DIY Cyber Security Package
Know what to do, in what order, and how to do it — a self-paced toolkit for sorting your cyber security.
✓ Complete implementation guides for your platformCyber security is a question Australian small and medium businesses are increasingly being asked to answer — by clients, by insurers, by the contracts they’re signing. Most don’t have a clear answer.
The DIY Cyber Security toolkit is the structured way to get one.
Everything You Need to Secure Your Business
Our DIY package provides the same comprehensive guides and resources we use in our consulting services, empowering you to implement Essential 8 cybersecurity at your own pace.
- Self-assessment aligned to the ACSC test plan — all 50 ML1 requirements mapped with reference codes
- 8 platform-specific implementation guides (Windows, macOS, iOS, Android, ChromeOS)
- 950+ annotated screenshots of actual admin consoles and settings
- Downloadable validation scripts, registers, and checklists
- Assessor evidence callouts — exactly what reviewers check
- Troubleshooting sections for every control
- 24-document policy suite — policies, playbooks, checklists, forms, and registers
- Supplier Risk Toolkit — ACSC-aligned questionnaires, registers, and risk assessment
- Training resources and awareness posters
- Australian third-party service coverage (Xero, MYOB, banking, myGovID)
- Lifetime access — including future updates
Optional: 30-Minute DIY Check-In
Need some guidance? Book a focused video call to ask questions, get advice on your specific setup, or review your implementation progress with our cyber security expert.
Perfect For Businesses That...
What's Inside Your DIY Package
Everything you need to implement Essential Eight cyber security yourself — built by consultants, designed for non-technical business owners
Find what needs fixing
The Self-Assessment Guide
Structured checklists aligned to the ACSC Essential Eight Assessment Test Plan. Evaluate your current security posture control-by-control, identify gaps, and build a prioritised remediation plan — the same process a professional assessor would follow.
The questions are built on the Australian Cyber Security Centre’s Essential Eight — the national baseline for small business cyber security, and the framework your insurers and clients are increasingly expecting you to align with.
Why the Essential Eight:
How to fix it
Step-by-Step Implementation Guides
Each guide walks you through every relevant Essential Eight control with detailed, click-by-click instructions written specifically for your technology stack. Guides include annotated screenshots of every configuration screen, ready-to-run validation scripts, downloadable Excel registers and checklists, troubleshooting sections for common issues, and assessor evidence callouts explaining exactly what reviewers will check.
Platforms Covered:
+ all the resources you need to do it:
Policy & Template Suite
The documented policies your insurer, clients and auditors will ask for — written for Australian businesses, ready to brand and sign off. 24 documents covering everything from acceptable use to ransomware response.
Supplier Risk Toolkit
Every supplier you engage carries cyber risk into your business. The toolkit to work out which ones matter, what to ask them, and how to keep on top of it.
Training Resources
Ready-to-deliver training packs that turn your team from your biggest risk into your first line of defence. Under an hour per topic, no prep needed.
Awareness Posters
Print-ready posters and digital assets that keep the basics visible every day — for the kitchen, the printer, reception, or shared digitally with remote staff.
Email Authentication
Stop your domain being used to spoof your customers. The exact DNS records, the order to apply them, and how to read the reports once they start coming in.
Implementation Guides for Your Platform
Five workstation combinations cover the most common business setups — Windows or macOS paired with Microsoft 365, Google Workspace, or on-premise infrastructure. Three companion guides handle the mobile devices your team uses every day: iOS, Android, and Chromebook.
Workstation Guides — All 8 Controls
+
+ Microsoft 365
+
+ Google Workspace
+
+ Microsoft 365
+
+ Google Workspace
+
+ On-Premise
Companion Guides for Mobile Devices
M365 + Google
M365 + Google
Google Workspace
✨ Don't see your platform combination? Contact us now and we'll create a custom guide for you at no additional cost.
Why this works
Cyber security gets sorted the same way every time. Find the gaps. Plan what to do. Close them in priority order. The toolkit gives you everything you need for each step.
Find
Walk through the Self-Assessment Guide. The 50 questions are written in plain English and mapped one-to-one to the ACSC Essential Eight test plan. You finish with a clear picture of where you stand and what to tackle first.
Plan
Use the prioritised gap list to sequence the work. Start with what matters most. The toolkit’s policies, registers, and supplier questionnaires give you the governance scaffolding for everything you’re about to put in place.
Close
Follow the platform-specific implementation guide for your stack. Click-by-click instructions, annotated screenshots, validation scripts, troubleshooting sections, and assessor evidence callouts — one control at a time, until you’ve closed them all.
Every step in every guide looks like this
950+ annotated screenshots across the toolkit. Below is a step pulled directly from the Windows + Microsoft 365 implementation guide — covering Essential Eight control E3 (Restrict Administrative Privileges).
Assign Least-Privilege Entra ID Roles
Assign only the specific admin roles each person needs — not Global Admin for everyone. Navigate to Entra ID → Roles and administrators, select the role, and add the admin account. Cross-reference with your Privileged Access Register to ensure every role assignment has a documented business justification and approval.
ML1 Requirements Addressed: RA-01, RA-02
High Risk Global Administrator — limit to 1–2 accounts maximum. Can do everything.
Medium Intune Administrator — manages device policies, app deployments, compliance.
Medium Security Administrator — manages Defender, security policies, alerts.
Lower User Administrator — manages user accounts, password resets, group membership.
Remove M365 Licences from Admin Accounts
One of the most commonly failed ML1 checks. Navigate to M365 Admin Center → Users → Active users, select the admin account, and confirm no M365 licences are assigned. No licence means no Exchange mailbox, no OneDrive, no Teams, no SharePoint — which is what RA-03 requires.
ML1 Requirements Addressed: RA-03
Assessors specifically run this PowerShell command to catch admin accounts that still carry M365 licences:
Get-MgUser -All | Where-Object { $_.AssignedLicenses.Count -gt 0 } |
ForEach-Object {
$roles = Get-MgUserMemberOf -UserId $_.Id |
Where-Object { $_.AdditionalProperties.'@odata.type' -eq '#microsoft.graph.directoryRole' }
if ($roles) {
[PSCustomObject]@{
User = $_.UserPrincipalName
Roles = ($roles.AdditionalProperties.displayName -join ', ')
Licences = ($_.AssignedLicenses.Count)
}
}
}
Any admin account returned with licences assigned = RA-03 failure. The guide includes this script ready to copy, plus the expected output for a passing tenant.
Frequently Asked Questions
What if my IT provider already manages this?
The toolkit gives them the same map we’d use. Many buyers run it alongside their existing IT provider — you stay in control of the programme, they handle the parts they own. The self-assessment lets you see what your provider has actually covered, and the policy suite gives you the governance layer most providers don’t touch.
I’m not technical — can I actually do this myself?
The guides are platform-specific and written click-by-click, with annotated screenshots of every configuration screen. If a particular step is over your head, the optional 30-minute Check-In is there as a sanity check, or you can step up to the Cyber Security Review where we do the find-and-plan work for you.
Is this the same as an ML1 review?
No — we don’t issue certifications. The DIY programme is the structured guide to getting yourself to ML1, not an audit of whether you’re there. It uses the same checklist a professional reviewer would use, so when you do go through a formal review, there are no surprises.
What if I want help implementing?
The 30-minute DIY Check-In is built for exactly this. Add one to your purchase for help partway through, or book additional check-ins anytime you want a sanity check, a second opinion, or guidance on a specific control. You stay in control of the work; we’re available whenever you want input.
Is this just an Essential Eight checklist? I can get those for free.
Generic checklists don’t tell you the order, the platform-specific steps, or what evidence a reviewer expects. This is a programme, not a list — sized for a business that wants to do the work, not be told it exists. Plus the additional hygiene the Essential Eight doesn’t cover: email authentication, supplier risk, staff training, and the policy library to back it all up.
Ready to Take Control of Your Cybersecurity?
Get instant access to professional-grade cybersecurity guidance at a fraction of consulting costs.
Complete Your Purchase
Secure checkout powered by Stripe. Your login details will be emailed immediately after payment.
Order Summary
1. Complete payment securely via Stripe
2. Account created automatically
3. Login details emailed instantly
4. Access all resources immediately