As a Microsoft Solutions Partner MSP serving Canberra businesses and government suppliers, Mycelium 365 provides managed IT Canberra organisations rely on for Microsoft 365, Azure, and cyber security. Canberra is a remote-delivered service area: we hold no premises in the ACT and no staff member resident here, and we say so before the sales conversation rather than after it. What we bring instead is a Microsoft-only managed service built for organisations whose security requirements were written by somebody else — a department, a prime, a funder — and who need those requirements evidenced from a live environment rather than asserted in a policy attachment.
Essential Eight maturity assessed control by control and reported at the level you are actually at, with the movement to a contracted level priced rather than promised.
ISM and PSPF-derived obligations translated into Microsoft 365 and Azure configuration proportionate to a supplier, not a department.
Conditional access, compliance, patch and privileged-role exports assembled into an evidence pack an assessor or a prime can read.
No Commonwealth framework regulates a private Canberra business directly. What happens is that an agency is bound, the agency binds its supplier, and the supplier binds its subcontractors — so a security schedule drafted for a department arrives in the inbox of a firm with one part-time bookkeeper and no information technology staff. The obligations are real and enforceable through the contract; the resourcing assumed behind them frequently is not.
The Protective Security Policy Framework governs how Commonwealth information is valued, marked and protected across governance, information, personnel and physical domains. For a supplier the operative requirement is usually handling: recognising which material carries a classification, marking it consistently, and stopping it from being forwarded, downloaded or shared beyond its intended audience. Microsoft Purview sensitivity labels, data loss prevention policies and tenant-level external sharing restrictions are the mechanism, and they work only if the label taxonomy matches the markings your contract actually uses.
The Information Security Manual, maintained by the Australian Signals Directorate, supplies the detailed controls sitting beneath those policy requirements — identity and authentication, cryptography, system hardening, event logging, media handling and gateway design among them. Suppliers are ordinarily asked to satisfy the specific controls named in their agreement rather than the entire manual, and the useful work is mapping those named controls onto Microsoft 365 and Azure features, implementing them, and recording which capability satisfies which control reference.
Contracts increasingly name a maturity level rather than a list of controls, which turns the Essential Eight into a commercial term. Application control, patching of applications and operating systems, Microsoft Office macro restrictions, user application hardening, restricted administrative privileges, multi-factor authentication and regular backups each carry level-specific expectations, and the gap between Maturity Level One and Maturity Level Two is far wider than the numbering suggests. We assess against each control, publish the honest position internally to you, and cost the uplift the contract requires.
IRAP is the Australian Signals Directorate's programme under which endorsed assessors evaluate systems against the Information Security Manual; the Defence Industry Security Program governs businesses working with Defence. Both are frequently invoked loosely in this market. To be explicit: Mycelium 365 does not claim IRAP assessment, DISP membership, security clearances or membership of any Commonwealth procurement panel on this page. We support clients who carry those obligations by building and evidencing the technical controls, and we identify the points at which an accredited or cleared third party is required.
Suppliers several tiers below a prime often discover their obligations only when an onboarding pack arrives. Our defence contractor guidance sets out how the information and communications technology domain is typically evidenced, and the Essential Eight baseline audit is the usual starting point because it establishes the true position before anyone commits to a date in a response.
Because Canberra buyers are rightly sceptical of unverifiable provider claims, the one certification we do hold is stated plainly with its issuer and number so it can be checked. Our own information security management system is certified to ISO/IEC 27001:2022 (QAS International, certificate AIT1045), covering the managed IT, cloud, cybersecurity and helpdesk services we deliver to clients. See our certifications.
A Canberra estate is usually small, heavily collaborative with external parties, and carrying obligations designed for something much larger. That combination rules out both extremes: an unmanaged tenant will fail the first supplier review, and an enterprise security programme will consume the margin on the contract that prompted it. The services below are the proportionate middle.
Tenant, Exchange Online, SharePoint and Teams administration with the external collaboration model designed deliberately — because in this city almost every document has a party outside the organisation attached to it.
A sensitivity label taxonomy matched to the markings your contracts use, with data loss prevention and retention enforcing handling rather than relying on staff remembering a policy.
Conditional access, phishing-resistant authentication, privileged identity management and guest lifecycle governance — the four areas a supplier security review examines first.
Device compliance, application control and update rings configured to the maturity level your agreement names, with the reporting that demonstrates enforcement rather than intent.
Microsoft Defender across endpoint, email and identity with a Huntress-powered managed SOC, and audit logging retained long enough to answer an incident notification question properly.
Workloads deployed into Australian regions with the residency position for each service documented, so a contract schedule is answered from fact rather than from a general assurance.
Tier inclusions are published on our packages page, and organisations wanting the governance question addressed ahead of the technical one usually begin with governance and compliance readiness.
The ACT private sector is unusual in that almost all of it points at one customer. Defence industry, consultancies, peak bodies, research organisations and suppliers of entirely physical services all end up inheriting the same information security expectations, because they all end up in a Commonwealth contract chain.
Businesses subcontracting to defence primes or contracting directly to Defence carry security expectations that are contractual rather than optional, and they cascade several tiers deep. The Defence Industry Security Program sets the framework a member business is assessed against across governance, personnel, physical and information and communications technology domains. Our part is the last of those: hardened Entra ID, managed and compliant devices, controlled handling of technical data, restricted administration and retained logging, with the configuration evidence a security officer needs to complete an assessment. Membership itself is held by your business, not by us, and we do not claim it on our own behalf.
Management consultancies, policy advisers, research houses and professional firms delivering into agencies. The recurring problem is scale mismatch: a contract schedule written with a large systems integrator in mind lands on a firm of twenty people, and the security clauses do not scale down. We translate those clauses into a Microsoft 365 and Azure configuration that is proportionate, then keep the evidence current so each new contract reuses it instead of restarting the exercise.
Peak bodies, advocacy organisations and service providers delivering federally funded programs report to their funder on data handling as well as on outcomes. Budgets are grant-shaped and staff turnover is high, so the answer is Microsoft non-profit licensing where eligible, joiner and leaver processes that actually revoke access, and document structures that survive a funding cycle rather than leaving with the program manager.
Research institutes, clinical trial operators, medical colleges and health advisory bodies concentrated around the ACT's teaching and research institutions. Ethics approvals, participant consent and data retention commitments impose obligations that are separate from, and often stricter than, the security clauses in a commercial contract — and they are enforced by an ethics committee rather than a procurement officer.
Remote delivery by Australian-based engineers, with no ACT premises and no resident staff member — stated plainly because a supplier whose own contracts turn on verifiable claims deserves the same standard from a provider. Attendance in person is arranged and quoted when equipment genuinely requires it. The groupings below reflect how ACT clients cluster and what tends to be true of each.
Consultancies, policy shops, peak bodies and law firms working to Commonwealth contracts from small tenancies. The estate is usually modest and the obligations attached to it are not — a twelve-person consultancy handling agency data inherits controls written for organisations a hundred times its size.
The parliamentary triangle fringe: government relations firms, industry associations, professional services and the advisory businesses that exist because the department is a short walk away. Heavy external collaboration, constant guest access, and correspondence that is frequently in scope for a freedom of information request.
Logistics, printing, secure storage, trades and light industrial suppliers holding government contracts. Warehouse and workshop staff on shared devices, a small back office, and contractual security clauses inherited from work that has nothing obviously to do with information technology.
Town-centre businesses, health and community providers, and cross-border NSW suppliers servicing ACT clients. Queanbeyan operators frequently carry the same Commonwealth contract clauses as their ACT counterparts despite sitting in another jurisdiction.
Every published area is indexed on the locations page, and organisations weighing whether to build an internal capability instead can read our fractional CIO approach.
Clients on a managed plan see up to a 95% reduction in IT support tickets, achieved by eliminating recurring causes — one standard build, enforced updates, clean identity, no configuration drift. In a professional firm billing its time, that reduction is recovered chargeable hours rather than a service statistic.
Our case studies each record the starting position, the change made and what it cost, and our Microsoft Solutions Partner designations are awarded by Microsoft against delivered work rather than self-declared. Anything on this site that we cannot evidence is either qualified or absent, which is the standard your own contracts are held to.
Two write-ups that match the shape of an ACT brief: a security posture rebuilt because a counterparty demanded evidence, and a funded organisation modernised on a constrained budget.
Conditional access, multi-factor authentication and Defender for Endpoint deployed to close the specific gaps a counterparty's assurance questionnaire tested for.
Read the case studyLicensing rationalised, joiner and leaver processes enforced, and reporting to the funding body supported from records that already exist.
Read the case studyThe most productive first conversation in Canberra is not about managed IT at all — it is about the clause that landed with your last contract. Send it through beforehand and an engineer will work through which requirements your tenant already satisfies, which answers would not survive a review, and what the remaining distance costs. No commitment to a maturity level is made on that call that we cannot evidence afterwards. Call +61 1300 116 418 or email sales@mycelium365.com.au.
Book an ACT discovery call