People ask about the name more than you'd think. Usually it's a quick aside in a scoping meeting, somewhere between the server room and the kitchen: "So, why eight?" The short answer is that eight is how many layers an environment has, from the cables in the comms cupboard to the AI your people are quietly using, and each one has to be sound before the next can stand on it. The longer answer is this article.
Where most businesses start
Nobody plans for their IT to end up in a mess. It happens one sensible decision at a time. A server gets bought for one job and ends up doing six. A site gets connected on whatever the carrier could offer that month. Passwords live in a spreadsheet because the spreadsheet was there. Each choice made sense on the day, and the sum of them is an environment nobody fully understands.
The symptoms are familiar. Fixes take longer than they should, because every fix starts with working out how things are set up. The same problems come back. Small outages turn into long ones because the one person who knows the system is on leave. And the business stops asking IT for things, because asking is slow and the answer is usually "it depends".
That's chaos, in the everyday sense. Not a disaster, just a constant low drag on the work.
The eight steps
Our method is the same for every client, whether they have one site or twelve. It runs in order, from the ground up, because each layer stands on the one below it. At every step we assess what's there, fix what needs fixing, document it and put it under governance before we build on it. Nothing runs on top of cracks.
- Network. The ground everything stands on: switching, firewalls and wireless. We find every unmanaged switch, every default password and every mystery box in the comms cupboard, and we deal with them. Until the network is known and managed, nothing above it can be trusted.
- Devices. Every workstation, laptop and device accounted for, standardised and managed. The odd assortment of hardware that quietly drains support hours is retired, so there's one way of setting up a machine and one way of keeping it current.
- Identity and infrastructure. Servers and cloud, whether Azure, AWS or on premises, and every account that can sign in to them. Legacy accounts go, every identity is current, and multi-factor authentication is on everywhere, with no exceptions. Most break-ins start with a sign-in, so this step closes the front door.
- Data. The pivot point of the whole method. We work out where every critical dataset lives, who can reach it, how an attacker would get to it, and whether it's backed up and provably restorable. Everything after this step exists to protect what we find here.
- Security tooling. An audit of the security tools already in place. Anything outdated, unused or misconfigured is fixed or removed, so you stop paying for shelf-ware and the tools that stay are earning their keep.
- Hardened layers. The premium controls go on: the layers that tightly restrict what can run, who can get in and what gets through. Each one makes you a harder target, and makes an attacker's job progressively more miserable at every step if they try.
- Applications. Your line-of-business applications, how they connect to each other, and whether each is correctly deployed, licensed and secured. These are the systems the business actually runs on, and they're usually the least examined.
- AI. Where AI is already being used in your business, where it's being used without your knowledge, and the risks that's quietly creating. Then a path to use it safely and get ahead with it, rather than a ban nobody follows.
Why the order matters
It's tempting to jump to the interesting steps. Application control is more satisfying than an inventory of switches. But hardening an environment whose network you don't yet control means hardening the parts you know about, and protecting data before every identity is current means protecting it for the wrong people. The early steps are dull on purpose. They're what make the later ones stick.
The order also sets expectations. Every client knows which step they're at, what's been done at each layer and what comes next. Progress is visible, not a feeling, and that's a better answer than "it depends".
What calm looks like
A well-run environment isn't one where nothing goes wrong. Drives still fail and carriers still have bad days. It's one where problems are expected, noticed early and dealt with in a known way, so they stay small. People get help quickly from someone who already knows their setup. Frameworks come and go, and whichever one your clients or insurers ask about, the Essential Eight included, the fundamentals underneath are already in place. And nobody has to think about any of it very much, which is the point.
That's where the name comes from. Eight steps, in order, from chaos to calm. If you'd like to know which step your environment is on, book a scoping meeting and we'll tell you.
