Everyone Starts at Zero. That's the Good News.

By The Most Secure Man Alive | WISECLICK Ambassador

The national cyber standard is built so that almost every small business fails it on day one. Once you know why, the whole thing gets a great deal easier.

Something shifted in the last couple of years, and you've probably felt it without naming it.

The insurer's form got longer and sterner. A client slipped a security questionnaire into a contract. A tender asked for evidence you'd never been asked for before. None of it arrived as an announcement. It just became the water you were swimming in. What used to be a nice-to-have, the cyber equivalent of a tidy back office, quietly turned into something assumed of you, the way public liability cover or a locked front door is assumed. You aren't behind the times. The times moved, all at once, and everyone running a small business is standing in the same new normal, blinking at the same longer forms.

So here is the thing nobody says out loud, and it's the most freeing fact in this whole subject.

When you finally measure yourself against the national standard, you are going to score zero.

Not because you've been careless. Because it's built that way. The standard is the Essential Eight, kept by the Australian Signals Directorate, and its scale starts every single business at the bottom, at a level the government plainly calls zero. Almost every small business in the country sits there on day one. Zero isn't a report card. It's the starting line, drawn in the same place for everyone, the accountant and the architect and the bloke with the ute alike.

Which changes what the assessment is for. It was never a test you pass or fail. It's a map that shows you where the start line is and which way the hill runs. And the hill is shorter than the forms make it look.

Because the eight things, stripped of their stern language, are not exotic. A couple you switch on once and rarely touch — turning on multi-factor authentication so a stolen password opens nothing, sorting who really holds the keys. A couple are habits more than tasks — letting updates install instead of postponing them, keeping a backup that actually works. And the few that are genuinely technical are the kind a plain step-by-step guide walks you through, not a thing you sit and puzzle out alone. No firm. No audit. No lanyard in the doorway. Most of it is closer to locking up at night than to anything that needs a consultant, and the whole industry would rather you didn't know that, because a customer who feels capable doesn't renew out of nervousness.

So let me just tell you the path. It's short, and your peers are already walking it.

First, see where you stand. Take the Ransomware Readiness Check yourself — thirty minutes, plain English, nobody coming in. You'll most likely land at or near zero, and that's exactly right. Now you've got the map almost nobody bothers to draw.

Then get the relentless stuff off your plate. A WISECLICK membership runs the handful of things that must never stop — your protection, your backups — so they don't quietly lapse the week everything gets loud. That's the part that genuinely wants a partner. Not because it's hard, but because it's constant, and constant is the first thing to slide on a busy desk.

Then do the rest at your own pace. The membership hands you the Essential Eight as plain step-by-step guides, and a Cyber Toolkit alongside them — plain how-tos and tools that make the everyday safer, the café wi-fi, the dodgy-looking invoice, the new phone you've just set up, each explained so you can actually use it. Work through whatever's useful, in whatever order suits you. No deadline but your own.

And the piece that makes it a partnership rather than a purchase: when a question turns up, or a strange email lands, or a form asks something you don't recognise, you have someone to ask. That, more than any single setting, is the whole point of a membership. You stop being the only person in your business who has to know about this.

Where this leaves your cyber insurance

Now watch what happens to that insurance form.

Once the eight are in place and quietly maintained, the questionnaire isn't a threat anymore. The answers are simply true. And here's the part I like best: once you've done the work, we hand you a fresh token to take the assessment again, and the new result is yours to send straight to your insurer. Plain-English proof that you're the careful kind, the kind they price gently and pay without a fight. You're protected, and we keep you protected. The form becomes a formality, and the renewal becomes a short conversation.

That's the journey. Start at zero, see the map, hand off the relentless parts, climb the rest at your pace, and keep a partner on the line for the day something looks off.

You were never the weak link the longer forms implied. You'd just never been handed the list, in your own language, by someone with no reason to keep you nervous. The only thing that has ever separated one business from another is that one of them looked at where it stood and started climbing.

Start where everyone starts. The view from a little further up is worth the thirty minutes.

I took mine years ago, scored what everyone scores, and worked down the list over a few unremarkable afternoons. No one came in. I've answered every insurer's form since without a second thought, and barely thought about any of it in between. The least dramatic thing I ever did for the business, and quietly one of the best.

Stay protected, my friends.
— The Most Secure Man Alive

---

Frequently asked questions

Will I score zero on the assessment?

Most small businesses do at first, and that's by design. The Essential Eight scale starts everyone at zero, so it isn't a mark against you. It's simply the starting line, and the point is the climb from there.

Do I need an IT company to do the Essential Eight?

For most small businesses, no. A few of the eight you switch on yourself, a couple are ongoing habits, and the more technical settings come with plain step-by-step guides. The aim is to leave you capable, not dependent.

What does a WISECLICK membership actually do?

It runs the parts that must never stop — your protection and your immutable backups — so they don't quietly lapse, hands you the Essential Eight as step-by-step guides to apply at your pace, adds a Cyber Toolkit of plain how-tos that make the everyday safer, and gives you a partner to ask when something comes up. The simple stuff is yours; the constant stuff is ours.

How does this help with cyber insurance?

The controls insurers reward map almost one-to-one onto the Essential Eight, so doing the security work is most of the insurance work. Once you've done it, your membership includes a fresh assessment token, and that result is yours to share with your insurer as proof of where you stand.

Can I just buy more cover instead of doing the security work?

No, and the ASD says so plainly. Insurance moves the cost of a bad day, not the bad day. Using a policy as the reason to skip a control scores you as having done nothing at all (cyber.gov.au).

What is the Ransomware Readiness Check?

A thirty-minute, plain-English look at where your business stands against the Essential Eight. $149, results in plain language, no sales call afterwards, and nobody coming in. It's the map you start from.

---