Essentials for Enterprise IT: How we evolved the Essential Eight and lived to tell the tale

The Essential Eight has been the backbone of Australian cyber security guidance for years. So naturally, we decided to break it down and rebuild it from the ground up. This session takes you behind the curtain on the journey from eight prescriptive mitigation strategies to a principles-based framework designed for modern enterprise environments - and all the chaos that came with it.

You'll hear how we convinced a room full of subject matter experts that their favourite controls weren't being removed, they were being "elevated to principles" (it took several meetings). How we introduced protect surfaces as a concept and spent three workshops debating whether identity was one surface or five. How we designed a sequencing model that doesn't use the word "maturity" and then spent two months explaining to stakeholders why it's not a maturity model. And how a framework built on the premise of technology agnosticism was nearly derailed by a disagreement over whether a particular diagram needed a fourth shade of blue.

This talk covers the genuine design decisions behind the evolution - why we moved from controls to principles, how protect surfaces change the way organisations prioritise investment, what sequencing actually means when you're staring at a budget submission, and why the hardest part of framework development isn't the security architecture. It's the PowerPoint.