Essential Eight Assessment

Do you have technical controls in place that actively prevent unauthorised or unapproved software from running on company computers? 

Example: If an employee accidentally clicks a link and downloads a malicious program, your computers automatically block it from opening because it isn’t on your strict "approved" list.

When a critical security update is released for third-party software, is it installed across all company devices within 48 hours?

Example: When Adobe Acrobat or Google Chrome releases an emergency update to fix a security flaw, it gets pushed automatically to everyone's laptop, and nobody is left running a vulnerable version.

Are Microsoft Office macros blocked by default for all employees who do not explicitly need them for their daily roles?

Example: If someone emails your finance team an Excel file containing a hidden, malicious script, your system will automatically stops that script from running in the background.

Are your company's web browsers explicitly configured to block risky features, such as malicious web ads or outdated internet plugins?

Example: Your employees' web browsers are locked down so they can't accidentally install risky browser extensions or get infected by malicious pop-up ads on compromised websites.

Are day-to-day tasks (like checking email and browsing the web) done on "standard" user accounts, with Administrator access strictly limited?

Example: If an employee wants to install a new program or change a critical system setting, they get a pop-up asking for an IT administrator's password instead of being able to do it themselves.

Are all your computer and server operating systems (Windows, macOS, etc.) updated automatically or within 48 hours of a critical security patch being released?

Example: When Windows releases its "Patch Tuesday" security updates, your office PCs and servers are updated within two days, rather than letting staff hit "remind me later" for weeks on end.

Is MFA strictly enforced for all users accessing company email, VPNs, and sensitive business data?

Example: When your staff log into their work email from home or a coffee shop, they are required to enter a code from an MFA Authenticator app on their phone—a password alone isn't enough to get in.

Are your critical business systems and data backed up daily, and are those immutable backups kept isolated so ransomware cannot reach them?

Example: If a hacker encrypts all your office computers with ransomware today, you have a safely disconnected backup (Known as Immutable Backup, i.e, cannot be changed or deleted) from yesterday that the hackers couldn't reach, allowing you to restore operations quickly.