The Essential Eight

What is the Essential Eight?

The Essential Eight is published by the Australian Signals Directorate (ASD) via the Australian Cyber Security Centre (ACSC) at Essential Eight. It is a prioritised subset of mitigation strategies derived from broader ISM intent and threat-informed defensive practice. The model was first published in 2017 and evolved into a maturity-based framework in 2021.

It is designed to reduce the likelihood and impact of common cyber intrusions, especially in enterprise desktop and server environments. The Essential Eight is not the whole of cybersecurity, but it is intentionally practical and high impact. Most organisations can materially reduce avoidable incidents by implementing these controls consistently.

The Eight Strategies

ASD explains the strategies in detail at Essential Eight Explained. The eight controls are:

• Application control — Prevent unapproved programs and scripts from executing.
• Patch applications — Fix known vulnerabilities in user and server applications quickly.
• Configure Microsoft Office macro settings — Block untrusted macros and reduce malicious document execution.
• User application hardening — Disable risky or unnecessary features in browsers and document tooling.
• Restrict administrative privileges — Limit and govern privileged access paths.
• Patch operating systems — Remediate known operating system vulnerabilities promptly.
• Multi-factor authentication (MFA) — Require MFA for remote access and privileged accounts.
• Regular backups — Perform frequent backups and test restoration processes.

Together these controls target initial access, execution, privilege abuse, and recovery capability. Their effectiveness is highest when implemented as a coordinated set instead of isolated projects.

Maturity Levels

The maturity model is defined at Essential Eight Maturity Model. Maturity Level 0 (ML0) indicates controls are not aligned to model expectations. ML1 indicates basic, partial alignment against less sophisticated threats. ML2 indicates stronger, mostly aligned implementation against more capable adversaries. ML3 indicates comprehensive, tightly controlled implementation for advanced threat environments.

Maturity is assessed per strategy, not as a single checkbox for the whole organisation. Target levels should be set by system criticality, threat profile, and regulatory obligations. Evidence quality and control consistency are as important as policy intent.

Implementation Order

ASD guidance generally supports staged uplift: reach ML1 across all eight strategies first, then progress to ML2 across the set, then ML3 where required. This approach avoids over-investing in one control while leaving major gaps elsewhere. Balanced uplift produces better risk reduction than isolated excellence.

Sequencing should still account for local dependencies, legacy systems, and operational constraints. The principle is breadth before depth, then depth with evidence. Program governance should track implementation debt and residual risk as maturity rises.

In practice, many teams implement quarterly maturity increments with explicit exit criteria for each strategy. That keeps expectations realistic and allows leadership to see measurable reduction in exploitable exposure over time. Where delivery friction is high, documenting compensating controls and residual risk decisions is essential to preserve governance integrity.

Common Mistakes

Frequent implementation failures include over-focusing on one strategy, treating maturity as a compliance checkbox, not testing backups, maintaining excessive privileged accounts, and underestimating macro controls in phishing-heavy environments. These mistakes reduce the intended defensive value of the model even when policy documents appear complete.

Another common issue is weak measurement. Without control metrics and evidence discipline, organisations cannot prove effective operation or prioritize remediation accurately. A practical maturity program requires technical telemetry, governance ownership, and periodic reassessment.

Programs also fail when they separate security engineering from business operations. For example, patch targets without maintenance windows, MFA policy without identity process ownership, or backup policy without restoration exercises with application teams. Essential Eight maturity rises fastest when control owners include both technology and business stakeholders, with accountability for outcomes rather than just task completion.

Assessment

Essential Eight assessments are frequently incorporated into broader assurance activity, including IRAP (Information Security Registered Assessors Program) contexts. ASD publishes process guidance at Essential Eight Assessment Process Guide. This includes scoping, evidence handling, maturity determination, and reporting considerations.

Organisations can conduct internal self-assessments before formal external review to identify gaps and sequence remediation. Early self-assessment reduces rework and improves the quality of evidence presented during independent assurance.