Lion Cipher Lab
Assess an organization against the ACSC Essential Eight Maturity Model
- GRC / Compliance
- Intermediate
- ~60 min
- Free · no account required
Why it matters
The Essential Eight is one of the most widely used security baselines in the world, mandatory for many Australian government entities and adopted voluntarily by organizations far beyond Australia, so being able to run an Essential Eight self-assessment is a directly employable GRC skill. But the reason it is worth an hour of a learner's time goes deeper than the checklist: the E8 teaches a way of thinking that a plain hygiene list does not. It is a MATURITY MODEL, and its central, easily-missed idea is that you do not aim for 'the highest score' -- you choose a TARGET maturity level based on…
What you'll learn
- explaining what the Essential Eight is and who publishes it -- the Australian Signals Directorate's Australian Cyber Security Centre (ACSC) -- and that it is a prioritized subset of ASD's 'Strategies to Mitigate Cyber Security Incidents'
- defining all eight mitigation strategies in plain words: application control, patch applications, configure Microsoft Office macro settings, user application hardening, restrict administrative privileges, patch operating systems, multi-factor authentication, and regular backups
- understanding the four Maturity Levels (0, 1, 2, 3) and the key principle that they map to increasing ADVERSARY TRADECRAFT -- so you pick a TARGET level from your threat and risk, not from your size or budget
- rating a real (here fictional) organization's CURRENT maturity per strategy 0-3 against concrete evidence, and being honest enough to rate down
- building a gap register (current level vs target level per strategy) and a prioritized remediation roadmap that honours the PACKAGE principle -- raise all eight together, never max one while another sits at zero
- the judgment: when an org should reach for the Essential Eight versus NIST CSF, CIS Controls or ISO 27001, and how to hold them together with a crosswalk mindset
- the honest negative: the E8 is Microsoft-Windows-and-internet-connected-network centric, does not map cleanly to cloud/SaaS/OT/macOS, mitigates but does not guarantee prevention, and its maturity model measures consistent implementation, not a score to game
Steps in this lab
- What the Essential Eight is, and who stands behind it
- The eight mitigation strategies, in plain words
- The four maturity levels, and the principle that they track adversary tradecraft
- The package principle: raise all eight together, never max one
- Meet the organization you will assess: Coralstone Legal
- Set the target level, then rate current maturity for each strategy
- Build the gap register
- Prioritize the roadmap with the package principle
- The honest negative: where the Essential Eight stops, and when to reach for something else