ACSC Essential Eight
entityOS’s ISO/IEC 27001-certified controls, mapped to the Australian Signals Directorate’s Essential Eight mitigation strategies and their maturity model.
The Essential Eight is the Australian Signals Directorate’s baseline of eight mitigation strategies, measured on a four-level maturity model (ML0–ML3). It is designed to be self-assessed or externally assessed — there is no ISO-style certificate. This page is entityOS’s self-assessment, mapping its ISO/IEC 27001-certified controls to the eight strategies. As an Australian provider with customer data in AWS Sydney, the Essential Eight is a natural fit.
The ASD’s Strategies to Mitigate Cyber Security Incidents rank controls by effectiveness; the top eight are the Essential Eight. The maturity model (last updated November 2023) grades each strategy from Maturity Level Zero to Three. The eight sit under three objectives.
Each Essential Eight strategy, the entityOS controls that deliver it, and our self-assessed maturity level.
| # | Strategy | How entityOS applies it | Maturity |
|---|---|---|---|
| PreventPrevent malware delivery and execution. | |||
| 1 | Application control | Operations endpoints run only approved software; execution of unapproved or malicious programs is blocked. The platform servers run a fixed, hardened kernel with no arbitrary code execution. | ML3 |
| 2 | Patch applications | Vulnerability scanning is continuous and patches are applied within 24 hours — well inside ACSC timeframes; the Web Application Firewall runs the latest control sets. | ML3 |
| 3 | Configure Microsoft Office macro settings | The operating environment contains no Microsoft Office or macro-capable productivity software, so the macro attack surface is eliminated by design; the intent of the control (blocking untrusted macros) is met by absence. | N/A |
| 4 | User application hardening | Operations browsers are hardened with ad-blocking and web filtering; Flash, Java and unneeded features are disabled; the platform servers carry no browser at all. | ML3 |
| LimitLimit the extent of cyber-security incidents. | |||
| 5 | Restrict administrative privileges | Least-privilege by design: privileged access is limited to a few long-tenured, qualified personnel, governed by the CRO with MFA; all 700+ platform methods are role-controlled. | ML3 |
| 6 | Patch operating systems | Operating systems are patched within 24 hours; the AWS-managed infrastructure layer is continuously patched; the fixed kernel keeps change to a minimum. | ML3 |
| 7 | Multi-factor authentication | TOTP/MFA is available on all user access; administrative access requires MFA and optional IP allowlisting, over TLS with perfect forward secrecy. | ML3 |
| RecoverRecover data and system availability. | |||
| 8 | Regular backups | Real-time data-store duplication, daily full backups and daily test-restores via AWS RDS, plus a warm-standby duplicate service; backups have secure, access-controlled storage. | ML3 |
The model defines four levels of maturity, each countering a more capable adversary. entityOS self-assesses at Maturity Level Three across the applicable strategies (Microsoft Office macro settings are not applicable — no such software is present).
Weaknesses in the organisation’s overall cyber-security posture.
Counters opportunistic attackers using common, widely-available techniques.
Counters more focused adversaries willing to invest time to bypass basic controls.
Counters adaptive attackers who tailor techniques to specific weaknesses.
The Essential Eight is a focused baseline; ISO/IEC 27001 is a full management system.