What does IT governance include?
The unglamorous part that keeps auditors, insurers and boards satisfied: written policies, a register of what you actually own, access that gets reviewed rather than assumed, and a technology roadmap you can take into a budget meeting. We measure against the Australian Signals Directorate’s Essential Eight rather than an opinion.
- Essential Eight assessment and maturity uplift
- IT policies and documented procedures
- Asset and licence register
- Access reviews and a real offboarding process
- Risk register and remediation planning
- Technology roadmap and budget planning
- Reporting for audits, insurers and boards
How does an Essential Eight assessment work?
We assess where you currently sit against each strategy, agree a target maturity that is realistic for your size and budget, and work through the gaps in a planned order rather than all at once.
Day-to-day protection sits with managed cybersecurity. The backup service itself sits with backup and disaster recovery. Assistant policy sits with AI consulting.
- A current position against each strategy
- A target maturity sized to the business
- Gaps worked through in a planned order
What are the eight strategies?
The Australian Signals Directorate recommends eight baseline mitigation strategies that, taken together, make it substantially harder to compromise a business.
- Patch applications
- Patch operating systems
- Multi-factor authentication
- Restrict administrative privileges
- Application control
- Restrict Microsoft Office macros
- User application hardening
- Regular backups
The Essential Eight is published by the Australian Signals Directorate — read it on cyber.gov.au.
Common questions about IT governance
What does IT governance include?
Essential Eight assessment and maturity uplift, IT policies and documented procedures, an asset and licence register, access reviews and offboarding, a risk register, a technology roadmap and budget planning, and reporting for audits, insurers and boards.
What is the Essential Eight?
Eight baseline mitigation strategies published by the Australian Signals Directorate: patch applications, patch operating systems, multi-factor authentication, restrict administrative privileges, application control, restrict Microsoft Office macros, user application hardening, and regular backups.
How do you run an Essential Eight assessment?
We assess where you currently sit against each strategy, agree a target maturity that is realistic for your size and budget, and work through the gaps in a planned order.
Is this the same as managed cybersecurity or backup?
IT governance is the assessment, the policies and the registers. Day-to-day protection sits with managed cybersecurity, and the backup service itself sits with backup and disaster recovery.
Planning your next move?
Talk to us about managed services, a migration, better backup or tightening up your security. Honest advice, and a clear scope before anything starts.
Need help right now?
Call the support hotline — a Perth-based technician is ready to help, anywhere in metro Perth or rural WA.