First Real IT Decision in Melbourne: How Not to Be Sold Something You Do Not Need

A business of 10 to 30 people in Melbourne needs about five things before it needs anything else. Multi-factor authentication that is actually enforced, patching somebody owns, and a backup somebody has restored. Then a licence tier that can carry those controls, and one named person accountable when something breaks. What gets quoted on top of that is either an obligation somebody has placed on you, or a product built for a bigger business. On a proposal the two look identical. inSUPPORT has run 1,500 or more cyber audits for Australian businesses.

If you are reading this, you are probably not careless. The business has run on a friend who is good with computers, or a contractor you ring when something stops. That worked until it did not. Then a client sent a security questionnaire, or an insurer asked something you could not answer.

The honest version of this conversation shortens your list. What you need turns on four things: your turnover, your industry, what the internet can reach, and what a client or an insurer has already asked for in writing. All four are desk work for one afternoon. None of them needs a provider.

One item below is the case for not buying small business IT support in Melbourne at all this year.

TL;DR: What you actually need, and what can wait

• ✅ Five controls carry most of the risk at 10 to 30 users: enforced multi-factor authentication, patching with a name against it, one restore somebody has actually done, a licence tier that supports the controls, and one accountable person.
• ✅ Settle whether the Privacy Act binds you before you buy anything. The Office of the Australian Information Commissioner (OAIC) sets the line at $3 million annual turnover, with a list of businesses it covers regardless of turnover.
• ✅ A target Essential 8 maturity level nobody has asked you for is worth questioning on a first quote. The Australian Signals Directorate (ASD) says there is no requirement to have an implementation certified by an independent party.
• ✅ Ask which line items are obligations and who imposed each one. An obligation has a name attached: a contract, a regulator, or a government directive. A sales deck is not one.
• ✅ Below about 30 users a monthly per-user support contract often does not stack up, and the assessment is the better first step. That is worth hearing from the side of the table that sells the contract.

Contents

• Four Things to Establish Before You Buy Anything
• What a 10 to 30 User Business Genuinely Needs
• What Tends to Be Priced for a Bigger Business
• The Four Questions That Expose the Difference
• Questions First-Time Buyers Ask Before They Sign Anything

Four Things to Establish Before You Buy Anything

This part starts with facts you already own. Nobody can tell you what you need until these four are written down. A quote that arrives before them is a guess with a price on it. None of it is technical work: an afternoon and a notepad, and the list in item 2 takes an hour of that.

Do them in order, because each one shortens the next.

1. Work Out Whether the Privacy Act Actually Binds You

Most small Australian businesses are not covered by the Privacy Act 1988. That is worth settling before anybody prices work against it. The OAIC sets a small business at an annual turnover of $3 million or less, counting all income from all sources. Its own checklist asks whether your turnover has been more than $3 million in any financial year since 2002. Crossing that line once is enough.

Turnover is not the whole test. Regardless of turnover, the Act covers health service providers, any business trading in personal information, a contractor providing services under a Commonwealth contract, credit reporting bodies, operators of residential tenancy databases and anti-money-laundering reporting entities, among others. Work through the OAIC checklist, write your answer down and keep it. It is the one fact that decides how much of this list is a legal obligation and how much is good practice. Thresholds like that are set by legislation, so check the OAIC page, not this one, when the answer carries weight.

2. Write Down What the Internet Can Reach, and Who Holds the Keys

List every system somebody could reach from outside your office. Email, remote access, file sharing, the accounting platform, the website's admin login, anything with a password box on the public internet. Then write next to each one who can administer it. The list takes an hour, and it is the most useful hour in this process.

Two entries are worth hunting for in particular. The first is a login nobody remembered existed. The second is administrator access still held by somebody who has left, or by a contractor you no longer use. Both are cheap to close once you can see them. Neither needs a product to find.

3. Find Out What Has Already Been Asked of You in Writing

Go through your client contracts, any tender questionnaires you have filled in, and your insurance renewal form. If one of them names a framework, a control or a maturity level, that is an obligation with somebody's name on it. It goes to the top of your list, ahead of anything a provider suggests.

If nothing names anything, you have no deadline. You get to sequence this on your own terms. ASD is explicit about where an obligation can come from. There is no requirement for an organisation to have its Essential Eight implementation certified by an independent party, though an implementation may need independent assessment where a government directive or policy, a regulatory authority or a contractual arrangement requires it. Three sources, all of them nameable. Urgency from a fourth source is a sales technique.

4. Count Your Users and Your Real Trading Hours

Small business IT support in Melbourne is normally priced per user per month. Your headcount is your budget, so a rough guess costs you in both directions. Count the people who need an account, including the casual who works Saturdays and the two directors who barely log in.

Then write down the hours your business actually trades, not the hours your office is open. A support tier is bought against that number. If your week finishes at 5:30 on Friday, you are not in the market for evening cover. Knowing that before the first call saves you arguing about it later.

What a 10 to 30 User Business Genuinely Needs

This list is short on purpose. ASD's guidance for smaller organisations says mitigation strategies should be proportionate to an organisation's risk profile and risk appetite. Its small business cloud security guides are expressly not designed for an organisation chasing a particular Essential Eight maturity level. Proportionate is the word to hold onto when the quote arrives.

Four of the five below are configuration and discipline. None of the four is a product, which is why they rarely headline a proposal. Most of them also map onto ASD's Essential Eight strategies: multi-factor authentication, patching, regular backups and control of administrator access.

5. Multi-Factor Authentication, Enforced Rather Than Available

Switched on somewhere and enforced everywhere are different states. Accounts get taken over in the space between the two. What you want is a written list of the systems where a second factor is required, no sign-in route that quietly skips it, and every exemption documented with a review date. Our longer piece on why multi-factor authentication is not a checkbox walks the four checks that decide whether yours would hold.

This is the first thing to close. It rarely needs new software. If a provider proposes anything ahead of it, ask why.

6. Patching With a Name Against It

Operating systems, applications, firmware, the router in the comms cupboard. Patching is unglamorous, and patching applications and operating systems sit among ASD's eight strategies. Where it slips, the cause is ownership. It belongs to nobody in particular.

The fix at your size is not a platform. It is a named owner, a schedule, and a short monthly record of what was patched and what could not be. That record is the difference between saying patching happens and being able to show it. Keep it even in the months nothing happens.

7. One Restore Somebody Has Actually Done

A green tick on a backup job tells you the software ran. It does not tell you the business can come back. Ask whoever looks after your IT when a restore was last tested and what was recovered. A screenshot from the monitoring tool is not that answer. The detail sits in our piece on whether your backups would actually restore.

At 10 to 30 users this is usually an afternoon of somebody's time once a year, written down afterwards. It is the cheapest control on this page, and the easiest one to assume.

8. A Licence Tier That Can Carry the Controls

Here is the item where the honest answer is that you have to spend money. ASD's small business cloud security guides state that many security configuration options are unavailable in entry level Microsoft 365 subscriptions. Following the guides, they say, requires a Microsoft 365 Business Premium subscription or equivalent. You cannot configure your way around a licence that does not expose the setting.

So treat a licence upgrade as a control rather than an upsell, and ask for it priced as a line you can see. ASD's executive overview of those guides was last reviewed in December 2022 when we checked in October 2026, and subscription names and inclusions move. Confirm the current requirement with ASD and the vendor before you buy on the strength of one sentence.

9. One Accountable Person, and Your Own Keys in Your Own Name

Somebody has to own the next step when something breaks. At your size that is usually one named person. Ask for the name, the hours, and what happens when that person is on leave.

Then make sure the keys to your own business sit in your own business's name. The administrator account for your email and file platform. The domain registration, the password vault, the backup console. Whoever you engage works inside those, not instead of them. This one piece of housekeeping is what turns a future change of provider into a handover rather than a negotiation.

What Tends to Be Priced for a Bigger Business

Nothing in this group is a trick. All of it is real work that a larger organisation buys. The question at your size is sequence, not honesty. An item is premature when nothing in your written obligations asks for it and the five controls above are not yet in place.

Each one below carries the condition that tells you when it stops being premature. Ask for that condition in writing. You have then turned a sales judgement into a decision you can make yourself.

10. A Target Essential 8 Maturity Level Nobody Has Asked You For

ASD defines four maturity levels, Zero through Three. It tells organisations to identify a target level suitable for their own environment, implement each level progressively, and reach the same level across all eight mitigation strategies before going higher. Nobody outside your business sets that target for you, unless a directive, a regulator or a contract does.

Two things follow. A maturity level on a first quote, with no obligation named behind it, is a choice made on your behalf. And since ASD says there is no requirement for independent certification, an offer to make you Essential 8 certified is an offer of something the framework does not contain. Aligned is the accurate word. The maturity model was last reviewed in November 2023, so check ASD's current page before you commit to a number.

11. Penetration Testing Before the Basics Are In

A penetration test tells you what a skilled person could do to your environment as it stands today. It is useful work and it is not cheap. It is also the wrong first purchase while a second factor is optional on three systems and nobody has restored a backup.

ASD's own sequencing is the clue. The same maturity level across all eight strategies, before any single one goes higher. A test that hands you the gaps you already knew about has spent the budget that would have closed them. It becomes the right purchase once the five are done, or sooner if a client contract asks for one by name.

12. Round-the-Clock Cover for Hours You Do Not Trade

Twenty-four-hour support is a real product and some businesses plainly need it. The test is the trading hours you wrote down earlier, not how the cover sounds in a meeting.

If your week ends at 5:30 on Friday, buy business hours and spend the difference on the five controls. If you trade Thursday evenings and Saturday mornings, the sum changes. The question then becomes what an hour of being down in those hours actually costs you. That is arithmetic, not opinion, and you can do it before anybody quotes you.

13. A Security Product for a Risk Nobody Has Named

There is a three-part sentence that sorts this out, and you can say it in the meeting. Name the thing that goes wrong. Name the control that stops it. Name who asked you for it.

A line item that survives all three is worth buying. One that survives only the first is a brochure. At 10 to 30 users the money is better spent higher up this page. None of this is hostile to the person quoting you. A good one answers all three without blinking.

14. And the Awkward One: You May Not Need Managed IT Yet

inSUPPORT's support model is built for Australian businesses of roughly 30 to 300 users. Below about 30, the economics of it do not work. It says so plainly instead of discounting its way into an account the model cannot carry. It is an awkward thing for a provider to put in writing. It is still the right sequence.

So if you are twelve people with a tidy environment and no obligation on your desk, a monthly per-user contract may be the wrong purchase this year. The useful next step is the assessment. Find out exactly where you stand, close the five, and buy ongoing support when your headcount or your obligations make it the cheaper option. A provider willing to tell you that has told you something about how they will behave later.

The Four Questions That Expose the Difference

You do not need a technical translator for any of these. They are commercial questions and they can all be answered in plain English.

Ask all four in the same conversation. Ask for the answers to the second and the fourth in writing.

15. Which of These Is an Obligation, and Who Imposed It?

Go down the quote line by line. Ask for one of three answers against each item: a contract, a regulator or government directive, or a recommendation. Recommendations are legitimate and often sensible. They are simply not deadlines.

What you are listening for is whether the person can tell the two apart unprompted. Someone who labels their own recommendations as recommendations is easier to trust on the items they call obligations.

16. Who Pays to Fix What the Audit Finds?

This is the structural one. If a provider bills for the audit and then bills for the remediation, every problem found becomes more billable work for them. If the remediation sits inside the support fee, the incentive runs the other way. Both are legitimate ways to sell IT. You are entitled to know which one you are signing, and to see it written into the agreement as a clause.

inSUPPORT publishes its support pricing per user per month, with the remediation the onboarding audit finds included in the support fee. Insurance, backup and security awareness training are separate named line items on the quote. However your provider sets it up, ask for the line between included and extra in writing.

17. What Would You Hand Back if We Left in a Year?

Ask it now, while nothing is wrong and the question costs nothing. What you want back is written handover notes, every admin login, licences registered to your business, and your data in a format you can open.

A provider who trusts their own work gives a short, specific reply. A vague answer is itself the answer. It is far better to hear it before you sign than in the week you are trying to leave.

18. Read the Term That Lets Them Change the Deal and Not You

Australian law gives you real protection here, and it is worth knowing before you sign. Since 9 November 2023, proposing, using or relying on an unfair term in a standard form contract has been banned, and penalties apply. The protections reach any business with fewer than 100 employees, or less than $10 million in annual turnover. That almost certainly includes you.

The Australian Competition and Consumer Commission (ACCC) publishes examples of terms that may be unfair, and they are worth reading your draft agreement against. A term that lets one party and not the other change the contract, end it, or penalise the other side for ending it. A term is unfair where it causes a significant imbalance in the parties' rights, is not reasonably necessary to protect the legitimate interests of the party it advantages, and would cause harm if enforced. Only a court can finally decide that, so read carefully before you sign.

Once the list is yours, choosing who supplies it is the easier half of the job. Our comparison of managed IT providers in Melbourne runs nine of them through a single test. It is the natural next step after this page. inSUPPORT is an IT support company in Melbourne, and the same test applies to us.

Questions First-Time Buyers Ask Before They Sign Anything

Do I need managed IT support in Melbourne for a 15-person business?

Often not as a monthly contract. At 15 people you need the five controls above, somebody accountable, and your own administrator access in your own name. A smaller arrangement can deliver that. What changes the maths is an obligation landing on you, a growth plan that takes you past about 30 users, or trading hours that need cover when nobody is in the office. Until one of those is true, small business IT support in Melbourne starts with an assessment, and the contract comes second.

Can the person who has been helping us just keep doing it?

Sometimes, and the test is scope rather than skill. One capable person can run patching, multi-factor authentication and a tested restore for a small environment perfectly well. What one person cannot be is on call while asleep, across every framework a client might name, and the holder of the only copy of the knowledge. If your arrangement depends on one mobile number being answered, that dependency is the gap to price.

How long does getting the basics in place actually take?

The establishing work in part one is yours, and it is an afternoon and a notepad. How long the five controls take depends on what an assessment finds, so ask for the timing in writing alongside the price. One of them waits on something outside the work itself: the first tested restore needs time in somebody's diary. Expect the written record to be the part that slips, because nothing breaks when it is missing until somebody asks for it.

Where do I start if nobody has ever assessed our setup?

Start with the two facts you can establish yourself: whether the Privacy Act covers you, and what the internet can reach. Then have someone independent look at the environment before you decide on people or products. An assessment replaces a hunch with a written list, and you can hand that list to any provider and ask them to price it. A Cyber Strength Audit is available to smaller businesses as a standalone health check, with no obligation attached.

Citations

• "Small business, Office of the Australian Information Commissioner", The source for the Privacy Act test in item 1: a small business is one with an annual turnover of $3 million or less, counting all income from all sources; the OAIC checklist question asking whether turnover has been more than $3,000,000 in any financial year since 2002; and the list of businesses the Act covers regardless of turnover, including health service providers, businesses trading in personal information and contractors under a Commonwealth contract. Read 20 October 2026. oaic.gov.au
• "Essential Eight maturity model, Australian Signals Directorate", The source for the four maturity levels from Zero to Three, the instruction to identify a target maturity level suitable for the environment and reach the same level across all eight mitigation strategies before moving higher, the description of the Essential Eight as a minimum set of preventative measures, the eight strategies themselves including patch applications and patch operating systems, and the statement that there is no requirement to have an implementation certified by an independent party unless a government directive or policy, a regulatory authority or a contractual arrangement requires an assessment. Published 30 June 2017, last reviewed 27 November 2023. Read 20 October 2026. cyber.gov.au
• "Small Business Cloud Security Guides: Executive Overview, Australian Signals Directorate", The source for mitigation strategies being proportionate to an organisation's risk profile and risk appetite, for the guides being expressly not designed for organisations seeking a specific Essential Eight maturity level, and for the statement that many security configuration options are unavailable in entry level Microsoft 365 subscriptions so that following the guides requires a Microsoft 365 Business Premium subscription or equivalent. Published and last reviewed 16 December 2022, so confirm current subscription requirements. Read 20 October 2026. cyber.gov.au
• "Contracts, Australian Competition and Consumer Commission", The source for item 18: the change effective 9 November 2023 banning the proposing, use of or reliance on unfair terms in standard form contracts with penalties attached, the replacement thresholds of fewer than 100 employees or less than $10 million in annual turnover, the three-part test for an unfair term, the examples of terms that may be unfair, and the position that only courts make final decisions on unfairness. Read 20 October 2026. accc.gov.au

Related Reading

• The Best Managed IT Providers in Melbourne, Compared on One Test
• What a Managed IT Support Fee Actually Covers
• What Happens in a Cyber Strength Audit
• Twelve Questions to Ask Your IT Provider Before You Renew
• Cyber Strength Audit

Content reviewed by Probably Genius for accuracy and relevance.

inSUPPORT provides managed IT and cyber security services. It is not an insurer, insurance broker or underwriter and does not hold an Australian Financial Services Licence. Where cyber insurance forms part of a plan, it is arranged through licensed insurance partners and underwritten by the insurer. Cover is subject to the insurer's assessment, the policy terms and the Product Disclosure Statement and Target Market Determination. This article is general information about IT and security practice, not financial product advice, and it does not take account of your objectives, financial situation or needs.