Two weeks to the board.
Six to DISP renewal.
Mira runs risk & compliance at a 280-person engineering firm with four branches. This is what one quarter looks like on Cybereen, told through one of her quarters. Essential Eight is the framework. The story is the product.
Mira and the engineering firm in this walkthrough are a composite of real customer patterns — not a single named customer. Every screen reflects real platform behaviour; the people and timestamps are representative.
four branches
plain English
ready Thursday
Two weeks to the board.
Six to DISP renewal.
Mira opens last quarter's spreadsheet.
Half the branches haven't filled it in. The other half used different criteria. This is the part the platform demos always skip.
Last updated 14 December.
Brisbane partially filled. Sydney blank.
Darwin: "Mike to send through".
Melbourne: different version of the criteria.
Mike out til Wed
6 wks ←
Same data. Same evidence. Same audit trail. Just visible, finally.
First time she's seen the whole group on one screen.
Three branches at 93%+. One branch at 40%. The variance was always there. It just wasn't visible.
- Group score: 82% — held down by one outlier, not several.
- Darwin is at 39.67% with an active alert. Last activity: 35 minutes ago. The data is current.
- Mira didn't send anyone a request. Every branch has been assessing in Cybereen this quarter.
From "we have gaps" to "these specific four things, in plain English."
Darwin's MFA-1 control. Three boxes ticked, four to go. Same control at Sydney shows what done looks like.
- Each missing criterion reads like a sentence an auditor would write — not a CVE, not a technical scan.
- Sydney's completed criteria carry a "who, what, when" trail. Cybereen calls it "Completed by — on —". The audit calls it evidence.
- Eight gapped controls across the group. Each one has an owner field ready to populate.
Board pack, Friday morning. Five days early.
One PDF: current state, gap analysis, remediation plan. The auditor and the board read from the same document. So does the DISP application.
- Two clicks: Compliance Summary for the board, Remediation Report for the auditor.
- Maturity radar shows current vs target. The board reads the gap shape in three seconds.
- CSV export sits next to the PDF — for teams running their own analytics pipelines.
"Five days ahead of the board. I haven't been five days ahead of anything in years."
— Representative quote · Head of Risk & Compliance, AU engineering firm · illustrative compositeClient Portfolio
Multi-client overview — triage at a glance, drill into any client from here.
Multi-Factor Authentication — Maturity Level 1
- MFA is used by an organisation's users if they authenticate to their organisation's internet-facing services.— Branch IT Lead · 12 Mar 2026
- MFA is used by an organisation's users if they authenticate to third-party internet-facing services that process, store or communicate their organisation's non-sensitive data.— Branch IT Lead · 12 Mar 2026
- MFA is used by an organisation's users if they authenticate to a third-party internet-facing service that process, store or communicate their organisation's sensitive data.— Branch IT Lead · 14 Mar 2026
- MFA is used to authenticate users to their organisation's online customer services that process, store or communicate their organisation's sensitive customer data.
- MFA uses either: something users have and something users know, or something users have that is unlocked by something users know or are.
- Successful and unsuccessful MFA events are centrally logged.
- Event logs are protected from unauthorised modification and deletion.
Multi-Factor Authentication — Maturity Level 3
- MFA is used by an organisation's users if they authenticate to their organisation's internet-facing services.— Sydney IT Lead · 03 Feb 2026
- MFA is used to authenticate users to their organisation's online customer services that process, store or communicate their organisation's sensitive customer data.— Sydney IT Lead · 19 Feb 2026
- MFA uses either: something users have and something users know, or something users have that is unlocked by something users know or are.— Sydney IT Lead · 22 Feb 2026
- MFA is phishing-resistant.— Sydney IT Lead · 04 Mar 2026
- Successful and unsuccessful MFA events are centrally logged.— Sydney IT Lead · 04 Mar 2026
- Event logs are protected from unauthorised modification and deletion.— Sydney IT Lead · 11 Mar 2026
- Event logs are analysed in a timely manner to detect cyber security events.— SOC · 17 May 2026
Compliance Status Summary
ACSC Essential Eight · Perfect Ashlar Group · target ML1
Maturity Levels Radar
Current vs target across 8 controls (ML 0–3)
Criteria Progress
Completed vs remaining per strategy
Remediation Report — 8 open · all assignable now
| Code | Control | Branch | Target ML | Priority | Owner |
|---|---|---|---|---|---|
| MFA-1 | Multi-Factor Authentication | Darwin | ML1 | P1 | Unassigned |
| PATCH-OS | Patch Operating Systems | Darwin | ML1 | P1 | Branch IT Lead |
| USR-APP | User Application Hardening | Darwin | ML1 | P2 | Unassigned |
| ADMIN-PR | Restrict Admin Privileges | Darwin | ML1 | P2 | Unassigned |
| BACKUP | Regular Backups | Melbourne | ML2 | P3 | S. Park |
The work is done.
On time. Defensible.
If your quarter looks more like Act 1, the next quarter doesn't have to. Book a guided walkthrough on your own data — we'll bring the questions, you bring the spreadsheet.
Or read the Essential Eight overview · 8 strategies, 4 maturity levels, what auditors actually want