Cyber Security & Compliance
Essential Eight compliance
The Australian Signals Directorate's Essential Eight is the framework most Australian boards, insurers and accreditors now measure security against. Knowing your maturity level is the starting point.
What the Essential Eight is
The Essential Eight is a set of eight mitigation strategies published by the Australian Signals Directorate as part of its Strategies to Mitigate Cyber Security Incidents. Each is assessed across maturity levels, so the question is not whether you comply but where you sit.
- Application control
- Patch applications
- Configure Microsoft Office macro settings
- User application hardening
- Restrict administrative privileges
- Patch operating systems
- Multi-factor authentication
- Regular backups
How we run it
We map your current maturity against each of the eight during the audit, then issue a remediation plan sequenced by risk and by what your environment can absorb without disrupting trade or care. Posture is re-mapped and reported quarterly, so the position is current rather than a point-in-time snapshot that ages badly.
The reason this matters commercially: an insurer or accreditor asking about your security position wants a document, not an opinion. Having a mapped posture and a dated remediation plan is frequently the difference between a straightforward renewal and a difficult one.
Being straight about maturity levels
Full Maturity Level Three across all eight controls is a significant program and is not the right target for every organisation. Pushing application control to its strictest setting in a club running legacy gaming integrations, or on shared clinical workstations, can break things that matter more than the control gains.
We will tell you which controls are worth pushing hard in your environment and which are worth holding at a lower level with a documented reason. A framework applied without judgement is how organisations end up with both poor security and poor usability.
Common questions
Is the Essential Eight mandatory for us?
It is mandatory for non-corporate Commonwealth entities. For private clubs, practices and care providers it is not legally mandated, but it has become the de facto benchmark that insurers, accreditors and boards use — which makes it the most useful yardstick available.
How long does an uplift take?
The initial mapping is part of the audit. Meaningful movement on the highest-risk controls typically happens inside the first ninety days; the rest is sequenced into the roadmap.
Related
Book a Technology Review.
One to two hours onsite, across support, cyber posture, backup and recovery, infrastructure, Microsoft 365 and where the organisation is heading. You receive a written findings report within five days — prioritised risks, quick wins and gaps, in writing.
$1,500 including GST. Credited in full against your engagement if you proceed.
The report is yours to keep regardless of what you decide to do next.
The 90-day guarantee. Give us 90 days. If you're not satisfied with our service in that time, cancel and we'll refund our fees. You keep the audit, the report and every improvement we've made. Third-party hardware, licences and subscriptions purchased on your behalf are excluded. Full terms