The Essential Eight is the most widely referenced cyber security baseline in Australia, yet it is also one of the most misunderstood. Many organisations believe they have “done” the Essential Eight when in reality they have implemented two or three controls partially. This guide explains, in plain English, what the eight strategies actually are, how the maturity model works and how an Australian organisation should approach implementation without drowning in jargon.
What the Essential Eight is, and what it is not
The Essential Eight is a set of eight mitigation strategies published by the Australian Cyber Security Centre (ACSC), part of the Australian Signals Directorate (ASD). It distils decades of incident response experience into a prioritised baseline that prevents the most common attacks, limits the damage when prevention fails, and aids recovery. It grew out of the older “Strategies to Mitigate Cyber Security Incidents” and represents the controls the ACSC considers the most effective starting point for almost any organisation.
Crucially, the Essential Eight is a technical baseline, not a complete security program. It does not address governance, security culture, physical security, personnel vetting, supply chain risk or the detail of incident response. Those belong to broader frameworks. The most successful approach we see in practice treats the Essential Eight as the technical core sitting inside a wider risk-based program aligned to the ISO 27001 information security standard or the ACSC’s own Information Security Manual.
The eight strategies in plain English
The eight strategies fall into three broad goals: preventing malware from running, limiting the extent of an attack, and recovering data. Here is what each one actually means.
1. Application control
Application control restricts which executables, software libraries, scripts, installers and other code are allowed to run on your systems. The idea is simple but powerful: if only approved programs can execute, malware and unapproved tools cannot run, even if a user is tricked into downloading them. This is often the hardest control to implement well because it requires understanding exactly what your environment legitimately needs to run.
2. Patch applications
Attackers routinely exploit known vulnerabilities in software such as web browsers, office suites, PDF readers and other internet-facing or commonly used applications. Patching applications means applying security updates promptly, with the most critical and internet-facing applications patched within tight timeframes, and removing software that is no longer supported by the vendor.
3. Configure Microsoft Office macro settings
Macros are small programs embedded in Office documents, and they remain a favourite delivery mechanism for malware arriving via email. Hardening macro settings means disabling macros for users who do not need them, only allowing macros from trusted locations or that are digitally signed by a trusted publisher, and blocking macros originating from the internet.
4. User application hardening
This strategy reduces the attack surface of the applications your users run every day. In practice it includes configuring web browsers to block or disable risky features such as Flash, ads and Java from the internet, and hardening Microsoft Office and PDF readers so they cannot be abused to launch attacks. Web advertising and untrusted content are common infection vectors, so closing these doors matters.
5. Restrict administrative privileges
Administrative accounts are the keys to the kingdom. Restricting administrative privileges means granting them only to people who genuinely need them, validating that need regularly, and preventing privileged accounts from reading email or browsing the web, which is how those accounts are most often compromised. Privileged access should be separated from day-to-day user accounts.
6. Patch operating systems
The same logic as patching applications applies to operating systems on workstations, servers and network devices. Known operating system vulnerabilities are patched within defined timeframes based on severity, and operating systems that vendors no longer support are replaced. Unsupported operating systems are a recurring finding in the assessments we conduct.
7. Multi-factor authentication
Multi-factor authentication (MFA) requires more than just a password, typically something the user has, such as an authenticator app or hardware token. MFA is one of the single most effective controls against account compromise and credential theft. The maturity model expects MFA across remote access, privileged actions and access to important or sensitive data repositories, with stronger, phishing-resistant methods required at higher levels.
8. Regular backups
Backups are your last line of defence, particularly against ransomware. The strategy requires regular backups of important data, software and configuration settings, retained according to business needs, stored so they cannot be modified or deleted by an attacker, and, critically, tested through restoration. A backup that has never been test-restored is a hope, not a control.
How the maturity levels work
The Essential Eight Maturity Model defines four levels. Maturity Level Zero indicates significant weaknesses in an organisation’s posture. The three substantive levels are calibrated against the increasing capability of adversaries:
- Maturity Level One targets adversaries using widely available, commodity tradecraft to gain access, typically opportunistic and untargeted attacks.
- Maturity Level Two targets adversaries willing to invest more effort and use more capable tradecraft, including better-resourced phishing and credential theft.
- Maturity Level Three targets adversaries who are more adaptive and far less reliant on public tools, investing time to evade detection and defeat specific targets.
The model is designed to be implemented as a set. The ACSC’s guidance is that organisations should reach the same maturity level across all eight strategies before progressing any single strategy to a higher level, because attackers will exploit the weakest link. Reaching Level Three in patching while sitting at Level Zero in application control leaves an obvious gap. If you are new to the model, our guide to Maturity Level One is the right place to begin.
Is it mandatory? The Australian compliance picture
Whether the Essential Eight is mandatory depends entirely on who you are. For most non-corporate Commonwealth entities it is mandatory under the Protective Security Policy Framework, which directs them to implement the Essential Eight. State governments increasingly mandate it through their own cyber security policies, and it frequently appears as a contractual requirement when supplying to government.
For local government and the private sector it is generally a strong recommendation rather than a legal obligation, though regulated sectors face their own overlapping requirements. APRA-regulated financial entities, for example, must meet CPS 234 information security obligations, and the Essential Eight maps cleanly onto many of those expectations. In our experience advising councils and agencies, the Essential Eight has become the de facto baseline that buyers, insurers and boards expect to see, regardless of strict legal status. Councils in particular should review our guidance on cyber security for Australian government and councils.
How to approach implementation
The most common mistake is treating the Essential Eight as eight independent IT projects. It is an integrated control set, and the order in which you tackle it matters. A practical sequence we recommend:
- Assess honestly. Establish your real current maturity against Level One for all eight strategies. Self-assessments tend to be optimistic, so test the controls rather than assuming they work.
- Bank the quick wins. MFA, disciplined patching and tested backups usually deliver the fastest, largest risk reduction and are achievable without major disruption.
- Tackle the hard controls deliberately. Application control and restricting administrative privileges take more planning and change management. Phase them in to avoid breaking the business.
- Document and assign ownership. Every strategy needs a named owner, a target maturity level and a review cadence.
- Measure and re-test. Maturity drifts. Configurations change, exceptions accumulate and new systems appear, so reassess regularly.
Where to get help
Implementing the Essential Eight well is as much about disciplined operations as it is about technology. Organisations that struggle usually lack senior security ownership rather than tools. A virtual CISO can provide that ownership, set a realistic uplift roadmap and keep the program honest over time. If you would like an independent view of where you stand and a pragmatic path forward, CISO Advisory can help. Call 07 2112 8502 or get in touch via our contact page to arrange an assessment.
Frequently asked questions
What is the Essential Eight?
The Essential Eight is a set of eight baseline mitigation strategies recommended by the Australian Cyber Security Centre to help organisations protect themselves against common cyber threats. It covers application control, patching, macro hardening, application hardening, restricting administrative privileges, multi-factor authentication and regular backups, each implemented to a defined maturity level.
Is the Essential Eight mandatory in Australia?
For most non-corporate Commonwealth entities the Essential Eight is mandatory under the Protective Security Policy Framework. For state and local government and the private sector it is generally a strong recommendation or contractual requirement rather than law, but it is widely adopted as the de facto baseline across Australia.
How many maturity levels does the Essential Eight have?
The Essential Eight Maturity Model defines four levels: Maturity Level Zero (significant weaknesses), and Maturity Levels One, Two and Three. Each higher level targets increasingly capable and well-resourced adversaries, from opportunistic attackers at Level One to sophisticated, adaptive actors at Level Three.
Does the Essential Eight replace a full security program?
No. The Essential Eight is a strong technical baseline focused on preventing and limiting malware and intrusions, but it does not cover governance, physical security, personnel, third-party risk or incident response on its own. It should sit inside a broader risk-based program aligned to frameworks such as the ISM or ISO 27001.
Where should an organisation start with the Essential Eight?
Start by assessing your current state honestly against Maturity Level One, then prioritise multi-factor authentication, patching and backups, which deliver the fastest risk reduction. Document a realistic uplift roadmap, assign owners, and treat the eight strategies as an integrated set rather than isolated projects.
Need this handled for your organisation?
Confidential and no obligation. We respond the same business day — on-site same day / next business day, or remote, Australia-wide. Prefer to talk now? Call us 24/7 on 07 2112 8502.