Last reviewed: 11 October 2026
The Essential Eight is a set of eight cyber security mitigation strategies that the Australian Signals Directorate (ASD) recommends every Australian organisation implement as a baseline. They cover patching, multi-factor authentication, admin privileges, application control, Office macros, application hardening and backups, and are measured against four maturity levels, from Zero to Three.
In short:
- What it is: ASD’s recommended minimum set of cyber security controls, with a maturity model to measure them.
- Who it’s for: every Australian organisation. It is mandatory for many government entities and recommended for businesses.
- Where to start: reach Maturity Level One across all eight strategies, beginning with MFA, admin rights, patching and backups.
Where the Essential Eight comes from
The Essential Eight was developed by ASD’s Australian Cyber Security Centre (ACSC). It is drawn from ASD’s longer list of Strategies to Mitigate Cyber Security Incidents, and ASD describes the Essential Eight as “the most effective of these mitigation strategies” (Essential Eight maturity model).
The maturity model was first published in June 2017 and is updated regularly. The current version is the November 2023 release (maturity model changes).
What’s next: in June 2026, ASD announced that the Essential Eight will evolve into a broader Essentials series, starting with Essentials for enterprise IT and followed by chapters for operational technology and cloud (ASD). ASD has said both will be live during a transition period, with the Essential Eight expected to be deprecated from about 12 months and retired in about 24 months (iTnews). Until then, it remains the framework insurers, customers and tenders ask about.
ASD designed the Essential Eight to protect internet-connected IT networks. It notes the principles may be applied to mobile and operational technology environments, but the model was not designed for them.
The eight strategies at a glance
| Strategy | What it means in plain English | Main objective |
|---|---|---|
| Patch applications | Keep browsers, Office, PDF readers and other apps up to date | Prevent |
| Patch operating systems | Keep Windows, macOS, servers and network devices up to date | Prevent |
| Multi-factor authentication | Ask for a second proof of identity, not just a password | Limit |
| Restrict administrative privileges | Only a few people get admin rights, using separate admin accounts | Limit |
| Application control | Only approved programs and scripts can run | Prevent |
| Restrict Microsoft Office macros | Block risky macros, especially in files from the internet | Prevent |
| User application hardening | Lock down browsers so ads, Java and risky features can’t be used against you | Prevent |
| Regular backups | Back up data, apps and settings, protect the backups and test restores | Recover |
The summaries below reflect Maturity Level One in the November 2023 maturity model. Check the maturity model for ASD’s full wording.
Patch applications
Attackers routinely exploit known flaws in browsers, Office, PDF readers and online services. Patching closes those holes. For a small business, this means automatic updates for everyday software and a way to see what has been missed. Level One in practice: scan for missing patches, patch internet-facing services within 48 hours when a flaw is critical or being exploited, patch Office, browsers, email clients, PDF software and security products within two weeks, and remove unsupported software.
Patch operating systems
The same logic applies to Windows, macOS, servers and network devices such as firewalls. An unpatched firewall or old Windows server is a common way in. Level One in practice: patch workstations and internal servers within one month, patch internet-facing servers and network devices within 48 hours for critical or exploited flaws (two weeks otherwise), and replace operating systems that are no longer supported.
Multi-factor authentication
MFA asks for something extra, such as an authenticator app prompt, on top of a password. Stolen or guessed passwords are one of the most common ways into small business email. Level One in practice: use MFA for staff on online services that hold your sensitive data, including third-party services, and on customer-facing services that hold sensitive customer data.
Restrict administrative privileges
Admin accounts can install software and change security settings, so attackers want them. If everyone works as an admin, one phishing click can hand over the whole computer. Level One in practice: validate requests for privileged access, give admins a separate admin account, and stop admin accounts being used for email and web browsing.
Application control
Application control means only approved software can run. Ransomware dropped into a downloads folder simply won’t start. Level One in practice: apply application control on workstations, including user profiles and temporary folders, so only an approved set of programs, scripts and installers can run.
Restrict Microsoft Office macros
Macros automate tasks in Word and Excel, but they are also a long-standing way to deliver malware through email attachments. Level One in practice: disable macros for staff who don’t need them, block macros in files from the internet, turn on macro antivirus scanning, and stop users changing macro settings.
User application hardening
Hardening turns off features in browsers that attackers abuse. Level One in practice: disable or remove Internet Explorer 11, stop browsers processing web ads and Java from the internet, and stop users changing browser security settings.
Regular backups
Backups are your way back from ransomware, mistakes and hardware failure, but only if they work and can’t be deleted by an attacker. Level One in practice: back up data, applications and settings according to how critical they are, keep them secure, test restores as part of disaster recovery exercises, and stop ordinary user accounts changing or deleting backups.
The Essential Eight maturity levels explained
ASD defines four maturity levels. Apart from Level Zero, each level is based on defending against increasing levels of attacker tradecraft and targeting.
| Level | Who it’s designed to stop (plain English) | ASD says generally suitable for |
|---|---|---|
| Maturity Level Zero | Not a target level: weaknesses exist that Level One addresses | – |
| Maturity Level One | Opportunistic attackers using widely available tools, stolen or guessed passwords and known exploits | Small to medium enterprises |
| Maturity Level Two | Attackers willing to invest more time, including targeted phishing and getting around weak MFA | Large enterprises |
| Maturity Level Three | Adaptive attackers who use new exploits quickly and work around your specific controls | Critical infrastructure providers and organisations in high threat environments |
Three rules matter when you plan:
- Choose a target level that suits your environment, then implement towards it progressively (maturity model).
- Treat the eight strategies as a package. ASD recommends reaching the same maturity level across all eight before moving higher, because they are designed to complement each other.
- Level Two now includes logging. Since the November 2023 update, centralised collection and analysis of event logs is required at Maturity Level Two (changes page).
Not sure where you sit? An Essential Eight assessment and uplift gives you a rating for each strategy and a plan to close the gaps.
Does my business need the Essential Eight?
It isn’t a legal requirement for most private businesses, but it is ASD’s recommended baseline for all organisations, and it is increasingly requested by cyber insurers, larger customers and tenders.
For government, the picture is different. ASD’s FAQ notes that for non-corporate Commonwealth entities subject to the Protective Security Policy Framework (PSPF), Maturity Level Two is considered a mandatory baseline. Those expectations often flow down to suppliers.
If your business is covered by the Privacy Act 1988, you must take reasonable steps to protect the personal information you hold (OAIC). The Essential Eight is not a legal test of “reasonable steps”, but it is a well-recognised way to show you have taken them.
You’ll probably be asked about it if:
- you hold health, financial or other sensitive personal information
- you supply government agencies or large corporates
- your cyber insurer sends you a security questionnaire at renewal
What maturity level should a small business aim for?
ASD’s guidance is clear: “Generally, Maturity Level One may be suitable for small to medium enterprises, Maturity Level Two may be suitable for large enterprises, and Maturity Level Three may be suitable for critical infrastructure providers and other organisations that operate in high threat environments” (maturity model FAQ).
In practice, get to Level One across all eight strategies first. Consider Level Two if a contract, your insurer or the sensitivity of your data calls for it.
How to get started (five steps)
- List your systems and accounts. Devices, servers, cloud apps and who has admin access.
- Turn on MFA everywhere, starting with email and remote access.
- Remove everyday admin rights and create separate admin accounts for the people who need them.
- Set automatic patching for operating systems and applications, and check it is actually working.
- Set up backups and test a restore.
Then get a proper baseline with an Essential Eight assessment and uplift. ASD also publishes free guidance for smaller organisations on cyber.gov.au.
Essential Eight vs other frameworks
The Essential Eight is a set of technical controls with a maturity model; it is not a certification. ISO/IEC 27001 is an international standard for an information security management system that organisations can be certified against by an accredited body. SMB1001 is a certifiable Australian standard for small and medium businesses that overlaps with several Essential Eight controls. The NIST Cybersecurity Framework is a broader US framework for managing cyber risk. Many businesses use the Essential Eight as their technical baseline and one of the others for governance.
Related reading: what zero trust security means and SIEM vs MDR. Explore our endpoint protection, email security and managed IT services.
Frequently asked questions
Who created the Essential Eight?
The Australian Signals Directorate (ASD), through its Australian Cyber Security Centre (ACSC). It is drawn from ASD’s Strategies to Mitigate Cyber Security Incidents.
What are the eight strategies?
Patch applications, patch operating systems, multi-factor authentication, restrict administrative privileges, application control, restrict Microsoft Office macros, user application hardening and regular backups.
What are the Essential Eight maturity levels?
There are four: Maturity Level Zero (Level One not met) through Maturity Level Three. Each level from One to Three defends against more capable and more targeted attackers.
Is the Essential Eight mandatory?
It is mandatory for many Australian Government entities under the Protective Security Policy Framework. For most private businesses it is recommended, not legally required, though insurers, customers and tenders increasingly ask for it.
What level should a small business aim for?
ASD says Maturity Level One may be suitable for small to medium enterprises. Reach Level One across all eight strategies first, then consider Level Two if your risk or contracts require it.
Is the Essential Eight a certification?
No. It is a maturity model. You are assessed against it, not certified. ASD notes independent assessment is only needed where a directive, regulator or contract requires it.
When was the Essential Eight last updated?
The current maturity model is the November 2023 release. It was first published in June 2017 and is updated regularly.
Is the Essential Eight being retired?
Yes, gradually. In June 2026, ASD announced a broader Essentials series that builds on the Essential Eight. Both will run side by side for a while, and ASD expects to retire the Essential Eight in about two years. The core controls carry forward.
Can Microsoft 365 help us meet the Essential Eight?
Yes. Microsoft 365 Business Premium tools such as Intune, Defender for Business and Entra ID cover much of Level One, but you still need a separate backup solution and correct configuration.
How do we find out our current maturity level?
With an Essential Eight assessment, which rates each strategy against ASD’s maturity model and gives you a prioritised plan. Loginet’s assessments start from $2,590 ex GST for up to 20 users. See our Essential Eight assessment and uplift service.
Not sure where you sit?
Get a clear rating for each of the eight strategies and a plan to reach Level One. Call (07) 4599 7909.
or call (07) 4599 7909
