Essential Eight
for Websites & Web Platforms
The Essential Eight is ASD’s recommended cyber security baseline. We review how your websites, member portals and the servers behind them measure up, and fix the gaps.
- Aligned to ASD’s Maturity Model
- Patching, MFA & Backups
- Board-Ready Reporting
Over a decade of website security expertise
What the Essential Eight Is
The Essential Eight is the Australian Signals Directorate’s baseline set of mitigation strategies: patch applications, patch operating systems, multi-factor authentication, restrict administrative privileges, application control, restrict Microsoft Office macros, user application hardening and regular backups.
ASD’s Essential Eight Maturity Model, last updated in November 2023, defines Maturity Levels One to Three, with Level Zero meaning weaknesses that leave an organisation open to compromise. Commonwealth agencies are expected to implement it, and boards and cyber insurers increasingly ask about it.
Most Essential Eight work focuses on laptops and office networks. Websites, member portals and the servers behind them are often left out, even though they’re internet-facing and hold personal information.
The Essential
Eight, Applied to
Your Web
Platforms
The Essential Eight, Applied
to Your Web Platforms
The Essential Eight, Applied
to Your Web Platforms
Five of the eight strategies apply directly to websites and web applications. Patch applications means your CMS, plugins, extensions and frameworks, not just Windows. Patch operating systems covers the servers and PHP versions underneath. Multi-factor authentication and restricted administrative privileges apply to every admin, hosting and developer login. Regular backups means off-site, tested and restorable.
We review your web platforms against those strategies, map where you sit on the maturity model, give you a prioritised plan to lift it, and then do the work. End-of-life platforms are often the biggest blocker, because they can’t be patched at all.
Our review is aligned to ASD’s published maturity model. It is technical evidence for your board, not a certification.
Why Start
With Your
Web Platforms
Why Start With
Your Web Platforms
Why Start With
Your Web Platforms
Internet-Facing by Design
Websites and portals are exposed to the whole internet around the clock, so unpatched plugins and weak admin logins are found fast.
Where Personal Data Lives
Member, donor and customer records often sit behind the website, making it the highest-impact system to get right.
Often Out of Scope
Many Essential Eight programs cover desktops and Microsoft 365 only. We cover the web layer they miss.
Mitigation Strategies in the Essential Eight
Apply Directly to Websites and Web Apps
Cybercrime Reports to ASD in 2024–25
Minutes Between Cybercrime Reports, on Average
How It Works
We confirm your websites, portals, servers and hosting, and give you a fixed price.
Step 2: Essential Eight
Web Review
We assess patching, MFA, admin privileges, backups and hardening across your web platforms.
Step 3: Maturity Plan
& Uplift
You get your current position and a prioritised uplift plan, and we can carry out the work.
Brands We Have Helped
What People Say
Makes the Magic Happen
“Love the professional finishes . Dustin and the team know how to make the magic happen.”
Sam Hunter
Corporate Headshot Photographer
Always Shows Up
“I have hired Pixelbird many times to build websites and to host. I recommend Dustin and his team without question.”
Kym Bolger
Social Media Marketing
Responsive Professionalism
“Dustin is friendly and good to work with. He is good at finding better ways to provide solutions and automate the processes.”
Ivan Huang
CPA
What You Can Expect
Strategy
What We Check on the Web Layer
Common Gap
Patch Applications
With Us
CMS, plugins, extensions and frameworks up to date
With Them
Plugins months or years behind
Patch Operating Systems
With Us
Server OS and PHP versions supported
With Them
End-of-life PHP still running
Multi-Factor Authentication
With Us
MFA on CMS, hosting, DNS and developer accounts
With Them
Password-only admin logins
Admin Privileges
With Us
Least-privilege roles, old accounts removed
With Them
Everyone is an administrator
Regular Backups
With Us
Off-site, isolated and restore-tested
With Them
Backups on the same server
Application Control
With Us
Only approved code can run on servers
With Them
Writable, executable upload folders
User Application Hardening
With Us
Security headers and script controls on sites
With Them
Unknown third-party scripts
End-of-Life Platforms
With Us
Unsupported CMS versions identified
With Them
Platforms that can’t be patched at all
Logging & Monitoring
With Us
Admin, file and access events logged
With Them
No record of who changed what
Reporting
With Us
Maturity position for your board
With Them
A list of vulnerabilities only
Frequently Asked Questions
What is the Essential Eight?
A set of eight mitigation strategies published by the Australian Signals Directorate as a baseline for protecting internet-connected networks, supported by a maturity model with levels from Zero to Three.
Is the Essential Eight mandatory for us?
Commonwealth agencies are expected to implement it. For most other organisations it isn’t mandatory, but it is widely used as a benchmark for reasonable cyber security, including by boards and insurers.
Do you certify Essential Eight compliance?
No. ASD publishes the maturity model and an assessment process guide, and there is no certificate. We give you an independent technical view of your web platforms against the model and help you lift your maturity.
Does the Essential Eight apply to websites?
It was designed for internet-connected networks, and most strategies apply directly to websites and their servers: patching, multi-factor authentication, admin privileges, backups and hardening.
What maturity level should we aim for?
The right target depends on the threats you face and the data you hold. Many organisations aim for Maturity Level Two. We’ll help you pick a realistic target and get there.