Microsoft 365 · Compliance, built in

BSO Cloud Essentials. Practical compliance for small business.

No servers, no office network, and a team working from home, cafes and client sites. As part of our Microsoft 365 Partner plan, we assess your business against BSO Cloud Essentials, a small-business profile of ASD's Essentials for cloud selected by Biz Secure Online from ASD's published actions. We help you fix what matters first, and give you a verified posture report to show customers, insurers and partners.

Book a free 30-minute call See what we assess

Designed for small business

Compliance that secures your business from day one

ASD writes Essentials for cloud for government and large organisations, and says smaller businesses can use the guidance where relevant. BSO Cloud Essentials keeps the actions that give a business of 1 to 50 staff on Microsoft 365 and SaaS real security value, and that are quick to assess and keep up to date.

Sized for your business

Only the ASD actions that matter for a business your size, each explained in plain English. Every action left out is listed in your workbook with the reason, so nothing is hidden.

Practical, not paperwork

Every gap comes with the fix, in priority order. Many fixes we can make for you through your Microsoft 365 plan, so your security actually improves.

A verified posture to show others

Every rating is backed by evidence we have checked, reported in ASD's own format. Share it with customers, insurers and tenders when they ask.

What we assess

The ASD actions that matter for a small business

BSO Cloud Essentials follows Essentials for cloud domain by domain, in ASD's recommended order. Some examples of what we check:

Phase 1

Identity services

Phishing-resistant multifactor sign-in for everyone

Old sign-in methods blocked

Unused accounts removed and every login unique

Phase 1

Boundary services

Apps and integrations approved before they get access to your data

Current encryption on your websites and data

Weaknesses in what you add fixed on time

Phase 2

Critical processes and services

Backups held separately from Microsoft 365, with restores tested

Recovery arrangements agreed with your providers

Your essential services and suppliers identified

Phase 2

Privileged environments

Admin rights kept to the minimum and reviewed

Every admin action recorded

Admin work done only from secure devices

Phase 3

Business systems

Only approved apps and add-ins enabled

Connected apps reviewed regularly

Services added and removed with a checklist, data recovered on exit

Phase 3

User devices

Staff trained before they get access

Sign-in, app and logging controls applied to every laptop and phone

Every phase

Governance and culture

Accountability for cyber security and AI use set by the owner

An AI use policy and a register of approved AI tools, including Copilot

A register of your cloud services and who is responsible for what

Suppliers checked before you sign up, and every year

Every phase

Visibility and response

Audit logs switched on and protected

Alerts read and triaged quickly

An incident plan for account and tenant compromise, tested yearly

How it works

Four steps, following ASD's assessment process

Scope

We agree which services, accounts and domains are in scope, and record anything excluded and why.

Collect evidence

Your Microsoft 365 diagnostic and website scans, your documents, and a short interview with the owner.

Rate every control

Each BSO Cloud Essentials control is rated not effective, partially effective or fully effective, using ASD's published assessment method.

Report and plan

You get the workbook, the report and a prioritised plan, walked through with you on a call.

What you receive

Evidence you can show a customer or insurer

Control workbook. A spreadsheet of every BSO Cloud Essentials control, with its rating, the evidence behind it, the gap and who owns the fix, plus the ASD actions outside the profile and why. Yours to keep.

Assessment report. A summary by phase and domain, in ASD's reporting format, plus the detail behind every rating.

Improvement plan. The gaps in priority order, following ASD's phases, with the first fixes spelled out.

Starter documents. Templates for the cloud service register, risk register and incident plan that many actions rely on.

Part of the Microsoft 365 Partner plan from A$500 a month, re-assessed every month. Need more time for the improvement work? Add extra Microsoft 365 hours at A$125 each.

Book a free 30-minute call

Assessment summary

Example data · principles per rating

Phase	Domain	Fully	Partially	Not	% effective
All	Governance and culture	3	4	2	56%
All	Visibility and response	2	5	3	45%
1	Identity services	8	6	3	65%
1	Boundary services	7	7	3	62%
2	Critical processes and services				Not assessed
2	Privileged environments				Not assessed

Example of a business working through Phase 1. Later phases are assessed as you progress, and every rating links to its detail in your workbook.

A project, when you need more

Need ISO 27001, ISO 9001 or the full Essentials for cloud?

Talk to us and we scope it with you as a project. Certification itself is carried out by an accredited certification body.

Coming next

The workbook, kept current automatically

Our compliance platform will update your BSO Cloud Essentials ratings from your scans and Microsoft 365 diagnostic. Join the list to hear first.

Join early access

BSO Cloud Essentials is a small-business profile of ASD Essentials for cloud, published by the Australian Signals Directorate on 15 October 2026, selected by Biz Secure Online from ASD's published actions. ASD writes the Essentials for government, critical infrastructure and large organisations, and says smaller businesses can use the guidance where relevant. Our assessments follow ASD's published assessment process. Ratings describe your own environment; there is no certificate. Biz Secure Online is not affiliated with ASD, and ASD has not reviewed or endorsed BSO Cloud Essentials.