Australian Signals Directorate updated the Essential Eight Maturity Model

Heads up for the hardworking people down in the IT support dungeon - there's an update to the Australian Signals Directorate (ASD)'s Essential Eight Maturity Model. The big change is Maturity Level One now includes a new minimum standard that requires multi-factor authentication to "something users have and something users know, or something users have that is unlocked by something users know or are" and cannot be opt-out. Also in Maturity Level One, Internet Explorer 11 has to be disabled or removed and systems must be patched within 48 hours "when either vulnerabilities are assessed as critical by vendor" as well as when working exploits exist. The ASD's website has the full list of changes to all the Maturity Levels. Thanks TRS-80 for posting this in The Sizzle's Slack group!