Home / Trace / Essential Eight
MyRISK Trace · Essential Eight decisions
A maturity score says where you got to. It does not say why you stopped there.
Most organisations running the Essential Eight can produce a current maturity assessment. Far fewer can produce the decision behind a gap — who accepted a control at level one rather than two, on what reasoning, for how long, and whether the conditions attached to that acceptance were ever met.
Why it surfaces now
The assessment is the easy half
An Essential Eight assessment is a point-in-time measurement, and there are competent tools and assessors for it. What no assessment holds is the governance around the gaps it finds: the exception that was approved, the compensating control that was accepted instead, the legacy system that could not be patched and the trade-off somebody made about it.
Those are decisions, not control states — and a decision is the thing a board, an auditor or an incident review asks you to justify after the fact.
Where it bites first
Six decisions worth being able to replay
01
A target maturity decision
Why this level was chosen for this mitigation, against what risk assessment, and by whom.
02
A control exception
An exclusion from application control or macro settings, the reasoning, the expiry, and who approved it.
03
A patching deferral
A patch window missed for an operational reason. Sound at the time, and usually recorded only as a ticket.
04
A legacy system acceptance
A system that cannot meet a mitigation, the compensating controls accepted instead, and the review date attached.
05
A supplier or managed-service gap
What was verified about a provider's own mitigations, and what was taken on assurance rather than evidence.
06
An incident decision trail
When a control gap contributed to an incident, what was known about that gap beforehand and who had accepted it.
The assessment tells you the state. The record tells you the reasoning, the authority and the conditions — which is the half that has to survive being questioned.
What a replay produces
The evidence as it stood, not as it reads now
A Trace record preserves what existed at the time and the policy version that applied, the rationale and the alternatives considered, who held authority and what exactly was approved, the conditions and their expiry, and whether anything has changed since that unsettles the approval. Corrections are append-only and never overwrite the snapshot.
Two different jobs
The assessment is one job. The record of what you decided about it is another.
MyRISK does both, and they are separate engagements because they answer separate questions. Buying the wrong one first is the common mistake.
Core
The assessment and the control record
Controls, evidence, owners and reporting mapped once against the mitigations and reused everywhere they are asked for — so your maturity position is held rather than rebuilt for each request.
Trace
The decisions around the gaps
Why a control sits at the level it does, who accepted that, what conditions were attached and whether anything has changed since.
Most organisations need both eventually and one of them first. Which one depends on whether your problem is the position or the reasoning behind it.
The boundaries, in writing
What this is not
Read this before taking it further
- Trace is not an Essential Eight assessment, scanner or uplift service. It does not measure your maturity and does not change it — it holds the record of decisions taken around it. MyRISK Core does the assessment side, and the two are different jobs.
- Not a compliance claim of any kind. Whether your position satisfies an obligation is your assessment and your assessor's, not a MyRISK claim.
- Not affiliated with or endorsed by the ACSC. The Essential Eight is named here because it is what the decisions are about.
- Not a replacement for the tooling that produces the assessment. Trace sits after it, on the governance the assessment surfaces.
Which control gap would be hardest to justify if it were exploited tomorrow?
Bring that one. The Diagnostic compares your current reconstruction with a Trace-style replay — fixed scope, fixed price, one decision class first.