Cyber Resilience

The ACSC Essential 8 — what it actually means

Eight mitigation strategies, three maturity levels each. For most Australian SMBs, hitting Maturity Level 1 across all 8 is the realistic 6-month target and prevents the vast majority of opportunistic attacks. The 8 controls:

• Application control — only approved software runs on endpoints
• Patch applications — automated patching with documented SLAs
• Configure Microsoft Office macro settings — disable by default, allowlist exceptions
• User application hardening — disable Java, Flash, ads in browsers; restrict PowerShell
• Restrict administrative privileges — least-privilege, separate admin accounts
• Patch operating systems — automated OS patching with monitoring
• Multi-factor authentication — MFA on email, remote access, privileged accounts
• Regular backups — automated, tested, offline copies, ransomware-resistant

Our engagement model

Phase 1 — Gap assessment (1–2 weeks)

We assess your current state against Essential 8 Maturity Level 1. Output: a written gap report with prioritised remediation, effort and cost estimates per gap, and a recommended phasing plan. You own the report regardless of whether you proceed with the remediation phase.

Phase 2 — Prioritised hardening (4–12 weeks)

We work through the gaps in priority order. Highest-leverage wins for most SMBs: MFA rollout (often the single biggest risk reducer), patch automation, backup verification, and admin-account separation. We do the implementation work alongside your existing IT support — we don't replace them.

Phase 3 — Ongoing review (quarterly)

Quarterly review against Essential 8, an annual tabletop incident drill, and updates as ACSC guidance changes. This is optional and many clients run it internally after our initial engagement.

What we don't sell

We're not a product reseller — we don't take vendor margin on security tooling. Our revenue is engineering time, not licence kickbacks. When we recommend tools, we recommend the cheapest thing that meets the requirement (often that's the Microsoft 365 Business Premium licences you already pay for, properly configured).