Essential Eight Maturity Level Three Compliance for Australian Federal and State Agencies

This white paper is designed for Australian Federal & State agencies as well as nominated critical infrastructure environments looking to achieve maturity level 2 or 3 compliance within the ASD & ACSC Essential Eight. The Essential Eight has been designed to protect organization’s internet and non-internet-connected information technology platforms and networks. It is a recommended security baseline for government and systems assigned to critical infrastructure. This is a guide focused on the evolving cyberthreat landscape to help agencies and organizations protect against the following:

• Targeted cyber intrusions (advanced persistent threats) and other external adversaries who steal backup data
• Ransomware and external adversaries who destroy backup data and prevent computers/networks from functioning
• Malicious insiders who steal data
• Malicious insiders who destroy backup data and prevent computers/networks from functioning

This is a guide only, built around both Industry best practices and recommendations highlighted by the Australian Signals Directorate and Australian Cyber Security Centre, and will not guarantee data loss or cyberthreats occurring. By implementing the recommendations in this white paper, organizations will significantly increase recovery efforts in the event of a cyberattack for faster return to business continuity. They will be able to remove non-activated dormant threats during recovery operations, as well as reduce the blast radius from a cyberattack.