Essential Eight for HR and payroll data

The strategies, as listed in Essential Eight explained, are: patch applications, patch operating systems, multi-factor authentication, restrict administrative privileges, application control, restrict macros in office documents, user application hardening, and regular backups.

The Essential Eight maturity model defines four levels, Maturity Level Zero to Maturity Level Three. ASD advises reaching the same level across all eight strategies before moving to a higher one. No independent certification is required unless a government directive, regulator or contract asks for an assessment.

ASD describes Maturity Level Zero as weaknesses that could allow data to be compromised. Level One addresses attackers looking for any victim with common weaknesses. Level Two addresses attackers who invest more time, including phishing for credentials and getting around weak multi-factor authentication. Level Three addresses more adaptive attackers. Payroll teams are often targeted by phishing, so plan to move towards Level Two once Level One is in place.

• Patch office software, browsers, email clients and PDF software within two weeks of a patch’s release.
• Patch operating systems on internet-facing servers within 48 hours when critical or exploited, and on workstations within one month.
• Use multi-factor authentication for your own and third-party online services that process, store or communicate sensitive data. A cloud payroll or HR system holding employee data falls in this category.
• Back up data, applications and settings in line with business criticality, keep backups secure and resilient, and test restoration in disaster recovery exercises.

The maturity model lists the full requirements for each level. Smaller employers usually meet them through their IT provider and their software suppliers’ settings, so ask both to confirm in writing which controls are in place.

In payroll redirection, a scammer poses as an employee, usually by email, and asks payroll to change the account their pay goes to. ASD’s business email compromise guidance recommends a clear, consistent process to verify requests for payment and sensitive information, and keeping HR and finance staff contact details out of public view. Warning signs include an unexpected change of bank details, urgency, and an email address that doesn’t look quite right.

1. Accept bank detail changes only through a self-service portal protected by multi-factor authentication, or a signed form confirmed by phone.
2. Call the employee on the number already on file, never a number given in the request.
3. Tell the employee at their existing contact details that a change has been made.
4. Have a second person approve bank changes made close to a pay run.
5. Before each pay run, review a report of bank details changed since the last one.

A compromised payroll or email account often exposes personal information as well as money. Under the Notifiable Data Breaches scheme, if serious harm is likely you must notify the OAIC and affected employees. The steps and exemptions are in employee records: privacy and security.

Pair the technical controls with organisational ones: role-based access, a retention and destruction schedule, staff training and a breach response plan. If staff use AI tools with employee data, apply the same account controls; see using AI assistants with HR data. For what records you must keep, see employer record-keeping obligations.