Essential Eight is a prioritised set of mitigation strategies developed by the Australian Cyber Security Centre (ACSC) to protect organisations from cyber threats. While not legally mandatory for all businesses, it's required for Australian Government entities and is increasingly expected by cyber insurers. The eight strategies include application control, patch applications, configure Microsoft Office macros, user application hardening, restrict administrative privileges, patch operating systems, multi-factor authentication, and regular backups.

Strong cyber security posture and compliance certifications like ISO 27001 and Essential Eight implementation can significantly reduce cyber insurance premiums in Australia while increasing coverage limits. Insurers assess your security controls, incident response capabilities, and compliance status when determining premiums. Organisations with robust security frameworks typically receive better rates and more comprehensive coverage.

APRA CPS 234 is the Information Security standard from the Australian Prudential Regulation Authority that applies to APRA-regulated entities including banks, insurers, and superannuation funds. It requires organisations to maintain information security capability commensurate with their size, complexity, and risks. Key requirements include board accountability, robust information security controls, incident management, and testing of security controls.