Standards
What every employee should know
Our published standard sets out the security awareness topics we believe matter most, drawn from the Australian Signals Directorate’s Essential Eight and ISO/IEC 27001. Everyone covers the Core Baseline, and the roles attackers target hardest add a specialist module on top. Every Layer 8 game is built to it.
Domain matrix
Baseline competencies, plus role-based expansions
The Core Baseline covers the five domains every employee needs. Each variant adds the specialist domains its role is most exposed to. Select a domain to read it.
| Domain | Core Baseline | Finance Variant | HR & Privacy Variant | Executive & Board Variant | IT Variant |
|---|---|---|---|---|---|
| Authentication & Access Control | High | Not covered | Not covered | Not covered | Not covered |
| Threat Recognition & Social Engineering | High | Not covered | Not covered | Not covered | Not covered |
| Device & Software Hygiene | High | Not covered | Not covered | Not covered | Not covered |
| Data Protection & Resiliency | High | Not covered | Not covered | Not covered | Not covered |
| Incident Reporting | High | Not covered | Not covered | Not covered | Not covered |
| Financial Fraud | Basic | High | Not covered | Not covered | Not covered |
| Privacy & Legal | Not covered | Not covered | High | Not covered | Not covered |
| Executive Threats | Not covered | Not covered | Not covered | High | Not covered |
| Vendor Risk | Not covered | Not covered | Not covered | Not covered | High |
The standards
One baseline, four specialisms
Core Baseline
What every employee should know. 5 domains and 21 topics, mapped to ISO/IEC 27001:2022 and the Essential Eight.
- Published
Finance Variant
Core Baseline + Financial Fraud
Business email compromise, altered invoices, payroll scams and the first minutes after a fraudulent transfer.
For finance, payroll and accounts payable
Read the standard - Published
HR & Privacy Variant
Core Baseline + Privacy & Legal
Recruitment fraud, the Privacy Act, internal data spillage and secure offboarding.
For hr, recruitment and legal teams
Read the standard - Published
Executive & Board Variant
Core Baseline + Executive Threats
Cyber governance, deepfake whaling, public-profile and travel risk, and leading through a breach.
For executives, directors and board members
Read the standard - In development
IT Variant
Core Baseline + Vendor Risk
Suppliers, third-party access and the software supply chain.
For it, help desk and system administrators
Map it to your organisation
Tell us which roles you need to cover and what you have to evidence, and we will show you which standard fits each team.
Let’s talk