Quick summary
The Essential Eight is a set of eight mitigation strategies from the Australian Signals Directorate (ASD). ASD describes them as the most effective of its strategies to mitigate cyber security incidents. The maturity model, last updated in November 2023, has four levels, Zero to Three, each aimed at a more capable attacker. This guide explains the eight strategies, what each maturity level actually requires, how an assessment works and how to plan your uplift.
On this page
- What is the Essential Eight?
- Who needs to comply?
- The 8 strategies explained
- Maturity Levels One, Two and Three
- The assessment process
- What drives the cost
- The cost of doing nothing
- How a managed provider helps
- Self-assessment checklist
What is the Essential Eight?
The Essential Eight is published by ASD through its Australian Cyber Security Centre (ACSC). It sits within ASD's wider Strategies to Mitigate Cyber Security Incidents, and ASD describes the Essential Eight as the most effective of those strategies. The eight are:
- Patch applications
- Patch operating systems
- Multi-factor authentication
- Restrict administrative privileges
- Application control
- Restrict Microsoft Office macros
- User application hardening
- Regular backups
Together they address the main stages of a typical attack:
| Attack stage | Essential Eight strategies that address it |
|---|---|
| Getting malicious code to run | Application control, patch applications, Office macro restrictions, user application hardening |
| Using stolen credentials | Multi-factor authentication |
| Taking control of the network | Restrict administrative privileges, patch operating systems |
| Destroying data or holding it to ransom | Regular backups that attackers cannot modify or delete |
The framework is free. The work is in implementing it properly and keeping it current.
Why it matters now
ASD's Annual Cyber Threat Report 2024-25 recorded over 84,700 cybercrime reports in the 2024-25 financial year, about one every six minutes, and an average self-reported cost per report of $56,600 for small businesses and $97,200 for medium businesses. ASD responded to over 1,200 cyber security incidents, and 11 per cent of them included ransomware. The report again urges organisations to adopt the latest version of the Essential Eight maturity model.
Who needs to comply?
There is no general law that requires a private Australian business to implement the Essential Eight. Whether it is effectively required for you depends on who you deal with:
| Situation | What it means |
|---|---|
| Government agencies | Agencies have their own protective security obligations, and ASD writes the Essential Eight with government in mind |
| Regulated sectors | Critical infrastructure, financial services and others have their own security rules. The Essential Eight is a common way to meet parts of them, but check your regulator's actual requirement |
| Suppliers to government and large companies | Contracts and supplier questionnaires increasingly ask for an Essential Eight maturity level |
| Businesses buying cyber insurance | Insurers commonly ask about MFA, patching, admin rights and backups during underwriting |
| Businesses holding personal information | Under the Notifiable Data Breaches scheme, organisations covered by the Privacy Act must notify affected people and the OAIC when a breach is likely to result in serious harm |
For most small and mid-sized businesses, the Essential Eight is the clearest way to show a customer, insurer or board that the basics are in place.
The 8 strategies explained
The requirements below are summarised from ASD's Essential Eight maturity model. Read the model itself for the exact wording at each level.
1. Patch applications
What it does: Keeps applications free of known vulnerabilities.
What Maturity Level One requires, in short:
- Automated asset discovery at least fortnightly, and a vulnerability scanner with an up-to-date database.
- Daily scanning of online services; weekly scanning of Office, browsers, email clients, PDF software and security products.
- Patches for online services within 48 hours when critical or exploited, otherwise within two weeks.
- Patches for Office, browsers, email clients, PDF software and security products within two weeks.
- Unsupported applications removed.
At Level Two: other applications are scanned at least fortnightly and patched within one month. At Level Three: the 48-hour rule extends to Office, browsers, email clients, PDF software and security products when a vulnerability is critical or exploited.
2. Patch operating systems
What it does: Keeps Windows, macOS, Linux, servers and network devices patched.
Maturity Level One, in short: internet-facing servers and network devices are scanned daily and patched within 48 hours when critical or exploited, otherwise within two weeks. Workstations and internal servers and devices are scanned at least fortnightly and patched within one month. Unsupported operating systems are replaced.
3. Multi-factor authentication
What it does: Makes a stolen password insufficient on its own.
Maturity Level One: MFA for users of your online services and third-party online services that handle sensitive data, and for online customer services that handle sensitive customer data. Maturity Level Two: MFA also for privileged users of systems, and MFA for online services and systems must be phishing-resistant. Maturity Level Three: phishing-resistant MFA extends further, including to users of data repositories.
4. Restrict administrative privileges
What it does: Limits what an attacker can do with a compromised account.
Maturity Level One: privileged access is validated when first requested, admins have dedicated privileged accounts, those accounts are blocked from the internet, email and web services (unless explicitly authorised), and privileged and unprivileged environments are kept separate. Maturity Level Two: privileged access is disabled after 12 months unless revalidated, and after 45 days of inactivity.
5. Application control
What it does: Only an approved set of programs, scripts and installers can run.
Maturity Level One: application control on workstations, applied to user profiles and temporary folders, restricting executables, libraries, scripts, installers and similar to an approved set. Maturity Level Two: extends to internet-facing servers and all locations, adds Microsoft's recommended blocklist, annual ruleset validation and central logging. Maturity Level Three: extends to non-internet-facing servers.
6. Restrict Microsoft Office macros
What it does: Stops malicious macros, a common way malware arrives.
Maturity Level One: macros disabled for users without a business need, macros in files from the internet blocked, macro antivirus scanning on, and users cannot change macro settings. Maturity Level Two: macros are also blocked from making Win32 API calls. Maturity Level Three: only macros from a sandbox, a Trusted Location or signed by a trusted publisher can run, and they are checked before being signed or placed in a Trusted Location.
7. User application hardening
What it does: Reduces what browsers and Office will do with content from the internet.
Maturity Level One: Internet Explorer 11 disabled or removed, browsers do not process Java or web advertisements from the internet, and users cannot change browser security settings. Maturity Level Two: browsers and Office hardened using ASD and vendor guidance, and Office blocked from creating child processes, creating executable content and injecting code into other processes.
8. Regular backups
What it does: Lets you recover from ransomware or data loss without paying.
Maturity Level One: backups of data, applications and settings are performed and retained in line with business criticality, synchronised to a common point in time, retained securely and resiliently, and restoration is tested as part of disaster recovery exercises. Unprivileged accounts cannot modify or delete backups. Maturity Level Two: privileged accounts (other than backup administrators) also cannot access, modify or delete other users' backups.
Maturity Levels One, Two and Three
ASD defines four maturity levels. Apart from Level Zero, each is defined by the attacker it is designed to stop:
| Level | The attacker it targets (ASD's description, summarised) |
|---|---|
| Maturity Level Zero | Not a target: the strategy is not yet implemented to Level One |
| Maturity Level One | Opportunistic attackers using widely available tools, for example a public exploit for an unpatched online service or stolen, reused or guessed credentials |
| Maturity Level Two | Attackers willing to invest more time and effort, including phishing for credentials and getting around weak MFA |
| Maturity Level Three | Adaptive attackers who move quickly on new exploits, steal authentication tokens, and target older software and weak logging |
Choosing your target
ASD recommends that organisations:
- Identify a target maturity level suitable for their environment.
- Implement each maturity level progressively until the target is reached.
- Reach the same level across all eight strategies before moving to the next level, because the strategies are designed to complement each other.
For most small and mid-sized Australian businesses, Maturity Level One across all eight is the first milestone. Maturity Level Two is the common target for businesses that handle sensitive data, supply government or are asked for it by customers. Maturity Level Three is for organisations facing more capable, targeted attackers.
At a glance
| Strategy | Maturity Level One | Maturity Level Two adds | Maturity Level Three adds |
|---|---|---|---|
| Patch applications | 48 hours for critical online services, 2 weeks otherwise | Other applications within 1 month | 48 hours for critical Office, browser, email, PDF and security product vulnerabilities |
| Patch operating systems | 48 hours for critical internet-facing, 1 month for workstations and internal systems | More frequent scanning and broader coverage | Tighter timeframes and latest releases |
| MFA | Online services with sensitive data | Privileged users; phishing-resistant MFA | Phishing-resistant MFA more widely, including data repositories |
| Admin privileges | Dedicated admin accounts, no internet or email | Access expires after 12 months or 45 days inactive | Tighter controls and monitoring |
| Application control | Workstations, approved set only | Internet-facing servers, blocklist, logging | Non-internet-facing servers |
| Office macros | Internet macros blocked, users cannot change settings | Win32 API calls blocked | Only sandboxed, trusted-location or trusted-signed macros |
| User application hardening | No Java or web ads in browsers | ASD and vendor hardening for browsers and Office | Further hardening |
| Regular backups | Tested restores, users cannot delete backups | Admins (other than backup admins) cannot delete backups | Further restrictions on backup access |
The assessment process
ASD publishes an Essential Eight assessment process guide and runs an assessment course. A typical engagement looks like this:
Step 1: Baseline assessment
Each of the eight strategies is assessed against the maturity model. That means reviewing configurations, running scans and looking at evidence that the controls actually work, not just that a policy exists.
Output: a maturity level for each strategy, for example "application control: Level Zero, patch applications: Level One, MFA: Level One", and an overall picture.
Step 2: Gap analysis and uplift plan
A prioritised plan closes the gaps to your target level: specific actions per strategy, effort, sequence and who does what.
Step 3: Implementation
The longest phase. A common order:
- Multi-factor authentication (high impact, relatively quick)
- Backups (protected copies and a tested restore)
- Patching (automated, with internet-facing systems first)
- Admin privileges (dedicated admin accounts)
- Office macros (block internet macros)
- User application hardening (browser and Office settings)
- Application control (most effort, very effective)
Step 4: Evidence
Keep evidence that controls are working: configuration exports, patch and scan reports, restore test records, MFA coverage reports and application control logs.
Step 5: Ongoing monitoring
Controls drift. Review maturity regularly, keep evidence current and re-assess when your environment changes.
What drives the cost
The cost of an Essential Eight uplift depends far more on your starting point than on the framework. The main drivers:
| Factor | Why it matters |
|---|---|
| Legacy systems | Unsupported operating systems and applications must be replaced or isolated |
| Undocumented software | Every application in use has to be known before application control can be applied |
| No existing patch management | Building automated patching and scanning from scratch takes more effort than tuning it |
| MFA gaps | Rolling out MFA, and phishing-resistant MFA at Level Two, means licensing, devices and user support |
| Backup design | Protected copies, separate credentials and restore testing may need new infrastructure |
| Number of sites and remote staff | More locations and devices add complexity to every strategy |
Things that reduce the cost:
| Factor | Why it helps |
|---|---|
| A Microsoft 365 business plan with security features | Many of the controls can be configured with tools you may already license |
| A phased plan | MFA, backups and patching first spreads the effort and improves protection early |
| Automation | Automated patching, scanning and evidence collection cut ongoing effort |
| A provider with repeatable playbooks | Less trial and error, and evidence kept as part of the service |
The biggest hidden cost is staff time: testing application control rules, changing how admins work and chasing evidence. Plan for it.
The cost of doing nothing
The case for the Essential Eight is the cost of an incident without it:
- Direct losses. ASD's average self-reported cost of cybercrime per report in 2024-25 was $56,600 for small businesses, $97,200 for medium businesses and $202,700 for large businesses.
- Downtime and recovery. Rebuilding systems, restoring data and investigating what happened.
- Breach obligations. Notifying affected people and the OAIC when a breach is likely to result in serious harm.
- Lost opportunities. Failing a customer's or government buyer's security questionnaire, or struggling to obtain cyber insurance.
How a managed provider helps
Implementing the Essential Eight by hand, one device and one policy at a time, is slow. A good managed provider shortens the work:
| Area | Manual approach | Managed approach |
|---|---|---|
| Assessment | Weeks of manual review | Scanning and configuration analysis shorten the baseline |
| Evidence | Screenshots gathered before an audit | Evidence collected from management tools and kept current |
| Patching | Monthly cycles, scheduled by hand | Automated patching to ASD timeframes, with reporting |
| MFA | Manual enrolment and follow-up | Staged rollout with self-service enrolment and coverage reports |
| Backups | Restore tests when someone remembers | Scheduled restore tests with documented results |
| Reporting | Annual report | Regular maturity reporting the board can read |
The practical order of work: baseline, prioritised roadmap, implementation of MFA, backups and patching first, ongoing monitoring, a current evidence pack and a tested incident response plan.
Self-assessment checklist
Use this checklist before you engage an assessor:
Application control
- Do you maintain an approved application list?
- Can unapproved executables run on workstations?
- Is application control applied to internet-facing servers?
Patch applications
- Do you have automated patching and vulnerability scanning?
- Are critical vulnerabilities in online services patched within 48 hours?
- Have unsupported applications been removed?
Microsoft Office macros
- Are macros from the internet blocked?
- Are macros disabled for staff who do not need them?
- Can users change macro settings?
User application hardening
- Do browsers block web advertisements and Java from the internet?
- Is Internet Explorer 11 disabled or removed?
- Can users change browser security settings?
Restrict administrative privileges
- Do admins use dedicated admin accounts?
- Are admin accounts blocked from email and web browsing?
- How many admin accounts exist, and does each have a current reason?
Patch operating systems
- Is OS patching automated?
- Are internet-facing servers and devices patched within 48 hours when critical?
- Have unsupported operating systems been replaced?
Multi-factor authentication
- Is MFA on for all online services that hold sensitive data?
- Is MFA on for all admin accounts?
- Is your MFA phishing-resistant?
Regular backups
- Are backups taken in line with how critical each system is?
- Can normal user and admin accounts delete or change backups?
- When did you last test a full restore?
Count the boxes where the answer is the secure one. Fewer than 12 means Maturity Level One is the immediate priority; 12 to 20 means you have a foundation with gaps; above 20, assess formally against Maturity Level Two. This is a rough guide, not an assessment.
Ready to start?
Run the checklist above, choose a target maturity level that matches your obligations, and start with MFA, backups and patching. If you want help with the assessment, the uplift plan and keeping evidence current, see our managed cybersecurity service. If you would rather have the baseline run as part of everyday IT, see managed IT services.