Black Shard’s own estate assessed at Essential Eight Maturity Level 3 across all eight strategies
Measured against live evidence from the systems we run every day, it is the top of the ASD maturity model and the standard our assessments rate clients against.
On this page
The result
The ASD model reads overall maturity as the lowest level reached across all eight, so Level 3 means no strategy sits below it.
- Application control
- Patch applications
- Configure Microsoft Office macro settings
- User application hardening
- Restrict administrative privileges
- Patch operating systems
- Multi-factor authentication
- Regular backups
What Level 3 asks for
Maturity Level 3 is aimed at adversaries who adapt their methods, rely less on public tools and will invest in targeting a specific organisation. It asks for faster patching, tighter application control and stronger administrative separation.
How we run our estate
Phishing-resistant multi-factor authentication on every account, with just-in-time administrative access. Application control and attack surface reduction enforced on managed devices.
Central security monitoring of every system we run, with immutable log retention. Immutable off-site backups, restore-tested every day.
Who it is for
Councils, agencies and regulated firms that hand us their systems or their data can ask for the assessment and its evidence before they engage us, and read it against the level they hold their own suppliers to.
Kept current
Every strategy has a check that runs daily against the system that enforces it, and the assessment is reviewed on a set cycle and on any material change.
The assessment we sell
We run the same assessment for clients: all eight strategies rated against the ASD maturity model, with a written report and an uplift plan sequenced by risk and effort.
