Cybersecurity built into your technology.

The Australian Government's baseline for blocking ransomware and common threats. Built on strict, non-bypassable controls enforced by your technology, rather than policies people are expected to follow.

What is the Essential Eight?

The baseline. Not the whole answer.

The Essential Eight is a cybersecurity framework developed by the Australian Government to block common threats like ransomware. It assumes people will sometimes make the wrong security decision, then removes the decision from their hands. But compliance and security are not the same thing. We use the Essential Eight as the baseline, then identify the strategic gaps and the controls your business needs on top to actually be secure, sequenced around the compliance, cost and AI pressure you are facing.

The eight controls Application, operating system, identity and backup.

Application

Application Control Patch Applications Configure Office Macros

Operating System

User Application Hardening Patch Operating Systems Restrict Admin Privileges

Identity & Backup

Multi-Factor Authentication Daily Backups

Maturity levels Three tiers, scaled to your environment and risk appetite.

Level 1

Basic protections

Foundational risk reduction against opportunistic, untargeted attacks.

Level 2

Stronger hardening

Resists targeted attacks. The mandated baseline for federal departments and many insurers.

Level 3

Robust controls

Suitable for high-risk environments facing sophisticated, well-resourced adversaries.

Why it matters

Compliance is shifting from intent to evidence.

Boards, regulators, and insurers want proof that controls are working, not assurances that they exist.

85% of known threats stop here

Attackers target the basics. Implemented well, the Essential Eight blocks the overwhelming majority of common attack patterns.

Insurers and boards want proof

Cyber insurance renewals and board oversight increasingly require evidence of maturity, not policy documents.

Regulation has changed shape

Expectations are moving from intent to comply, to documented evidence of control. Audits now look for proof.

People need protection from people

Your team will occasionally make the wrong call. Technical controls remove that risk before it reaches a decision.

Our approach

Pragmatism over perfection, intent over checklist.

We listen before we prescribe, understanding your pain points, goals, and constraints first
We translate complex security into practical business outcomes
We focus on what delivers the biggest impact first, not what fills the longest report
We make sure you understand the why behind every recommendation
We align to the intent of the Essential Eight, not just the checklist
We build controls that are achievable, scalable, and sustainable for your team

How Cornerstone helps

We start with you, not the controls.

Whether you're starting from zero or maturing existing controls, we tailor an approach that aligns to the intent of the Essential Eight. Our role is to make maturity achievable, relevant, scalable, and sustainable, so you're not just passing a test, you're actually more secure.

Outcome Essential Eight maturity goals achieved in a way that makes you a safer, more efficient organisation. You leave with confident decisions, not another report.

Your senior advisor

Shaun Struik

Director · Co-Founder

"We don't start with the controls. We start with you, then build security that fits how your business actually runs."

Every engagement, shaped around you

Tailored to your environment and risk appetite Delivered with precision and care Customised outcomes you can actually run

Let's chat

Align your roadmap to the business pressure behind it.

book a Cyber Essentials Health Check.

Emailinfo@cornerstonecyber.com.au

Webcornerstonecyber.com.au

OfficeWellington Point, QLD