blueAPACHE — IT Operations Excellence as a Service: Security Frameworks & Alignment

Security framework alignment is a different category of claim from certification, and this section keeps that distinction explicit.

ASD Essential Eight — Maturity Level 3. The Essential Eight is the Australian Signals Directorate's set of eight prioritised mitigation strategies: application control, patching applications, configuring Microsoft Office macro settings, user application hardening, restricting administrative privileges, patching operating systems, multi-factor authentication, and regular backups. Maturity is graded from Level Zero to Level 3. The Essential Eight is not a certification scheme — organisations self-assess or engage third-party assessors.

APRA CPS 234. The prudential standard for information security applying to APRA-regulated entities, extending to information assets managed by third parties. Accountability remains with the regulated entity when it outsources.

NIST framework. Alignment to the NIST cybersecurity framework.

Uptime Institute. Data centres are certified to Tier III (concurrently maintainable) and Tier IV (fault tolerant).

The practical question in any engagement is which of the Essential Eight strategies the provider operates and which remain yours. blueAPACHE defines that split per engagement rather than leaving it implied — which is the answer worth asking any provider for in writing.