GRCOPILOT Insights

Insights, guidance and product updates on cybersecurity, GRC and compliance.

The Essential Eight assessment: what an assessor actually checks
Audit

The Essential Eight assessment: what an assessor actually checks

Assessors test rather than take your word for it. How the assessment works, the evidence that satisfies each strategy, the sampling that catches partial coverage, and how to prepare without inflating your rating.
Essential Eight vs ISO 27001: which one does your organisation need?
Comparisons

Essential Eight vs ISO 27001: which one does your organisation need?

One is eight prescriptive technical controls with fixed timeframes; the other is a management system across a scope you define. What each proves, where they overlap, and why Australian organisations increasingly need both.
Application control: the hardest of the Essential Eight, and how to get it done
Australia & APAC

Application control: the hardest of the Essential Eight, and how to get it done

Application control blocks more Essential Eight programmes than any other strategy. Why discovery is the real project, what the requirement actually says, and a sequence that reaches enforcement without breaking the business.
Who must comply with the Essential Eight in Australia?
Australia & APAC

Who must comply with the Essential Eight in Australia?

Where the Essential Eight is legally mandated, where it arrives through procurement and contracts, and how it interacts with the SOCI Act and the Privacy Act for organisations that are not government.
Essential Eight Maturity Level Two: what changes from Level One
Australia & APAC

Essential Eight Maturity Level Two: what changes from Level One

Level Two adds tighter patch windows, MFA for privileged users, application control on internet-facing servers, real hardening of Office and browsers, and centralised logging. The delta, and what it costs.
Essential Eight Maturity Level Three: the requirements and what they demand
Australia & APAC

Essential Eight Maturity Level Three: the requirements and what they demand

Phishing-resistant MFA, just-in-time administration, application control everywhere, macros restricted to sandboxed or signed execution, and logs an intruder cannot edit. What Level Three really asks.
Essential Eight Maturity Level One: the requirements, strategy by strategy
Australia & APAC

Essential Eight Maturity Level One: the requirements, strategy by strategy

What Level One actually asks for across all eight mitigation strategies, the requirements most often missed, and the evidence an assessor will want to see.
Essential Eight Maturity Level Zero: what it means and how to get out of it
Australia & APAC

Essential Eight Maturity Level Zero: what it means and how to get out of it

Level Zero is not a starting grade, it is a finding. What puts an organisation there, why a single unmet requirement is enough, and the shortest defensible route to Level One.
The Essential Eight Maturity Model: a complete guide
Frameworks

The Essential Eight Maturity Model: a complete guide

What the eight mitigation strategies are, how the four maturity levels differ, why your rating is the lowest level you achieve across all eight, and how to plan an uplift that survives assessment.
Mapping ISO 27001 to NIS2: what carries over and what does not
Comparisons

Mapping ISO 27001 to NIS2: what carries over and what does not

A measure-by-measure crosswalk from ISO 27001:2022 Annex A to the ten NIS2 minimum measures, plus the four obligations certification will never give you.
EU AI Act compliance checklist
Checklists

EU AI Act compliance checklist

A step-by-step checklist: inventory your AI systems, fix your role, classify by risk tier, then work the requirements that attach. Includes the staged application dates and the obligations that already bite.
GDPR security controls: what Article 32 actually requires
EU & UK

GDPR security controls: what Article 32 actually requires

GDPR names only four measures and then hands you a risk test. What appropriate technical and organisational measures mean in practice, the controls regulators look for, and the evidence that survives a breach investigation.
© 2026 GRCOPILOT