The Essential Eight is a set of eight baseline mitigation strategies published by the Australian Signals Directorate. It is a prioritised minimum, not a complete security program, and it is measured in maturity levels from Zero to Three.
It is mandatory for non-corporate Commonwealth entities. For everyone else it arrives through contracts, tenders and insurance questionnaires rather than through law.
The Essential Eight has quietly become the default language of cyber security in Australia. It turns up in government tenders, in supplier security schedules from larger corporates, and increasingly on the renewal questionnaire your insurer sends out. Most businesses first encounter it as a question they cannot answer.
It comes from the Australian Signals Directorate, published through the Australian Cyber Security Centre, and it is deliberately short. The ASD publishes a much longer catalogue of mitigation strategies; the Essential Eight is the subset they consider the most effective starting point for organisations running Microsoft Windows environments.
The eight strategies, grouped by objective
They are usually listed as a flat set of eight, which hides the logic. The ASD groups them under three objectives, and the grouping is the part worth understanding, because it tells you what each control is actually for.
Prevent cyberattacks
Stop malicious code running in the first place
- Application control - only approved programs are allowed to execute. The most effective of the eight and the most disruptive to implement, which is why it is so often skipped.
- Patch applications - keep software current, remove versions no longer supported by the vendor, and close critical vulnerabilities within defined timeframes.
- Configure Microsoft Office macro settings - block macros for users who have no business need, and allow only vetted or digitally signed macros for those who do.
- User application hardening - disable or remove risky functionality in browsers and common applications, such as Flash, ads, Java and unnecessary browser extensions.
Limit the extent of incidents
Contain the damage when something does get in
- Restrict administrative privileges - admin rights are granted only where genuinely required, reviewed regularly, and kept separate from day-to-day accounts used for email and browsing.
- Patch operating systems - the same discipline as application patching, applied to Windows and to network devices, with unsupported operating systems removed.
- Multi-factor authentication - required for internet-facing services, remote access and privileged accounts. This is the single highest-value control most small businesses can turn on this week.
Recover data and system availability
Get the business running again
- Regular backups - important data, software and settings backed up, retained according to business requirements, protected from modification or deletion by an attacker, and tested through actual restoration. The testing is the part that gets skipped and the part that matters.
How the maturity levels work
This is the most misunderstood part of the framework. The maturity levels are not a score out of ten or a grading of how good your security is in general. Each level is defined by the kind of adversary it is designed to defeat.
| Level | What it means | Adversary it addresses |
|---|---|---|
| Maturity Level Zero | Weaknesses in the overall cyber security posture | Effectively none - a starting point, not a target |
| Maturity Level One | Partly aligned with the intent of each strategy | Adversaries using widely available commodity tools and techniques, taking opportunities rather than choosing targets |
| Maturity Level Two | Mostly aligned with the intent of each strategy | Adversaries willing to invest more time, effort and capability in a specific target |
| Maturity Level Three | Fully aligned with the intent of each strategy | Adaptive adversaries, less reliant on public tooling, who will exploit weak links and pivot |
Two rules follow from this, and both get broken constantly:
- Implement all eight to the same level before advancing. The ASD is explicit that the strategies work as a package. Being at Level Three on multi-factor authentication and Level Zero on backups is not "mostly there" - it is a business with an unproven recovery path.
- Higher is not automatically better. The right level is the one proportionate to the threat your business actually faces and to what your contracts require. Level Three is expensive and operationally heavy, and for many small businesses it is not the correct answer.
The maturity model is revised periodically. Always check the current version on cyber.gov.au rather than relying on a summary - including this one - for anything you are being assessed against.
Who actually has to comply
Non-corporate Commonwealth entities are required to implement the Essential Eight under the Protective Security Policy Framework, with the required maturity level set by that policy.
Everyone else is not legally bound - and yet a great many businesses now have to demonstrate it anyway, because it reaches them through commercial channels rather than legislation:
- Government tenders. Supplying to federal or state government increasingly means answering Essential Eight questions in the submission.
- Supply chain requirements. Larger corporate clients push their own obligations down to suppliers through security schedules in contracts.
- Cyber insurance. Renewal questionnaires ask about multi-factor authentication, patching, admin privileges and backups. Those are Essential Eight controls whether or not the form names the framework.
- Professional and regulated services. Accounting, financial services, legal and healthcare businesses face client and regulator expectations that map closely onto the same controls.
If any of those apply, the framework is effectively a commercial requirement. Our IT compliance page covers the wider picture of what WA businesses are being asked to evidence.
There is no such thing as Essential Eight certification
The ASD does not certify or accredit organisations against the Essential Eight, and nobody can make you "Essential Eight certified" - if a provider offers certification, that alone tells you something.
What genuinely exists is assessment: an independent review of your current maturity against each of the eight strategies, producing evidence, a maturity rating and a prioritised gap list. That is the artefact you hand to a client or an insurer, and it is what the ASD's own assessment guidance describes.
What Level One looks like for a small business
Stripped of the formal wording, a fifteen-person business at Maturity Level One looks roughly like this:
- Multi-factor authentication on email and any internet-facing system, and on every privileged account.
- Windows and applications patched within defined timeframes, with anything the vendor no longer supports removed rather than tolerated.
- Nobody doing daily work from an administrator account, and admin rights reviewed rather than granted permanently and forgotten.
- Office macros blocked for staff with no business need for them.
- Browsers hardened, unnecessary extensions and legacy plug-ins gone.
- Application control on workstations, so only approved software runs.
- Backups running, retained, protected from deletion, and restored as a test at least once so you know they work.
Most businesses we assess in Perth are already partway there without knowing it - multi-factor authentication is often on, backups are usually running. The recurring gaps are application control, macro configuration, admin privilege separation, and backups nobody has ever restored.
Does Microsoft 365 cover it?
Partly, and the gap between "we have the licence" and "we meet the control" is where most of the risk sits. Microsoft 365 Business Premium supplies tooling for several strategies - multi-factor authentication and Conditional Access through Entra ID, patching and hardening through Intune, privilege restriction, and endpoint protection through Defender for Business.
It does not deliver application control, macro configuration or tested backups on its own, and none of what it does supply works at defaults. See Business Premium vs Business Standard for what the licence actually includes, and note that Microsoft's own retention is not a backup strategy - protection against your own deletions and against ransomware is a separate thing you configure.
Where to start
In order, and this order matters:
- Multi-factor authentication. Highest impact, lowest effort, achievable this week.
- Backups, then restore one. Until a restore has been tested, you do not have backups - you have hope.
- Admin privileges. Separate daily accounts from administrative ones and remove rights nobody needs.
- Patching discipline. Defined timeframes and removal of unsupported software, not ad-hoc updates.
- Then assess formally against all eight, so you know your real starting maturity before spending on the harder controls.
Doing an assessment first is also defensible, and often better if a contract deadline is driving the work - you get a documented baseline and a costed plan rather than improving things in an order nobody can evidence.
Our Essential 8 security uplift service covers gap assessment and phased implementation for Perth businesses. Assessment work is charged at $180/hr ex GST, one-hour minimum, then 30-minute increments, with no call-out fee in metro Perth, and larger uplifts are quoted as fixed scope before starting.
Essential Eight Questions, Answered
What businesses ask once a tender or an insurer raises it.
What is the Essential Eight?
The Essential Eight is a set of eight baseline cyber security mitigation strategies published by the Australian Signals Directorate through the Australian Cyber Security Centre. They are grouped under three objectives: prevent cyberattacks, limit the extent of incidents, and recover data and system availability. It is a prioritised minimum baseline for organisations running Microsoft Windows environments, not a complete security program.
What are the eight strategies?
Application control, patch applications, configure Microsoft Office macro settings, user application hardening, restrict administrative privileges, patch operating systems, multi-factor authentication, and regular backups. The first four aim to prevent attacks, the next three limit the extent of an incident, and regular backups cover recovery.
What are the Essential Eight maturity levels?
There are four: Maturity Level Zero indicates weaknesses in the overall posture, Level One addresses adversaries using widely available commodity tools and techniques, Level Two addresses adversaries willing to invest more time and effort in a specific target, and Level Three addresses adaptive adversaries who are less reliant on publicly available tools. The ASD recommends implementing all eight strategies to the same maturity level before progressing to the next.
Is the Essential Eight mandatory in Australia?
It is mandatory for non-corporate Commonwealth entities under the Protective Security Policy Framework, and the required maturity level is set by that policy. For everyone else it is not law - but it arrives contractually. Government tenders, larger corporate clients, and cyber insurance questionnaires increasingly ask organisations to demonstrate alignment, which makes it a commercial requirement for a lot of businesses that are not legally bound by it.
Can you get Essential Eight certified?
No. The ASD does not issue an Essential Eight certification or accreditation, and no organisation can be officially "Essential Eight certified". What exists is assessment - an independent review of your current maturity against each of the eight strategies, producing evidence and a gap list you can show a client or insurer. Be cautious of anyone selling certification.
What does Essential Eight Maturity Level 1 involve for a small business?
In practical terms: multi-factor authentication on internet-facing services and privileged accounts, operating systems and applications patched within defined timeframes with unsupported versions removed, administrative privileges restricted and separated from day-to-day accounts, Office macros disabled or restricted for users who do not need them, web browsers and applications hardened, application control on workstations, and backups that are performed, retained and - critically - tested by restoring them.
Does Microsoft 365 give you Essential Eight compliance?
No single product delivers the Essential Eight. Microsoft 365 Business Premium provides tooling that supports several of the strategies - multi-factor authentication and Conditional Access, patching and hardening through Intune, and restricting privileges through Entra ID - but application control, macro settings and tested backups still have to be configured, maintained and evidenced. Buying the licence and leaving it at defaults achieves very little.
Related
Where to go next, depending on what prompted the question.
Been asked where you stand on the Essential Eight?
We will tell you your real maturity against all eight, in writing, with a costed and prioritised gap list - and we will tell you which gaps are not worth closing yet.
Support Perth IT Pty Ltd · Perth, Western Australia · $180/hr ex GST, one-hour minimum, then 30-minute increments · No call-out fee in metro Perth. This guide summarises publicly available ASD material and is not a substitute for the current published framework at cyber.gov.au.