Australian Essential
Eight Field Guide
A practical guide we're putting together for Australian organisations - drawing on public ACSC guidance, industry incident data, and our own engagement experience. Plain-English, vendor-neutral, and focused on what moves the needle. Register your interest and we'll send it when it's ready.
- The two or three Essential Eight controls most organisations get stuck on
- Business Email Compromise: still the most common initial vector
- What a realistic uplift roadmap looks like (and what it costs)
- The human factor: why people remain the primary target
- Where to start if you're a small team with a big mandate
From the Founder
BEC remains the most common initial access vector in Australian incidents. We break down why it persists, what defenders get wrong, and how to reduce your exposure.
After years of guidance, most Australian organisations still struggle with the same two or three Essential Eight controls. RTCS shares what we see most often, and how to fix it.
The decisions made in the first two days of a ransomware incident determine the outcome. Based on our incident response engagements, here is the playbook that matters.
The Privacy Act amendments are here. RTCS's privacy advisory team walks through the key changes, who they apply to, and the practical steps organisations need to take.
Across red team engagements targeting Australian enterprises and government environments, certain weaknesses appear consistently. Here is what we always find, and what it means for your defences.
Security leaders are increasingly expected to present risk in business terms. Our vCISO practice shares strategies for communicating cyber risk to boards who didn't grow up in security.
Technical Resources
A practical guide to measuring your Essential Eight maturity level across all eight mitigations - with assessment criteria, evidence requirements, and uplift recommendations.
Is your organisation actually ready for a cyber incident? This checklist covers the 40 key indicators of IR readiness - from playbooks and retainers to communications and regulatory obligations.
Zero Trust is widely misunderstood and often mis-sold. This paper explains what it actually means, what a practical adoption roadmap looks like, and the common pitfalls Australian organisations encounter.
A ready-to-use framework for presenting cyber risk to your board - covering what to include, what to leave out, how to express risk in business terms, and sample report structures.
Upcoming & On-Demand
A practical webinar covering the key elements of ransomware preparedness: backups, IR plans, comms, and the decisions that matter most in the first 24 hours.
Request RecordingRTCS's privacy advisory walks through the 2026 Privacy Act changes and what Australian organisations need to do to meet their new obligations.
Request RecordingBreaking down what Maturity Level 3 requires in practice across all eight controls, and the path to achieving it in a real enterprise environment.
Request RecordingGet the RTCS Threat Briefing
Monthly intelligence for Australian security leaders. Short, specific, and worth your inbox.