How to Lift Your Cybersecurity Baseline Without Breaking the Business

Cybersecurity has moved from “nice to have” to “board-level risk” for almost every organisation in Western Australia – from hospitality and tourism through to professional services, mining and agriculture. But for many SMEs, the challenge isn’t knowing that security matters – it’s knowing where to start, how far to go, and how to do it without blowing up budgets or staff patience.

In this article, we’ll walk through how we help clients lift their cybersecurity baseline in achievable stages, aligned to frameworks like SMB1001 and the Essential 8, without turning the whole business upside down.

1. Start With a Clear, Honest Baseline

You can’t improve what you haven’t measured. The first step is to understand where you actually stand today – not where you hope you are, or where a vendor’s brochure says you are.

When we onboard a new managed services or security client, we usually start with a structured assessment that looks at:

• Identity & access – How do staff log in? Is MFA enabled everywhere it should be? How many admin accounts are floating around?
• Devices – Are laptops and desktops being patched? Is endpoint protection consistent? Are drives encrypted?
• Data – Where does your critical data live (M365, line-of-business apps, on-prem servers), and how is it backed up?
• Perimeter & remote access – What do your firewalls, VPNs and vendor connections actually look like in the real world?
• Email & collaboration – How well are email security, Teams/SharePoint permissions and external sharing controlled?

The output of this isn’t a 150-page report that nobody reads. It’s usually a one–two page summary in business language, with a simple “traffic light” view of where the major gaps are.

2. Focus on “High Impact, Low Drama” Changes First

Once you know where you stand, the next step is to prioritise. Our goal at this stage is to identify the changes that:

• Materially reduce your risk profile, and
• Can be rolled out with minimal impact on staff and operations.

For most WA businesses, those early wins sit in a few familiar areas:

Multi-Factor Authentication (MFA) Everywhere It Matters

MFA isn’t magic, but it’s still one of the most effective controls you can put in place. We usually target:

• Microsoft 365 / Entra ID (especially admins and remote workers)
• Remote access tools and VPNs
• Critical line-of-business applications that support modern authentication

Backups You’ve Actually Tested

Many organisations believe they have backups, but nobody can clearly answer:

• What exactly is being backed up (and how often)?
• Where is it stored, and who has access?
• When was the last test restore performed?

As part of lifting the baseline, we standardise backup coverage for servers, key SaaS platforms (like M365), and critical file data – and then put regular restore testing into the calendar.

Basic Email & Web Protection

Most successful breaches still start with email or a risky click. Strengthening your baseline usually includes:

• Modern email security (beyond SPF/DKIM/DMARC)
• URL and attachment scanning
• Basic web filtering and reputation controls

3. Embed Security into “Business As Usual”

Cybersecurity can’t just be a one-off project – it has to become part of how you run the environment day to day. That doesn’t mean turning everyone into security specialists. It does mean putting a few rhythms in place:

Regular Security & Patch Cycles

We typically implement and manage:

• Standardised Windows and application patching through your RMM/Intune stack
• Routine reviews of failed patches and exceptions
• Documented rollback and testing processes for higher-risk systems

Continuous Threat Monitoring

Depending on your risk profile and industry, this might mean MDR, a full SOC or a SIEM that centralises logs and alerts. Through our partnership with a leading Perth-based cybersecurity firm, we can provide 24/7 eyes-on-glass for environments where incident detection and response time really matters.

Security Awareness That Actually Lands

“Tick the box” training once a year doesn’t move the needle. We’ve had far more success with:

• Short, regular micro-learning content for staff
• Simulated phishing campaigns with constructive feedback (not blame)
• Targeted training for higher-risk roles like finance and executive assistants

4. Align to Frameworks Without Drowning in Jargon

Frameworks like SMB1001 and the Essential 8 are extremely useful – but only if they’re translated into plain English and mapped to your reality.

With many clients, we:

• Map the current environment to the relevant control set
• Agree a target maturity level that makes sense for their size and risk
• Translate that into a 6–18 month roadmap with clear projects and owners

This gives you something you can show to a board, auditor or insurer: “Here’s where we are, here’s what we’re doing, and here’s when it will be done.”

5. Make It a Joint Effort Between IT and the Business

The most successful security uplift projects we see are the ones where:

• IT (internal or outsourced) owns the technical implementation
• Leadership owns the business decisions and priorities
• Everyone understands why changes are happening – not just what buttons are being pressed

That’s why we favour quarterly strategy sessions with our managed clients. They provide a regular cadence to:

• Review incident trends and risk changes
• Check in against your roadmap and SMB1001/Essential 8 targets
• Decide what to tackle next, and what can wait

Where Datatech Typically Starts

Wrapping Up

Lifting your cybersecurity baseline doesn’t have to mean a huge capital project, a new team of specialists, or disruption across the business. With the right plan – and the right partner – you can make steady, meaningful improvements that reduce risk and satisfy frameworks and insurers, without overwhelming staff.

If you’d like to understand where your organisation currently sits and what a pragmatic uplift could look like, we’re happy to walk you through a baseline assessment and roadmap – no jargon, no hard sell.