How does OptiTech help with the Essential Eight?

Quick answer

The Essential Eight is almost entirely machine-verifiable, which makes it a showcase for continuous checks: MFA coverage and admin-privilege restriction from your identity provider, patch status with the ACSC's actual clocks (48 hours for exploited, internet-facing vulnerabilities), macro and hardening settings from Intune or Jamf, application control state from endpoint tools, and backup performance and restoration testing from your infrastructure. Each strategy tracks against your target maturity level, scored as strictly as the ACSC assesses.

Maturity levels without self-deception

The Essential Eight's strict scoring (partial implementation drops you a level) is enforced by measuring rather than asserting: the dashboard shows per-strategy maturity computed from check results across your fleet, so "we're ML2 on MFA" means every in-scope access path verified, not most of them. Gaps that would drop a level surface as findings with owners, prioritized by which strategy and level they cost you.

The patch clocks, taken literally

The framework's sharpest requirement is patch timing: exploited vulnerabilities in internet-facing services within 48 hours, others on defined schedules by criticality. OptiTech runs these as clocked findings: a qualifying vulnerability opens with its deadline attached, routes to the owning team in their tracker, and escalates as the clock runs. The closure history becomes your assessment evidence that the clocks are met in practice, not just in policy.

Assessment and flow-down

For a formal assessment (government mandate or customer requirement), the assessor samples per-strategy evidence with timestamps through scoped access, and the maturity claims reconcile against a year of check history. If the Essential Eight reached you through an Australian government contract, the same posture answers the questionnaire; if you flow it down to your own vendors, the supplier register sends the questions. Cross-mapping feeds the same evidence into CIS v8.1, ISO 27001, and CPS 234 where Australian financial customers ask in that vocabulary.