Australia: Essential Eight and Privacy Act

Essential Eight is a maturity scale, not a certificate

The Essential Eight is published by the Australian Cyber Security Centre and covers application control, patching applications, configuring Microsoft Office macro settings, user application hardening, restricting administrative privileges, patching operating systems, multi-factor authentication and regular backups.

The important structural point is that each is assessed at a maturity level from zero to three, and you are expected to achieve the same level across all eight rather than excelling at some and ignoring others. Saying you "do the Essential Eight" is not an answer to an Australian buyer. The answer they want is a maturity level, and increasingly evidence of it.

It is mandatory for Australian federal government entities and widely used as the yardstick in the private sector. For an overseas supplier it usually appears as a questionnaire rather than an audit, but the questions are specific enough that vague answers are visible.

How it relates to what you already hold

If you hold ISO 27001 or Cyber Essentials, you are doing most of these activities. The gap is almost never whether you patch, it is whether you can evidence the specific maturity characteristics, particularly the patching timeframes, which are tighter than many organisations run.

Application control is the one genuinely additional item for most. It means allowing only approved executables to run, which is a substantial piece of engineering and operational work in a Windows estate, and it is where maturity level ambitions usually stall.

Nothing in the Essential Eight addresses privacy, governance, supplier risk or incident response beyond the technical. It is not a substitute for a management system and Australian enterprise buyers increasingly ask for both.

The Privacy Act and the notifiable breach scheme

The Privacy Act and its thirteen Australian Privacy Principles apply to organisations above a turnover threshold, and to some sectors regardless of size. If you offer goods or services in Australia and handle personal information, assume you are in scope until you have confirmed otherwise.

The principles will feel familiar from GDPR: open and transparent management, notification at collection, use limitation, direct marketing controls, cross-border disclosure, quality, security, access and correction. The framing differs in that the emphasis sits on collection and disclosure rather than on lawful basis.

The Notifiable Data Breaches scheme is the operational item. Where you suspect an eligible breach you have thirty days to assess whether it is one, and where it is you must notify the regulator and affected individuals as soon as practicable. Thirty days to assess is more generous than the European clock, and the trap is that the assessment is expected to be a genuine investigation rather than a holding position.

Cross-border disclosure carries an accountability consequence worth noting. If you disclose personal information overseas, you generally remain accountable for the recipient handling it consistently with the principles, which is closer to an outsourcing liability than to a transfer mechanism.

When the critical infrastructure law reaches you

The Security of Critical Infrastructure Act covers a broad set of sectors including energy, communications, data storage and processing, financial services, health, higher education, food and grocery, transport and water. Responsible entities must maintain a critical infrastructure risk management programme and report cyber incidents on short timelines.

For an overseas supplier the relevance is indirect but real. If your customer is a responsible entity, their obligations flow into their supplier assurance, and data storage or processing providers can find themselves directly in scope rather than merely adjacent to it. Ask the question during contracting rather than discovering it during an incident.

A practical entry plan

Establish your Essential Eight maturity honestly before a buyer asks, because the questionnaire is specific and an inflated answer is discoverable. If application control is the blocker, say so and give a date.

Map your existing privacy programme to the thirteen principles rather than assuming GDPR compliance carries over. It largely does, but collection notices and the cross-border accountability position usually need specific attention.

Confirm whether any customer is a responsible entity under the critical infrastructure regime, and whether your service falls into a covered category in its own right.