Are they still useful frameworks in terms of people working through a process to get to where they need to get to as opposed to tick the box?

I think they are.

At the heart of them, they focus on know your assets, know the controls protecting those assets and take action to achieve your target.

You can distill a lot of these programs down to those few things.

It's the classic CIA triangle, confidentiality, integrity, availability.

It still works the exact same now as it did back then.

But I think if you pick like essential eight, it's probably getting eroded pretty quickly in terms of the value that each control layer in there brings.

Are there some kind of key things that you thought, if only people knew this, what's your advice? What are the easy things that are not happening that should be?