When South Australian Government agencies and councils buy ICT services, they almost always ask about cyber security. The framework they know best is the Australian Signals Directorate's Essential Eight: eight practical controls that make it much harder for attackers to compromise systems. If you are an Adelaide SME bidding for government or council work, you do not need to be a security boutique to respond well. You do need to understand what buyers mean, what maturity looks like in plain English, and how to evidence your position without overclaiming.
What the Essential Eight is
The Essential Eight is a baseline set of mitigation strategies published by the Australian Cyber Security Centre (ACSC). The eight strategies are:
- Application control — only allow approved software to run
- Patch applications — keep browsers, office suites and other apps up to date
- Configure Microsoft Office macro settings — block or tightly control macros
- User application hardening — turn off risky browser and app features
- Restrict administrative privileges — separate day-to-day accounts from admin accounts
- Patch operating systems — keep Windows, macOS, servers and mobiles current
- Multi-factor authentication (MFA) — require a second factor for remote and privileged access
- Regular backups — back up important data, store copies offline or immutable, and test restores
Maturity is scored from Level 0 (weaknesses present) through Level 3 (stronger protection against more capable adversaries). For most small and medium businesses, Maturity Level 1 across all eight strategies is a sensible target. Larger or higher-risk environments often aim for Level 2 or 3.
Why SA agencies and councils care
Public sector buyers are accountable for citizen data, continuity of service and supply-chain risk. Tender questionnaires, panel applications and security schedules commonly ask suppliers to describe:
- How you protect your own systems and the environments you build for clients
- Whether you align to Essential Eight principles (and to related SA guidance such as the Information Security Management Framework where relevant)
- How you handle privileged access, patching, backups and MFA
- Insurance, incident response and what happens if something goes wrong
Even when a tender does not name the Essential Eight, answering with that structure shows evaluators you speak their language. For councils and small agencies, a clear SME story at Level 1 is usually more credible than vague claims of “enterprise-grade security” with no evidence.
Maturity levels in plain English (focus for SMEs)
The table below summarises the strategies that tend to matter most in SME and government-supplier conversations. It is a practical overview, not a substitute for the official ACSC Essential Eight Maturity Model.
| Strategy | Level 0 (gaps) | Level 1 (typical SME target) | Level 2–3 (stronger) |
|---|---|---|---|
| Multi-factor authentication | Passwords only for email, VPN or cloud admin | MFA on remote access, privileged accounts and important cloud apps | Broader coverage, phishing-resistant options for high-risk roles |
| Restrict admin privileges | Staff use admin accounts for everyday work | Separate standard and admin accounts; admin use is limited and logged | Just-in-time elevation, stricter monitoring and approval |
| Patch applications & operating systems | Updates are ad hoc; unsupported software remains | Critical patches applied promptly; unsupported products removed or isolated | Faster SLAs, automated inventory and stricter exception handling |
| Regular backups | Backups untested, incomplete or only on the same network | Important data backed up regularly; offline/immutable copy; restore tested | More frequent testing, broader coverage and stronger resilience design |
| Macros, hardening & application control | Macros unrestricted; browsers allow risky content; any software can run | Macros blocked or tightly controlled; basic hardening; approved software where practical | Stronger application control and hardening across more systems |
Use Level 0 honestly if that is where you are today. Evaluators prefer an accurate baseline and a dated uplift plan over a polished claim you cannot defend in a clarification meeting.
How to evidence Essential Eight in tenders without overclaiming
- State your target maturity and current position. For example: “We target Essential Eight Maturity Level 1 for our corporate environment. MFA, privileged access separation and tested backups are in place; application control is being rolled out on managed endpoints.”
- Attach artefacts, not adjectives. Useful evidence includes an information security policy, access-control procedure, patch schedule, backup and restore test notes, MFA screenshots or configuration summaries, and cyber insurance certificates. Redact sensitive detail.
- Separate your firm from the client environment. Be clear what applies to your own corporate systems versus what you will design into the client solution. Buyers need both stories.
- Do not claim certification you do not hold. Essential Eight is a maturity model, not a certificate. Avoid language such as “Essential Eight certified” unless you have a specific, verifiable assessment report to cite.
- Map answers to the criteria headings. Mirror the tender’s security questions. Short, evidenced paragraphs score better than long generic security essays.
- Show the SA context. Mention Australian data residency where relevant, Privacy Act / APP alignment, and willingness to support agency ISMF or risk processes.
A practical starting checklist for Adelaide SMEs
- Turn on MFA for Microsoft 365 / Google Workspace, VPN and any cloud admin consoles
- Publish SPF, DKIM and DMARC for every domain you own so criminals cannot send email as you (see our email security guide)
- Give staff standard accounts; keep admin accounts separate and few
- Inventory devices and applications; remove what you no longer support
- Set a patch cadence you can actually keep (and record it)
- Block Office macros from the internet; harden browsers
- Back up critical data, keep a copy offline or immutable, and restore-test at least quarterly
- Write a one-page incident response contact list and keep insurance current
If you need help operationalising this as a managed service, see our managed IT and cyber security offering. If you are preparing a panel or tender response, review our government capability statement or discuss your project with our team.