Tools that implement Essential Eight controls and produce assessment evidence, with a focus on open-source and self-hosted options: vulnerability scanning for patch cadences, central logging for ML2, immutable backups for ML3, and GRC tracking with ASD's OSCAL profiles.
Which open-source tools cover Essential Eight strategies that are not built into the operating system (vulnerability scanning, central logging, MFA, backups and GRC tracking), with their licenses and edition limits.
Meeting the Essential Eight's daily, weekly and fortnightly scanning and asset discovery requirements: what must be scanned how often, and how open-source and Microsoft scanners cover applications, operating systems, drivers and firmware.
Choosing the central log platform ML2 depends on: which events it must receive, protecting logs from modification, timely analysis, and how self-hosted options such as Wazuh, OpenSearch and Graylog compare on licensing and retention features.
Designing backups that meet ML2 and ML3 access rules, where even backup administrators cannot modify or delete backups during retention: retention controls, integrity checks, encryption and restore testing in self-hosted tools.
Using ASD's machine-readable ISM baseline profiles for ML1 to ML3 in a GRC tool: what the profiles contain, how levels nest, self-hosted GRC options and their edition limits, and continuous monitoring after an assessment.
Tell us what you're working on, whether it's a deployment, an audit, a security test or a cyber range. You'll speak with an engineer who can help you scope it.