The Essential Eight explained: a plain-English guide for Australian organisations

What is the Essential Eight?

The Essential Eight is a set of eight security strategies published by the Australian Signals Directorate (ASD) through its Australian Cyber Security Centre. They were chosen because, applied together, they stop or limit the great majority of the attacks ASD responds to. The Essential Eight is a baseline for Microsoft Windows-based networks connected to the internet, not a complete security program.

The eight strategies

1. Patch applications. Keep browsers, Office, PDF readers and other software up to date, and remove software the vendor no longer supports.
2. Patch operating systems. Apply security updates to Windows and servers promptly and replace versions that are out of support.
3. Multi-factor authentication. Require a second factor for sign-in, starting with internet-facing services, email and administrator accounts.
4. Restrict administrative privileges. Give admin rights only to the people who need them, on separate accounts that are not used for email or browsing.
5. Application control. Allow only approved software to run, so malware that reaches a device cannot execute. See our application control service.
6. Restrict Microsoft Office macros. Block macros from the internet and allow them only where there is a business need.
7. User application hardening. Switch off risky features in browsers and Office, such as unneeded plug-ins and advertising content.
8. Regular backups. Back up important data, settings and software, keep copies protected from tampering and test that restores work.

What the maturity levels mean

Each strategy is measured against a maturity model with four levels:

ASD's advice is to reach the same level across all eight strategies before moving up. Being at Level 2 for backups and Level 0 for multi-factor authentication does not make you "mostly Level 2"; an attacker will use the weakest point.

Who has to comply?

The Essential Eight is mandatory for many Australian Government agencies. For everyone else it is strongly recommended rather than required by law. In practice, though, it has become the common yardstick: government funders write it into contracts, cyber insurers ask about it at renewal and larger customers include it in supplier questionnaires. If you handle sensitive information for others, expect to be asked.

A practical order for reaching Maturity Level 1

Most small and mid-sized organisations start at Level 0 on several strategies. This order gives the most protection soonest:

1. Turn on multi-factor authentication everywhere, beginning with Microsoft 365 and admin accounts. This single step blocks most account takeovers. See Identity and MFA.
2. Separate admin accounts and remove local admin rights from everyday users.
3. Automate patching for operating systems and common applications, and find the devices and software that are out of support.
4. Fix backups: cover Microsoft 365 as well as servers, keep a copy that cannot be altered and run a test restore.
5. Block internet macros and harden browsers and Office through central policy.
6. Introduce application control, in audit mode first so you can see what would be blocked before enforcing it.

Application control takes the most planning, which is why it comes last here even though ASD lists it first.

Common mistakes

• Treating it as a one-off project. Maturity slips as staff, devices and software change. It needs ongoing management and periodic reassessment.
• Self-assessing generously. "We have MFA" is not the same as MFA enforced for every user and every service. An assessment should test, not ask.
• Forgetting Microsoft 365. Email, files and identities live there, yet many tenants run close to default settings.
• Chasing Level 3 in one area. Consistency across all eight matters more than depth in one.

Where to start

Start by finding out where you stand. An Essential Eight assessment tests each strategy against the current maturity model and gives you a report you can share with funders and insurers. Our uplift program then closes the gaps in planned phases. For the authoritative detail, read ASD's own guidance at cyber.gov.au.