Application control

Workstations only run an approved set of applications
Users cannot execute files from downloads, temp folders or email attachments
You would know if an unapproved executable ran somewhere

Patch applications

Internet-facing services are patched within two weeks of a fix, faster when an exploit is public
Browsers, Office, PDF readers and mail clients update automatically
Applications the vendor no longer supports have been removed

Office macro settings

Macros are disabled for staff with no business need for them
Macros in files that arrived from the internet are blocked
Users cannot change macro security settings themselves

User application hardening

Browsers do not process Java or other legacy active content from the internet
Web advertisements are blocked or constrained on managed devices
Users cannot unwind browser and Office security settings

Restrict administrative privileges

Admin access is requested, justified and revalidated over time
Privileged accounts never browse the web or read email
Admins use separate privileged accounts, not their daily account

Patch operating systems

OS patches land within two weeks on internet-facing systems, within days when exploited
Workstation and server patching is automated and its coverage is tracked
No unsupported operating systems remain in the fleet

Multi-factor authentication

MFA is enforced on all remote access and email, with no legacy sign-in paths around it
MFA covers the third-party services that hold your data
MFA is enforced on privileged and administrative access

Regular backups

Backups run on a schedule matched to how much data you can afford to lose
Restores are tested by actually performing them
Backup copies cannot be modified or deleted with stolen admin credentials

Self-check reading

Tick what is true today.

ReadingEarly

Application control: 3 of 3 open
Ransomware and commodity malware arrive as executables users were able to run. Allow-listing what runs is the single strongest control on this list.
Patch applications: 3 of 3 open
Most compromises use vulnerabilities with patches already available. The window between patch release and exploitation keeps shrinking.
Office macro settings: 3 of 3 open
Macro-laden documents remain a reliable initial-access technique because one permissive setting undoes the control for the whole business.
User application hardening: 3 of 3 open
Hardening removes the features attackers use and users do not. It costs little and quietly closes several delivery paths at once.
Restrict administrative privileges: 3 of 3 open
An attacker who lands on a machine with admin rights skips half the work. Privilege separation is what turns a bad day into a contained one.
Patch operating systems: 3 of 3 open
Unpatched and end-of-life systems are where intrusions persist. Tracking coverage matters as much as the patching itself.
Multi-factor authentication: 3 of 3 open
Credential theft is the most common way in. MFA that leaves one legacy protocol or one SaaS tool uncovered is a control with a hole in it.
Regular backups: 3 of 3 open
Ransomware operators delete reachable backups before they encrypt. A backup that has never been restored, or that an admin account can erase, is a hope rather than a control.

A reading, not a maturity level. Assessed maturity requires sighted evidence and tested controls across every workstation, server and account, which is engagement work.

What this does, and what it deliberately does not.

This check asks three questions per strategy and reads your answers the way an assessor would read a first conversation. It does not sight evidence, test controls, or assign a maturity level. It tells you where the gaps most likely are.

Read alongside

Want the evidence-based version of this exercise?

Australia-wide, from our Brisbane head office. Someone will contact you as soon as possible.

Open a brief info@blackshard.com.au

Essential Eight self-check.