A cyber security control is useful when it works across the systems that matter, not just when it appears on a product list. For a Sydney business using the Essential Eight as its baseline, the practical questions are which devices and accounts are covered, what exceptions remain and how the business can check the result.
The Essential Eight and newer ASD guidance
ASD has published the Essentials guidance. Its official transition FAQ explains that existing Essential Eight investments remain relevant and organisations should not slow or stop already approved uplift work. An Essential Eight maturity level does not automatically convert into an Essentials effectiveness outcome.
Before commissioning an assessment, agree which framework, systems and contractual requirements it will cover. Use ASD’s transition guidance to plan the next steps. The controls below remain a useful way to understand existing Essential Eight work; they are not a substitute for checking the current guidance applicable to your organisation.
Turn each control into a question you can answer
Application control
Can unapproved software run on covered devices? Application control needs maintained rules, a process for legitimate exceptions and testing against the applications people actually use. Buying a tool without assigning responsibility for its rules leaves an important gap. Cyber security services should be scoped around the required outcome and coverage.
Patch applications
Which applications are installed, and how quickly are their security updates applied? An inventory helps identify software outside the normal update process. Check unsupported applications, devices that are often offline and updates that repeatedly fail. Set timeframes against the applicable guidance and risk, rather than assuming a monthly report proves coverage.
Configure Microsoft Office macro settings
Which business processes still need macros? Restrict unnecessary macro use, test the settings and document legitimate exceptions. A blanket change without checking dependencies can interrupt work; an unrestricted exception can leave the original risk in place.
User application hardening
Which unnecessary features can be disabled or restricted in browsers and other applications? Apply the settings appropriate to your environment and check that the policy reaches the intended devices. Record exceptions with an owner and a review date.
Restrict administrative privileges
Who can make administrative changes, and why? Separate everyday work from administrative activity, review supplier access and remove permissions no longer required. Emergency access needs a controlled process too. A list of administrators is a starting point, not proof that their access is appropriately limited.
Patch operating systems
Are covered devices running supported operating systems and receiving security updates? Plan restarts and application testing, and identify equipment that cannot be updated. Unsupported systems need a replacement or other documented risk treatment, not an indefinite exception hidden in an update report.
Multi-factor authentication
Which services and accounts require MFA, and how are recovery and exceptions controlled? MFA reduces the risk from a stolen password but does not make an account immune to phishing, stolen sessions or compromised devices. Choose methods and coverage appropriate to the current requirements.
Duo is a separately scoped add-on at Milnsbridge. Confirm the intended users, applications and authentication methods when discussing an MFA implementation.
Regular backups
What could you restore, how far back could you restore it, and how long would that take? Protect backups against unauthorised change or deletion and test recovery. A successful backup job is not the same as a successful restore.
Agree the acceptable amount of lost work and interruption for each critical system. Then check that the backup and recovery arrangement supports those needs. Keep the service scope explicit rather than assuming every application and cloud account is protected.
Build a working improvement list
Start with the business functions that must keep running. For each, list the relevant systems, current controls, evidence and gaps. Include cloud services and supplier responsibilities explicitly; a device-focused checklist alone may miss important parts of the environment.
- Name the person responsible for each improvement.
- Describe what successful implementation will look like.
- Record affected systems and any approved exceptions.
- Set an achievable delivery date and a method of checking the result.
- Revisit the evidence when systems, staff or requirements change.
Agree the scope before starting
If you already have an Essential Eight improvement programme, review it against current ASD guidance rather than discarding completed work. If a customer, insurer or agreement specifies a particular requirement, confirm how it applies before changing the assessment basis.
For help defining the technical work and responsibilities, talk to Milnsbridge. Start with a clear scope and evidence list.
