What is the Essential Eight?

The Essential Eight is a set of baseline cyber security strategies recommended by the Australian Signals Directorate: application control, patching applications, configuring Microsoft Office macro settings, user application hardening, restricting administrative privileges, patching operating systems, multi-factor authentication and regular backups.

Does my small business need to report a data breach?

If your business is covered by the Privacy Act and a data breach is likely to result in serious harm to individuals, you must notify affected people and the OAIC under the Notifiable Data Breaches scheme. Many small businesses with turnover of $3 million or less are exempt, but there are important exceptions, such as health service providers.

Do I need to report a ransomware payment?

Under the Cyber Security Act 2024, businesses with annual turnover above $3 million, and certain critical infrastructure entities, must report ransomware payments to the Australian Signals Directorate within 72 hours.

Can you work with our existing IT provider?

Yes. We often provide strategy, security reviews and AI or integration projects while your existing provider handles day-to-day support.

IT Consulting & Cyber Security for Australian SMEs

Why it matters for your business

Cyber attacks on Australian small businesses are common, and the cost of an incident, from downtime to lost data and damaged trust, can be severe. At the same time, many businesses are running on a patchwork of tools that do not talk to each other, and are unsure how to use AI without putting customer data at risk. Our IT consulting service gives you senior advice and hands-on help when you need it. We assess where you stand, explain the risks in plain English and fix the things that matter most first.

Who this is for

Australian small and medium businesses, professional practices and growing teams that need practical IT advice, stronger cyber security and help adopting AI safely, without a full-time IT manager.

Our approach

We use the Australian Signals Directorate's Essential Eight as a practical baseline for cyber security, focusing first on high-impact controls such as multi-factor authentication, patching, backups and restricting admin privileges. We help you understand your obligations under the Privacy Act, the Notifiable Data Breaches scheme and, for larger businesses, ransomware payment reporting under the Cyber Security Act 2024. For AI, we help you choose tools, set policies on what data can be used, and keep a person in the loop for important decisions.

What's included

Essential Eight assessment

A practical review of your maturity against the ASD Essential Eight with a prioritised, budget-aware improvement plan.

Microsoft 365 and Google Workspace

Setup, migration, security hardening, device management and licence optimisation.

Backup and incident planning

Backup strategy, recovery testing and a simple incident response plan your team can follow under pressure.

Systems integration and custom software

Connect your business systems, automate manual processes, and build custom tools or apps where off-the-shelf software falls short.

Safe AI adoption

AI readiness review, tool selection, an AI use policy and staff training so you get the benefits without the privacy risks.

Fractional IT leadership

Ongoing technology advice, vendor management and planning, without the cost of a full-time IT manager.

How it works behind the scenes

Our recommendations are vendor-neutral, but we work most often with Microsoft 365, Google Workspace, Microsoft Intune, cloud backup tools and identity providers that support phishing-resistant multi-factor authentication. We document your environment, keep an asset and access register, and align changes with the Essential Eight maturity model so progress can be measured.

ASD Essential Eight

Microsoft 365

Google Workspace

Microsoft Intune

Entra ID

Cloud backup

How we work, step by step

Discovery and risk review

We review your systems, accounts, devices, data and current security controls.

Roadmap

You receive a plain-English report with prioritised recommendations, costs and timeframes.

Implementation

We implement the agreed changes, or work alongside your existing IT provider.

Review and improve

Regular check-ins keep your security and systems improving as your business grows.

How it compares

Area	Without a plan	With Folio Manager
Cyber security	Gaps found after an incident	Essential Eight baseline, risks addressed in priority order
Backups	Assumed to work	Tested and documented
AI use	Staff using tools without guidance	Clear policy, approved tools and training
Technology spend	Unused licences and overlapping tools	Rationalised stack and licence review

IT Consulting & Cyber Security: frequently asked questions

IT Consulting and Cyber Security for Australian SMEs

What does IT consulting for small businesses cover?