Essential Eight cyber security, managed end to end

The Essential Eight means eight specific security controls the Australian Signals Directorate recommends every organisation implement: application control, patching applications, restricting Office macros, hardening user applications, restricting administrative privileges, patching operating systems, multi-factor authentication and regular backups. They are grouped as “essential” because together they block the attack methods ASD sees most often in real incidents. Each control is implemented to one of three maturity levels, so doing the Essential Eight always means doing all eight to a stated level — not picking the convenient ones.

The Essential Eight is Australia’s baseline cyber security framework, written by the Australian Signals Directorate for Australian conditions and published free on cyber.gov.au. It is mandated for non-corporate Commonwealth entities, and it is the reference standard in defence supply chains and for larger customers assessing their vendors. Few cyber insurance policies name it, but the questions on an insurance application — multi-factor authentication, backups, patching, admin rights — are the same ground the Essential Eight covers. ASD has since published the Essentials series, which it describes as the evolution of the Essential Eight rather than its replacement — see the next question.

No — and ASD has now said so in its own words. In its Annual Cyber Threat Report 2025–26, published in October 2026, the Australian Signals Directorate describes releasing the Essentials series as “the evolution of ASD’s Essential Eight into a broader, principles-based approach”, and states plainly that “ASD’s Essential Eight remains effective in preventing cyber security incidents”. The Essentials series is built on Principles, Actions and Domains rather than maturity levels, with three chapters covering enterprise IT, operational technology and cloud. Both frameworks are published on cyber.gov.au today. On work already done, ASD is explicit: the evolved framework “does not discard that work. Indeed, this investment can be carried forward by organisations as part of implementing the Essentials.” It adds that it “will continue to engage with stakeholders on the transitional arrangements into 2027”. No deprecation or retirement date has been published; reporting after the June 2026 announcement quoted an ACSC official suggesting roughly twelve months to deprecation and twenty-four to retirement, but that is secondary reporting rather than an ASD date, and you should treat it as such. The reason for the change is structural: the Essential Eight was written in 2017 for on-premises, Windows-centred networks, and its controls do not map cleanly onto cloud and SaaS environments where responsibility is shared with the provider. In practice: if a contract, an insurer or a tender asks for Essential Eight Maturity Level 1, 2 or 3 today, that is still the requirement, and the work you have already paid for carries forward. Call 1800 456 567 if you want to know what the transition means for your business.

For private businesses the Essential Eight is not legislated, but it is rapidly becoming unavoidable in practice: government and defence supply chains (including DISP) expect it, larger customers increasingly require evidence of it from their vendors, and a cyber insurance application asks about the same controls under different names. For non-corporate Commonwealth entities, Essential Eight implementation is mandated under government policy. Otaris aligns Adelaide businesses to the framework and provides the evidence. Call 1800 456 567.

Maturity Level 1 means all eight controls are implemented well enough to stop opportunistic attacks using commodity tools — application control, prompt patching, macro restrictions, application hardening, restricted admin privileges, multi-factor authentication and tested backups. It is the sensible baseline for most Australian businesses, and the level Otaris Fortress starts at.

With Otaris it is part of the plan, not a project. Fortress at Essential Eight Level 1 is $139 per user per month, Level 2 is $179 and Level 3 is $219, published openly. There's no separate compliance project fee: the controls are implemented and maintained as part of managed IT. Call 1800 456 567 if you'd like to talk it through.

The Australian Signals Directorate (ASD), through the Australian Cyber Security Centre (ACSC) — the Australian Government's technical authority on cyber security. The full framework and its maturity model are public on cyber.gov.au, so you can verify everything a provider tells you against the standard itself.

Start with an assessment against each of the eight controls. Otaris runs this as the free Essential Eight Cyber Security Scorecard — a plain-English review of your environment that scores your business against the framework and gives you a clear maturity level and a prioritised fix list. Call 1800 456 567 or book it online.

Identity and access management is controlling who can sign in to a business's systems, what they can reach once they are in, and how that access is removed when they leave. It covers multi-factor authentication, conditional access, administrator privileges and account lifecycle. Otaris manages this for Adelaide businesses, including two of the Australian Government's Essential Eight strategies. Call 1800 456 567 to review your setup.

No. A code texted to a phone can be talked out of somebody by a convincing caller, or lifted by porting their number to a new SIM. Phishing-resistant methods cannot be intercepted that way, even by an attacker holding your password and a plausible story. The Essential Eight asks for phishing-resistant MFA at Maturity Level 2; Otaris includes it in every plan.

Because whatever the account can do, an attacker who reaches that person can do too. If someone works all day as an administrator, a single successful phishing email hands over the ability to change everything. Otaris removes standing admin rights, approves the few programs that genuinely need elevation, and keeps administrator accounts separate with no mailbox or browsing — so the account that can change everything never opens an attachment.

It should be removed the same day, across every system rather than just the email account — which is where most businesses come unstuck, because access accumulates over years in tools nobody has written down. Otaris manages the leaver process as part of your plan, so accounts, licences and access are closed off together and you stop paying for them.

It means the password alone is never enough. Your Microsoft 365 only opens on computers and phones that have been enrolled and are known to us, so a laptop nobody has registered or a personal phone outside Company Portal does not get in — even with the correct password and the correct code. A stolen password is not enough, and neither is a stolen phone number.

Through dark web monitoring. Billions of passwords from breached websites change hands every year and people reuse passwords between work and everything else, so a leak from an unrelated site becomes your problem. Otaris watches those markets for credentials tied to your business and tells you when something appears, so it can be changed before anybody tries it.

The Essential Eight Cyber Security Scorecard is Otaris's plain-English assessment of how well your business is protected, measured against the Australian Government's Essential Eight framework. It shows your current maturity level (M1–M3) and a prioritised list of gaps to close. To get yours, call 1800 456 567.

You check it through a security assessment that reviews your systems, controls and practices against recognised standards, then produces a score and a list of priorities. It is a straightforward way to see your risks without guesswork. Otaris runs the Essential Eight Cyber Security Scorecard for Adelaide businesses and explains the results in plain language. To get started, call 1800 456 567.

Your score shows how strong your current security is and where the biggest gaps are, such as missing multi-factor authentication, poor patching or weak backups. It gives you a clear, prioritised list of what to fix first rather than a vague sense of risk. Otaris maps your score to the Essential Eight and helps you improve it step by step.

Yes. A cyber security assessment is one of the most cost-effective steps a small business can take, because it identifies real risks before attackers do and focuses your spending where it matters. Guessing at security usually means paying for the wrong things or leaving gaps. Otaris offers the Essential Eight Cyber Security Scorecard to give you clarity. Call 1800 456 567 to book one.

Most businesses should reassess at least annually, and after any major change like new systems, staff growth or a security incident, because threats and your environment both keep evolving. A score is a snapshot, so regular checks keep it meaningful. Otaris monitors your security continuously and reviews your Essential Eight Cyber Security Scorecard over time so improvements stick. Call 1800 456 567 to set a schedule.

It is part of the plan, not a project. Otaris Fortress is $139 per user per month at Essential Eight Level 1, $179 at Level 2 and $219 at Level 3, with a five-user minimum — published, not quoted. Level 1 is the full Essential Eight and is where most Australian businesses should sit; the levels above it exist for defence, government and critical-infrastructure requirements rather than for extra peace of mind. Call 1800 456 567 if you would rather talk it through.

Round-the-clock monitoring means threats are detected and stopped before they cause damage, even overnight or on weekends when no one is watching your screens. Otaris watches your systems continuously for unusual activity, failed logins and known attack patterns, then responds straight away. The result is fewer incidents reaching your team and far less chance of a breach going unnoticed.

Disconnect affected devices from the network, stop using compromised accounts, and contact your IT and security provider immediately so the attack can be contained. Do not pay any ransom before getting expert advice. Otaris helps businesses respond, isolate the threat, recover from clean backups and review what happened to prevent it recurring. Call 1800 456 567 for urgent help.

Yes. A managed cyber security provider helps you meet obligations like the Privacy Act, industry regulations and client security requirements by putting the right controls, documentation and reporting in place. Otaris aligns your security to the Australian Essential Eight, monitors your environment continuously and gives you evidence of your security posture. To map your obligations, call 1800 456 567.