One phished password
A convincing email, a login page that looks right, and by lunchtime someone's mailbox is sending fake invoices to your customers. Without MFA, that's all it takes.
Security & compliance
Security that fits a small team.
The basics done properly — MFA everywhere, a password manager, a backup you've actually restored from, devices managed — without the enterprise theatre. Framed on the Essential Eight, sized for two to twenty people.
Sound familiar?
How small businesses actually get hit
Not a hacker picking you out. An ordinary email, an ordinary habit, and a gap nobody had got around to closing.
The shared spreadsheet of passwords
Everyone has a copy, nobody knows who else does, and the Wi-Fi password is the same as the accounting login.
"Microsoft backs it up, right?"
Not the way people assume. Microsoft keeps deleted items for a while; that's retention, not backup. When a mailbox is wiped or OneDrive is encrypted, the window runs out.
Ex-staff who can still log in
Someone who left in March still gets company email on their phone. Nobody meant it to happen; offboarding just wasn't anyone's job.
What's included
Six things, done properly
No appliance to buy, no dashboard to ignore — the controls that stop common attacks, set up once and kept running.
Managed password manager
A team vault where each person sees only what they work on. Shared accounts — the supplier portal, the social media login — handled without the sticky note. When someone leaves, their access ends that day.
MFA & Conditional Access
Multi-factor authentication on every account, with Conditional Access rules that block sign-ins from places your team never works and require a managed device for the sensitive systems.
Backup with a tested restore
Independent backup of email, OneDrive and SharePoint, kept outside your tenant — and restores actually run on a schedule, because an untested backup is a hope.
Intune device management
Laptops enrolled, encrypted, patched and locked after too many wrong guesses. A lost laptop is wiped remotely instead of becoming a crisis.
Phishing-awareness session
A plain-English session with your team: what the scams look like now, what to do when something seems off, and why nobody gets in trouble for asking.
Quarterly security report
What's protected, what changed, what's outstanding — in words you can forward to an insurer, a client or an auditor.
Framed on the Essential Eight
The Essential Eight, small-team sized
The Australian Cyber Security Centre's Essential Eight is its baseline list of mitigations: patch applications and operating systems, turn on MFA, restrict admin privileges, control which applications run, lock down Office macros, harden user applications, back up regularly. It was written with large organisations in mind and comes with maturity levels that assume an IT department. We apply each of the eight at a scale that fits two to twenty people, and tell you honestly which are done.
- Patch applications and operating systemsWindows, Office, browsers and the apps you run updated automatically through Intune, with a check that it actually happened.
- MFA, and fewer admin accountsEvery person on MFA. Admin rights only where needed and only when needed — never on the account you read email with.
- Control what runsApplication control and Office macro settings that block the "enable content" trick phishing relies on, plus browser hardening.
- Back up, and test the restoreDaily backups of email and files kept separately from your tenant, with a restore run on a schedule rather than assumed.
Health & NDIS
The paperwork an audit asks for
Allied health practices and NDIS providers hold the most sensitive information a small business can — and the Privacy Act's small-business exemption doesn't apply to health service providers. Policies are written to match how your practice works, not from a template.
Privacy policy
What you collect, why, where it lives and who can see it, written for clients to read. From 10 December 2026, privacy policies must also explain any automated decision-making that uses personal information and significantly affects people — the OAIC's guidance is the reference, and we word yours to match.
NDIS-aligned information-management policy
How participant information is stored, shared with support workers on the road and retired, lined up with what the NDIS Practice Standards expect — ready before the auditor asks.
AI-use policy
Which AI tools staff may use, on which accounts, and what must never be pasted in — client records, health information, tax file numbers, passwords. Short enough to be read.
How it works
Check, fix, keep
-
01
Check
A security audit of your Microsoft 365 tenant, devices, accounts and backups, written up in plain English: what's protected, what isn't, and which gaps matter first.
-
02
Fix
The urgent gaps closed first — MFA, old accounts, a backup that actually runs. Then the password manager, Conditional Access and devices, in an order that doesn't wreck anyone's week.
-
03
Keep
Monthly checks, a quarterly report, a phishing session for the team, and policies updated when the rules change — which they do. Part of the Secure and Complete IT plans.
What it costs
Two ways in
Prices are what you pay — Tidewire isn't registered for GST, so none is added.
Security & compliance add-on
From $150 a month
The full tier on top of any Tidewire IT plan, kept running month to month. Already included in the Secure and Complete plans.
- Managed password manager
- MFA, Conditional Access and Intune
- Backup with restores tested on a schedule
- Phishing session and quarterly report
Security audit
From $1,000 one-off
For when someone else looks after your IT, or you want to know where you stand first. One audit, one plain-English report, a priority list you can act on with anyone.
- Microsoft 365 tenant, devices and accounts reviewed
- Backup actually tested
- Written report with priorities
- No obligation to go further
Policies for health and NDIS providers are quoted as a fixed piece of work. If you're not happy in the first 90 days, every monthly fee you've paid comes back — set-up fees and advertising spend excepted.
See the IT plans the add-on sits on → · Compare everything on the pricing page →
FAQ
Fair questions
Is this the Essential Eight?
It's built on it. The Essential Eight is the Australian Cyber Security Centre's baseline list of mitigations, published with maturity levels that assume an IT department. We apply each of the eight at a scale that fits two to twenty people and tell you plainly which are in place. We don't claim or certify a maturity level.
We're tiny — who'd target us?
Mostly nobody targets you specifically. Phishing is sent in bulk, and a business with no MFA and a shared password spreadsheet is simply an easier door than the one next to it. The fake-invoice scam — a hacked mailbox emailing your customers new bank details — lands on small businesses precisely because money moves on trust.
Do we need cyber insurance paperwork?
If you hold or are applying for cyber insurance, the proposal form will ask whether MFA is on, backups are tested and devices are managed. This tier is the honest yes to those questions, and the quarterly report is something you can attach. We don't sell or advise on insurance.
What's a tested restore?
A backup you've actually pulled a file, a mailbox or a folder back from, on purpose, and checked was complete. Until that's happened, a backup is a setting, not a safeguard. We run restores on a schedule and note the result in your report.
Can you do this if someone else does our IT?
Yes. The one-off audit works alongside any provider — you get the report and priority list and can hand it to them. The ongoing add-on needs admin access to your Microsoft 365 tenant, so it usually pairs with one of our IT plans.
How long does set-up take?
The urgent work — MFA, old accounts, a backup that runs — usually happens in the first fortnight. The password manager, Conditional Access and device enrolment follow over the next few weeks, paced so your team isn't dealing with every change at once. Policies are drafted alongside. Everything else we do.
Find out where you stand
A free 15-minute chat, straight answers about what's protected and what isn't, and no obligation to buy anything.
Book a free 15-minute chator call 0439 649 099 · email hello@tidewire.com.au