It all comes down to understanding what’s in-scope and what’s out-of-scope in terms of the Essential Eight when public service leaders are assessing their cybersecurity posture.