Cyber Safe

What this mark certifies

This mark confirms that an organisation has implemented the Australian Cyber Security Centre Essential Eight mitigation strategies to a defined maturity level, verified across the assessed environment. It gives customers and partners a checked assurance of baseline cyber hygiene. It is an independent assessment against a public framework. It is not an Australian Signals Directorate assessment and not a government endorsement.

The certificate records the certified maturity level, so the claim is precise, and the holder must not display a higher level than the one certified. The mark reflects the state of the assessed environment at the point of assessment, and it does not guarantee that the organisation will never experience a cyber incident.

Certification requirements

• The organisation demonstrates implementation of the eight Essential Eight mitigation strategies, being application control, patching of applications, configuration of Microsoft Office macro settings, user application hardening, restriction of administrative privileges, patching of operating systems, multi factor authentication, and regular backups.

• Implementation is demonstrated at Maturity Level One as a minimum across the assessed environment, and the certificate records the maturity level achieved.

• The business holds a current Australian Business Number.

Evidence required

• Documentation and technical evidence for each of the eight mitigation strategies.

• Configuration records for the assessed environment.

• Evidence of testing and of successful backup restoration.

How it is assessed

The environment is assessed against the Essential Eight Maturity Model at the certified maturity level by an approved certifier who holds a recognised information security qualification. The certificate records the certified maturity level and the assessed environment.

Re-verification and monitoring

Certification is valid for twelve months and is subject to annual re-verification, which includes re-testing of the eight mitigation strategies at the certified maturity level.

Grounds for refusal, suspension or revocation

Certification is refused, suspended or revoked where the environment falls below the certified maturity level, or where a material control failure indicates that the certified level is no longer met.

Contractual obligations on the badge holder

In addition to the core terms of the CAQA Certified Licence Agreement in Section 4, a holder of this mark agrees to the following obligations specific to this badge.

1. 1

   The holder must maintain the certified Essential Eight maturity level across the assessed environment throughout the licence term.

2. 2

   The holder must display the mark only at the certified maturity level and must not represent a higher maturity level than the one certified.

3. 3

   The holder must notify CAQA in writing within fourteen days of any material control failure, or of any cyber incident, that reduces the environment below the certified maturity level.

4. 4

   The holder must submit to re-testing at re-verification and must provide technical evidence within ten business days of a request by CAQA.

5. 5

   The holder must not represent that the mark is a government assessment or a guarantee against cyber incidents.

6. 6

   The holder warrants that the technical evidence provided is true and accurately reflects the assessed environment.