANs, zero-trust remote access, secure guest Wi-Fi, and documented network diagrams.
Data protection and backup
Immutable backup that a ransomware operator cannot encrypt or delete. Native Microsoft 365 retention is not a backup. Tested restores, not just assumed ones. Encryption for data at rest and in transit.
Specific controls:
Immutable backup in Australian data centres, tested restore procedures, BitLocker or FileVault on every device, and role-based access to sensitive databases.
Monitoring and response
Someone watching when you are not. 24/7 monitoring of endpoints, identity and email for suspicious behaviour. A documented response playbook so a detection becomes an action, not an alert nobody reads. This is what turns a security tool into a security service.
Specific controls:
24/7 SOC or MDR service, incident response playbook, audit logging retained for 12 months, and quarterly security reviews with the leadership team.
What your business actually needs
Most Australian cyber insurers now require MFA, EDR, immutable backup, patch management and a documented incident response plan before they will quote, which is why the non-negotiable baseline for every business is the same regardless of headcount, and the differences by size are about monitoring depth and evidence rather than whether the controls exist. Coalition 2025 Cyber Claims Report.
Not every business needs every control at maximum maturity. But every business needs the same baseline. Here is what we recommend based on size and risk profile.
Every business (non-negotiable baseline)
MFA on every account. EDR on every endpoint. Immutable backup with tested restores. Patch management. Clean offboarding when staff leave. These four controls stop the majority of attacks targeting Australian SMBs.
Growing businesses (20 to 100 staff)
Add conditional access policies, DMARC enforcement on email, DNS filtering, application allowlisting on shared PCs, and 24/7 monitoring through a managed MDR service. Start documenting Essential Eight maturity for cyber insurance renewals.
Regulated or enterprise-adjacent (100+ staff or tendering)
Add privileged access management, security information and event monitoring (SIEM), network segmentation between office and operational technology, a documented incident response plan rehearsed annually, and full Essential Eight Maturity Level 2 or 3 evidence mapped to the ACSC model.
How to choose an IT security provider
ASD proposed changes to the Essential Eight framework mean MSPs and MSSPs delivering security services in Australia need to track the evolving maturity model and reassess what evidence they produce, so a provider ability to document controls against the current framework is a practical test of whether they actually manage the service rather than just resell tools. ConnectWise, Australia new Essentials framework for MSPs.
Are they Australian-based with local engineers?
Offshore helpdesks add time zone gaps and language friction. For security incidents, those gaps matter. You want engineers in your time zone who can be onsite if needed.
Do they hold recognised certifications?
Look for CyberCert (SMB1001) accreditation, ACSC Network Partner status, and vendor certifications for the platforms they manage (Microsoft, Huntress, Cisco). These are evidence of actual capability, not marketing.
Do they deliver security as a managed service, or just sell tools?
A tool you have to configure and monitor yourself is not a security service. You want a provider who installs, configures, monitors and responds. You get the outcome, not the dashboard.
Can they produce evidence for insurers and auditors?
When your cyber insurance renewal or a client security questionnaire arrives, can your provider document what is in place? If not, the controls do not exist as far as the insurer is concerned.
Is there a documented incident response plan?
Ask to see a sample playbook. If they cannot show you what happens in the first hour of a ransomware incident, they do not have one. You need this agreed before the incident, not during it.
Are there lock-in contracts?
Security relationships should be retained through quality, not contract terms. Be cautious of multi-year lock-ins, especially if the service level is unproven.
Compliance alignment for Australian businesses
The Essential Eight is evolving into a new Essentials series over the next two years, but the eight mitigation strategies remain the foundation and stay current guidance throughout the transition, so businesses building compliance evidence now should map to the existing maturity model and expect to reconcile against the new series rather than starting from scratch. ACSC, Essential Eight maturity model.
IT security services in Australia are not just about stopping attacks. They are increasingly about meeting obligations set by legislation, regulators and industry frameworks. Here is how the main ones connect.
ACSC Essential Eight
The Australian Signals Directorate baseline for cyber security maturity. Most cyber insurers, government tenders and enterprise clients now ask for evidence of at least Maturity Level 1. Government and defence adjacent work often requires Level 2 or 3. ASD is evolving the Essential Eight into a new Essentials series over the next two years, but the eight mitigation strategies remain the foundation and it stays current guidance throughout the transition.
Privacy Act 1988 and APPs
Organisations holding personal information must take reasonable steps to protect it under the Australian Privacy Principles. From 2026, small business exemptions are narrowing, meaning more NFPs and small businesses will be covered.
ACNC governance
Registered charities are expected to manage risk responsibly as part of ACNC governance duties. Cyber security is increasingly part of board reporting and donor due diligence.
Cyber insurance requirements
Most Australian cyber insurers now require MFA, EDR, immutable backup, patch management and documented incident response before they will quote. Missing controls mean higher premiums, exclusions, or declined cover.
Notifiable Data Breaches scheme
Under the Privacy Act, organisations must notify the OAIC and affected individuals of eligible data breaches. Having the right security controls in place reduces both the likelihood and the reporting burden.
What IT security services cost in Australia
Businesses that cannot demonstrate the baseline controls face three outcomes at underwriting: outright denial of coverage, exclusion of specific incident types particularly ransomware, or coverage in force that will be denied at claim time due to material misrepresentation about security posture, which is why security services are increasingly priced as part of a managed IT agreement rather than standalone tools. Coalition 2025 Cyber Claims Report.
IT security services are typically priced as part of a managed IT agreement rather than as standalone line items. Here is what Australian businesses can expect.
Managed SaaS (includes security)
$85 to $350 per user per month
Security controls like MFA, EDR, backup and patching are built into managed IT tiers. Higher tiers include 24/7 monitoring, conditional access and deeper Essential Eight maturity.
Security project work
From $195 per hour ex GST
One-off projects like an Essential Eight uplift, M365 tenant hardening, or a security assessment. Scoped to your environment and quoted upfront.
Standalone MDR (endpoint monitoring)
$15 to $45 per endpoint per month
If you already have an IT provider but need 24/7 security monitoring added. Covers EDR licensing and SOC monitoring, response and containment.
vCISO (strategic security leadership)
From $2,500 per month
For businesses that need a chief information security officer on a fractional basis. Includes strategy, board reporting, compliance management and vendor oversight.
All pricing is approximate and varies by environment size, complexity and risk profile. Use our pricing calculator for a custom estimate.
Common questions
What is the difference between IT security services and managed IT?
Do I need IT security services if I already have antivirus?
Is Microsoft 365 secure by default?
How do I know if my business is compliant with the Essential Eight?
What happens if we have a cyber incident?
What IT security services does a small Australian business actually need?
Want to know where your business sits right now? We offer a free 30-minute security assessment that checks your Essential Eight maturity, flags the gaps that matter, and gives you a prioritised plan. Book a consultation
Want a security review?
We assess your current environment against the Essential Eight, flag the gaps that matter, and give you a prioritised plan. No obligation.