Many businesses think they are immune to cyberattacks since their relative obscurity keeps them safe from cyberattackers. However, according to the Australian Cyber Security Centre (ACSC), in 2022, businesses in Australia reported a cybercrime every seven minutes, with small and medium businesses (SMB) impacted the most with losses averaging $64,000 per report.

SMBs are easy prey since they lack sophisticated cybersecurity protections. However, SMBs that do not have an in-house security expert can start with the Essential Eight Maturity Model. Many cybersecurity experts recommend Essential Eight as a baseline framework that can help organizations protect themselves against the most common cyberthreats.

What is the Essential Eight maturity model?

Essential Eight is part of the ACSC’s prioritized mitigation strategies to help cybersecurity professionals mitigate various cybersecurity incidents, such as cyber intrusions, ransomware, phishing and even malicious insiders.

Even though Essential Eight is a framework designed to enhance security provisions specifically for Microsoft Windows-based internet-connected networks, the strategies and best practices can be applied to cloud services and other operating systems.

Who developed Essential Eight?

Essential Eight was developed by the Australian Cyber Security Centre, a government agency responsible for coordinating cybersecurity efforts across Australia. The ACSC put together the framework based on the Australian Signals Directorate’s (ASD) top four recommendations.

The ACSC originally developed Essential Eight to establish security and operational best practices within governmental departments, agencies, councils and public sector businesses. The guidelines, however, are being adopted by many private businesses since they are a good first step to establishing security controls and setting a foundation for cybersecurity.

When was the Essential Eight released?

The ACSC first published Essential Eight in June 2017. However, the provisions of the framework are updated and refreshed periodically. The most recent updates were made by the ACSC in November 2022.

The main recommendations suggested were:

• To use an automated method of asset discovery at least fortnightly to assist with vulnerability scanning activities.
• To use an up-to-date vulnerability database before conducting vulnerability scanning activities.

There were certain key revisions that were introduced in July 2021 as well.    

• Businesses were asked to achieve a consistent maturity level across all eight mitigation strategies before moving to a higher maturity level.
• A fourth Maturity Level Zero was introduced to broaden the range and scope of maturity levels

Why is Essential Eight important?

In today’s IT landscape, a cyberattack is inevitable and it is only a matter of time before a vulnerability is exploited. With cyberattackers finding innovative ways to infiltrate systems, organizations that adopt the Essential Eight framework have a better chance of thwarting hackers.

Here are a few reasons why Essential Eight is important:

• It protects you against 85% of data breaches.
• It is an effective first step in preventing cyberthieves from stealing your money and data.
• It gives you a clear understanding of your current defense posture.
• It provides you with confidence that your organization is protected using widely accepted mitigation strategies.
• It improves your cybersecurity policies and procedures.
• It ensures compliance with business and industry information security requirements.
• It helps you achieve compliance with industry standards, such as NIST, ISO27001 and PCI.

 Is Essential Eight mandatory?

The framework is mandatory for all 98 non-corporate Commonwealth entities (NCCEs), and all entities must undergo a comprehensive audit every five years. The audits ensure that all NCCEs maintain the highest degree of security control. With the latest revisions, the ACSC has also made it mandatory for all NCCEs to establish compliance across all eight strategies.

Although the framework is not mandatory for other businesses, the best practices of Essential Eight help organizations increase their cybersecurity. The framework should be used as a guideline rather than a strict Essential Eight mandate.

What are the Essential Eight mitigation strategies?

In cybersecurity, there is no one-size-fits-all mitigation strategy. However, organizations are encouraged to implement the eight essential mitigation strategies as a baseline. According to the ACSC, this baseline, known as the Essential Eight, makes it difficult for hackers to compromise systems.

These eight security controls are further divided into three primary objectives:  

Those that avert a malware attack

Those that limit the damage caused by cybersecurity incidents

Strategies that assist in recovering data and provide swifter restoration of the network

Prevent cyberattacks  

1. Application control: Maintaining control over applications to prevent the execution of malicious or unauthorized code, such as executables and scripts. It ensures access is given to applications with valid permissions.

2. Patch applications: Timely implementation of new patches and vulnerability scans to fix any identified vulnerabilities in applications.

3. Configure Microsoft Office macro settings: Disable macros for users that do not require it and only allow vetted macros.

4. Application hardening: Limit or block user applications that regularly interact with content from the web. A prime example would be configuring web browsers to block ads, flash and javascript.

Limit cyberattack impact                          

5. Restrict administrative privileges: The ACSC strongly recommends organizations implement measures such as periodically evaluating privileged access, creating separate attributable accounts and restricting administrative privileges to a select few.            

6. Patch operating systems: Regularly check for newly released patches to prevent the use of unsupported versions. Promptly flag and mitigate vulnerabilities that are of “extreme risk” within 48 hours of discovery.

7. Multifactor authentication: Implement multifactor authentication methods, such as PINs or OTPs, and for enhanced security, you can even include biometrics, codes on authenticator apps or codes in emails.

Data recovery and availability               

8. Regular backups: Regular offline and online backups ensure that critical data is always accessible, even in the event of a cyberattack. It also provides specific proper incident response actions.

What are the Essential Eight maturity levels?

The essential eight framework lists out four maturity levels to help organizations determine the maturity of their cybersecurity approach. It helps identify cyber-risk and plans a mitigation program based on those risks. These maturity levels are defined as follows:

Maturity Level 0

This is the basic default level that every business starts with. Organizations whose cybersecurity posture is weak fall into this category. Their data can be easily compromised by hackers since their security is at its weakest.     

Maturity Level 1

If you are just starting to build a strong cybersecurity stance, achieving Maturity Level 1 requires all Essential Eight strategies to be in place at their most basic maturity level. This ensures your organization is protected against common threats.

Maturity Level 2

Businesses that are already aligned with the Essential Eight best practices but want to implement a stronger risk-reduction strategy and are ready to invest time and money to defend their organization from hackers fall under this category.

Maturity Level 3

Businesses that are fully aligned with the intent of their mitigation strategy fall into this category. These organizations are prepared to meet the challenges of a sophisticated cyberattack that can exploit privileged controls to obtain confidential data.

Meet the Essential Eight Maturity Model requirements with Compliance Manager GRC

Compliance Manager GRC is simple to use and you don’t need to be a compliance expert to manage the specific parameters for the Essential Eight Maturity Model. Pick the Maturity Level and Compliance Manager GRC automatically loads the specific requirements and controls you need to implement to be in compliance. Best of all, you can also track everything that’s in scope for your IT operation at the same time, and on the same dashboard, regardless of source.

It also allows you to use all your current IT security tools, software and systems to meet the requirements of The Essential Eight Cybersecurity Maturity Model while you maintain compliance with all your other IT requirements, regardless of source.

The built-in Standard Management Template allows you to quickly determine whether you can “check the boxes” for every requirement, identifies the gaps and automatically prepares all of the documents you need for compliance. Request a demo.