Essential Eight
A self-assessment of PezPC's own environment against the ACSC maturity model, plus what PezNet the software contributes to yours. No external audit has been performed and no assessor has signed anything off.
Two things make this framework easy to misrepresent, and both are handled explicitly below. First, most of the eight are properties of the environment software is deployed into rather than of the software itself, so each strategy states PezPC's own position and, separately, what PezNet gives you towards yours. Second, the maturity levels are not a score to average: the ACSC's model grades each strategy from Zero to Three, where Zero simply means the Level One requirements are not fully met, and it asks organisations to reach the same level across all eight before climbing. That makes an overall level equal to the weakest strategy, which is why ours is what it is.
This expands one row of the standards table in the main privacy policy. The standard itself is published by its own authority: ACSC maturity model.
Overall: Maturity Level Zero, not audited
That reads worse than it is, so here is exactly what it means. The ACSC asks organisations to reach the same level across all eight strategies before climbing, so an overall figure is the weakest strategy rather than an average of them. Five of the eight sit at Level Zero and two already meet Level One, with one not applicable. Application control is not implemented at all, and the two patching strategies fall short on the scanning cadence the model specifies rather than on whether patches get applied. Level One is what the ACSC suggests is generally suitable for a small to medium business, and it is what we would target.
Preventing malware delivery and execution
| 1 | Application control | Level Zero |
PezPC does not operate application allowlisting on its own servers, so this strategy sits at Level Zero and is what caps the overall figure. For your install it is a property of the operating system, configured by whoever administers it: PezNet installs as an ordinary service and neither implements nor interferes with allowlisting.
Next level: Level One would require application control on workstations, restricting execution to an approved set and preventing it from user profile and temporary folders.
|
| 2 | Patch applications | Level Zero |
PezPC applies patches to the software it runs, and pins forward off known-vulnerable dependencies when advisories land. What is missing is the cadence the model actually specifies: there is no vulnerability scanner running daily against internet-facing services and no automated asset discovery, so this is Level Zero on the letter of the requirement rather than on the spirit of it. PezNet helps you here: an install checks for releases daily and can apply one without a manual download, though it never forces the update.
Next level: Level One would require a vulnerability scanner run at least daily against internet-facing services and at least weekly against browsers, office suites, email and PDF software; patches applied within two weeks, or within 48 hours where an exploit exists.
|
| 3 | Configure Microsoft Office macro settings | Not applicable | PezPC does not run Microsoft Office macros in its production environment, and PezNet neither processes, generates nor opens them. Exported spreadsheets are plain data with no macro content. There is no macro surface to harden on either side. |
| 4 | User application hardening | Level Zero |
On PezPC's side this is largely unassessed: browser and endpoint hardening is not centrally enforced. On the product side PezNet does real work towards yours, serving a Content Security Policy that forbids inline script so page behaviour lives in separate modules, and marking cookies HttpOnly and, over HTTPS, Secure. Hardening the browsers your staff use to reach it remains yours.
Next level: Level One would require browsers configured not to process Java or web advertisements from the internet, with those settings not user-changeable, and Internet Explorer 11 disabled or removed.
|
Limiting the extent of incidents
| 5 | Restrict administrative privileges | Level One |
The strongest of the eight on both sides. PezPC grants portal administrator rights as a single explicit flag, never inherited, and publishes every screen it unlocks. PezNet ships a flat least-privilege permission model with no super-user that bypasses it, no impersonation feature, no support login and no vendor back door; rights are granted per group and can be denied per user. The gap against the model is process rather than capability: privileged access is not re-validated on a defined cycle.
Next level: Level Two would require privileged access to be automatically disabled after twelve months unless revalidated, and after 45 days of inactivity, with privileged activity centrally logged.
|
| 6 | Patch operating systems | Level Zero |
PezPC patches the operating systems of its own servers, but without the scanning cadence the model specifies, so the same Level Zero reasoning as patching applications applies. For a self-hosted install this is entirely yours: PezNet does not manage, monitor or report on the host operating system's patch level.
Next level: Level One would require a vulnerability scanner run at least fortnightly against operating systems, patches applied within one month, and within 48 hours for internet-facing services where an exploit exists.
|
| 7 | Multi-factor authentication | Level One |
Available and used on PezPC's portal accounts. PezNet supports it for sign-in, can delegate authentication to an identity provider that enforces it, and goes beyond the strategy by demanding a fresh step-up before any stored credential is revealed, recording the reveal. Enforcing it across all of your users is your configuration decision, and PezNet does not mandate it.
Next level: Level Two would require multi-factor authentication to be phishing-resistant, and to be used by all privileged users and for access to important data repositories, with successful and unsuccessful events centrally logged.
|
Recovering data and system availability
| 8 | Regular backups | Level Zero |
PezPC backs up its database. The shortfall is testing: restoration is not exercised on a documented schedule, which Level One asks for. PezNet makes this easier for you than most software by keeping everything, including attachments and photographs, in one PostgreSQL database, so a consistent backup is a single ordinary dump rather than a coordination problem across services. Taking it, storing it off the server and testing a restore is yours.
Next level: Level One would require backups retained in line with continuity requirements, restoration tested when first implemented and on any infrastructure change, and unprivileged accounts prevented from modifying or deleting backups.
|