Cybersecurity frameworks are an excellent starting point for organizations looking to strengthen their defenses against the most common cyber threats and attacks. Among country-specific frameworks designed for simplicity, there are two that stand out for their ease of implementation – Australia’s “Essential Eight”, and the United Kingdom’s “Cyber Essentials”.

In this blog post, we provide an overview of these two frameworks, the specific security controls they focus on, and where to find more information about them.

Essential Eight – Australia

What is Essential Eight?

The “Essential Eight” is a cybersecurity framework developed by the Australian Cyber Security Centre (ACSC). The eight strategies that constitute the framework cover the minimum essential controls that organizations should implement to stay protected from cyber threats. They include the following:

• Patch applications
• Patch operating systems
• Multi-factor authentication
• Restrict administrative privileges
• Application control
• Restrict Microsoft Office macros
• User application hardening and
• Regular backups

Implementing the Essential Eight strategies is mandatory for all Non-Corporate Commonwealth Entities (NCCEs) in Australia. These are Department of State, executive or statutory agencies under the direct policy control of the Australian Government.

For more information about the Essential Eight, click here: Essential Eight Explained

Essential Eight Maturity Model

The Essential Eight Strategies are broken down into multiple sub-controls and maturity levels under each strategy that can be implemented step-by-step by organizations based on their specific requirements and capacity.

The Maturity Model was developed to enable organizations of any size, and at any level of cybersecurity maturity, to use the Essential Eight strategies effectively.

There are three maturity levels in the maturity model.

• Maturity Level One can be used by small to medium sized enterprises
• Maturity Level Two can be used by large enterprises
• Maturity Level Three applies to critical infrastructure entities or organizations exposed to high cybersecurity risk

The ACSC recommends implementing the Essential Eight controls in a staged manner, starting with basic Level One controls and slowly progressing to higher levels. This enables organizations to properly assess the effectiveness of specific controls and take the time to adjust to changes before building up to more complex strategies.  

Learn more about the Essential Eight Maturity Model here: Maturity Model

Compliance assessments for the Essential Eight framework are conducted using the Maturity Model.

Cyber Essentials – United Kingdom

What are the UK’s Cyber Essentials?

The United Kingdom’s Cyber Essentials scheme has been designed to help organizations “guard against the most common cyber threats” and demonstrate that they follow cybersecurity best practices by getting certified. The scheme covers simple security controls to strengthen defences against a wide range of attacks. Getting a Cyber Essentials certification is not mandatory for all but is required if an organization would like to bid for Central Government contracts.

There are five major groups of security controls included in the Cyber Essentials –

• Firewalls and Routers – Secure your internet connection
• Software Updates – Keep your devices and software up to date
• Malware Protection – Protect against viruses and other malware
• Access Control – Control access to your data and services
• Secure Configuration – Secure your devices and software

Evaluating Cyber Essentials Implementation

Organizations can get an idea about which of the Cyber Essentials controls they have in place, and what more they can do to meet all requirements by answering a few simple questions here: Cyber Essentials Readiness Toolkit. By answering all the questions in the assessment, they can generate a detailed action plan with a list of recommendations. This self-assessment is a free resource provided by the IASME Consortium.

To get an official Cyber Essentials certification, sign up here: Cyber Essentials Certification

Compliance Tracking and Security Gap Assessment with CYRISMA

CYRISMA recently extended its popular Compliance Tracking capability to include the Essential Eight, Cyber Essentials and SOC 2. This will enable our partners and customers in Australia and the UK to easily track compliance with these frameworks, and find gaps between their existing security controls and what is recommended.

In addition to the three new frameworks mentioned above, the CYRISMA Compliance Tracker includes the CIS Critical Controls, the NIST Cybersecurity Framework, HIPAA and PCI DSS.

Implement Security Controls to fill Compliance Gaps

CYRISMA combines all essential cyber risk management capabilities in a single platform. These include Vulnerability and Patch Management, Sensitive Data Discovery and Data Protection, Secure Configuration Scanning, Network Discovery, Dark Web Monitoring, Risk Quantification, Active Directory Monitoring, Risk Mitigation, Complete Cyber Risk Assessment, and more.

With the ability to implement a wide range of essential security controls using the platform, organizations can both find compliance gaps using the tracker and also take steps to fill many of these gaps by running scans and mitigating risk from within scan results.

Watch a three-minute demo of the CYRISMA Platform