The standard every employee is held to.
Core Baseline
Five domains, ordered from the most common technical weakness to the final safety net. Each one sets out what we believe every employee should know, mapped to ISO/IEC 27001 and the ASD Essential Eight.
- Domains
- 5
- Topics
- 21
- ISO 27001 controls
- 11
- Essential Eight strategies supported
- 6
Domain 1
Authentication & Access Control
Securing user identities and preventing account compromise. Leading with this tackles the most common technical vulnerability first.
- 1.1
Password Hygiene
Creating strong passphrases, using password managers, and strictly avoiding password reuse.
- 1.2
Navigating Multi-Factor Authentication (MFA)
Using authenticator apps or hardware tokens securely.
- 1.3
Recognising MFA Fatigue
Not blindly approving unexpected MFA push notifications on your phone.
- 1.4
Administrative Privilege Awareness
Understanding why standard users cannot install software, and the risks of requesting admin rights.
Framework mapping
ISO/IEC 27001:2022
- Annex A 5.17 Authentication Information
- Annex A 5.16 Identity Management
Essential Eight
Directly addresses Multi-Factor Authentication and Restrict Administrative Privileges.
Domain 2
Threat Recognition & Social Engineering
The psychological and deceptive tactics attackers use to get around technical defences, and the habits that beat them.
- 2.1
Phishing & Deceptive Communications
Identifying malicious emails, SMS (smishing) and voice calls (vishing).
- 2.2
Physical Security & Tailgating
Preventing unauthorised physical access to office spaces and workstations.
- 2.3
The Danger of Macros
Understanding how malicious code hides in Office documents, and why corporate policy blocks them.
- 2.4
Verify Before You Act
Pausing on any urgent or unusual request — a payment, a password, a gift card, a change of bank details — and confirming it through a separate, trusted channel, never by replying to the message itself.
- 2.5
Your Digital Footprint
How much attackers learn from public social media and out-of-office replies, and being careful what you share about your role, your systems and your whereabouts.
Framework mapping
ISO/IEC 27001:2022
- Annex A 6.3 Information Security Awareness
- Annex A 7.4 Physical Security Monitoring
Essential Eight
Supports Restrict Microsoft Office Macros by teaching users why they must not bypass macro warnings.
Domain 3
Device & Software Hygiene
Working within a locked-down corporate environment, and understanding the endpoint controls that protect it.
- 3.1
Application Control
Understanding why downloading unapproved software (Shadow IT) or browser extensions is prohibited.
- 3.2
Safe Browsing & Hardening
Recognising dangerous web content, and understanding why certain ads or plugins (like Java and Flash) are disabled.
- 3.3
Secure Remote Work
The risks of public Wi-Fi, the mandatory use of VPNs, and keeping physical control of laptops in transit.
- 3.4
Removable Media & Baiting
Never plugging in an unknown USB drive — a “found” stick in the car park is a classic trap — and only using approved, encrypted media for company data.
Framework mapping
ISO/IEC 27001:2022
- Annex A 8.1 User Endpoint Devices
- Annex A 8.9 Configuration Management
- Annex A 7.10 Storage Media
Essential Eight
Directly supports Application Control and User Application Hardening by explaining the “why” behind the IT restrictions.
Domain 4
Data Protection & Resiliency
Handling sensitive information and keeping the business running.
- 4.1
Data Classification & Handling
Identifying PII and confidential data, and the approved channels for sharing it.
- 4.2
The Role of Backups
How ransomware operates, and why saving files to approved, backed-up network drives rather than local desktops is critical for recovery.
- 4.3
Clear Desk Policy
Securing printed documents and locking screens when walking away.
- 4.4
Using AI Tools Safely
Never pasting confidential information, personal data or source code into public AI tools, using only the AI services your organisation has approved, and treating anything an AI produces as a draft to check rather than a fact.
Framework mapping
ISO/IEC 27001:2022
- Annex A 5.12 Classification of Information
- Annex A 5.10 Acceptable Use of Information
- Annex A 5.24 Information Security Incident Management Planning
Essential Eight
Supports Regular Backups by making sure users store data where the automated backup systems can actually reach it.
Domain 5
Incident Reporting
A no-blame culture for rapid threat containment: the final safety net if the first four domains fail.
- 5.1
Spotting the Indicators
Recognising a compromised account: unexpected lockouts, sluggish performance, rules created in Outlook.
- 5.2
Immediate Action
Knowing the exact steps if a malicious link is clicked: disconnect from Wi-Fi, do not power down, call IT.
- 5.3
Reporting Culture
Understanding that rapid reporting matters more than hiding a mistake.
- 5.4
Recognising a Data Breach
Knowing that a lost laptop, a misdirected email or an exposed spreadsheet is a reportable incident, and escalating it straight away so the business can meet its notification obligations.
Framework mapping
ISO/IEC 27001:2022
- Annex A 6.8 Information Security Event Reporting
Essential Eight
Supports the rapid identification every mitigation strategy depends on to be effective.
Essential Eight
The user behind each control
Technical controls fail when people work around them. These are the Essential Eight strategies the Core Baseline backs up, and where.
Multi-factor authentication
Domain 1 Authentication & Access ControlRestrict administrative privileges
Domain 1 Authentication & Access ControlRestrict Microsoft Office macros
Domain 2 Threat Recognition & Social EngineeringApplication control
Domain 3 Device & Software HygieneUser application hardening
Domain 3 Device & Software HygieneRegular backups
Domain 4 Data Protection & ResiliencyTrain your team to the Core Baseline
Every Layer 8 game maps to these domains. Tell us about your team and we will show you how a session covers them.
Let’s talk