Guide · Security

The Essential Eight, explained plainly

What the Australian Cyber Security Centre's Essential Eight is, what each of the eight strategies means in practice, how the maturity levels work and where a small or mid-sized business should start.
Talk to us Managed cybersecurity

Background

What the Essential Eight is

The Essential Eight is a set of eight mitigation strategies published by the Australian Cyber Security Centre (ACSC), part of the Australian Signals Directorate. The ACSC presents them as a baseline that makes it much harder for adversaries to compromise systems, and the strategies are accompanied by a maturity model that describes what each one looks like at increasing levels of strength.

The Essential Eight was designed primarily for Microsoft Windows-based networks connected to the internet. The principles carry across to other environments, but the ACSC notes that other approaches may be more suitable for cloud services, mobile devices and operational technology.

It is not a certification and there is no Essential Eight badge. Organisations assess themselves, or engage someone to assess them, against the maturity model. Commonwealth government entities are required to implement it, and many private businesses now use it because insurers, customers and boards recognise it as a common reference point.

The eight mitigation strategies

Each strategy targets a different stage of an attack. Together they aim to stop malware running, limit the damage if something gets through and make sure you can recover.

1. Patch applications

Apply security updates to applications such as browsers, Office, PDF readers and internet-facing services quickly, prioritising those with known exploits, and remove applications that are no longer supported by their vendor.

2. Patch operating systems

Keep Windows, macOS, server and network device operating systems up to date, and replace operating systems that no longer receive security updates.

3. Multi-factor authentication

Require a second factor beyond a password for remote access, online services, privileged accounts and important data repositories. Higher levels call for phishing-resistant methods.

4. Restrict administrative privileges

Give admin rights only to the people who need them, use separate admin accounts that are not used for email or web browsing, and review privileged access regularly.

5. Application control

Allow only approved programs, scripts and installers to run, so malicious software delivered by email or download cannot execute.

6. Restrict Microsoft Office macros

Block macros from the internet and allow only macros that have a business need and come from trusted locations or are digitally signed.

7. User application hardening

Configure browsers and Office to block content that is commonly abused, such as web advertisements and Java from the internet, and stop Office creating child processes.

8. Regular backups

Back up important data, software and settings, keep copies protected from change or deletion, and test that restores actually work.

The maturity levels

The ACSC maturity model describes four levels, each defined by the kind of adversary it is designed to resist.
The maturity levels
LevelWhat it means
Maturity Level ZeroThere are weaknesses in the organisation's overall security posture that could be exploited.
Maturity Level OneDesigned to resist opportunistic adversaries using widely available tools and techniques against any target they can find.
Maturity Level TwoDesigned to resist adversaries willing to invest more time and effort, using somewhat more capable tools and targeting organisations more deliberately.
Maturity Level ThreeDesigned to resist more adaptive adversaries who are less reliant on public tools and who exploit weaknesses in an organisation's security quickly.

The ACSC advises choosing a target maturity level that suits your environment and threats, and reaching that level consistently across all eight strategies before aiming higher. Always check the current maturity model on cyber.gov.au, as it is updated from time to time.

Where to start

For most small and mid-sized businesses, a sensible path looks like this.
  1. 01

    Know what you have

    List your devices, accounts, applications and where important data lives. You cannot patch or protect what you do not know about.
  2. 02

    Assess honestly

    Check each strategy against the maturity model and record the evidence, not what people believe is true.
  3. 03

    Pick a target

    Choose a target maturity level for the business, considering your risk, your customers and any contract or insurance requirements.
  4. 04

    Fix the quick, high-value gaps

    MFA everywhere, separate admin accounts, tested backups and timely patching usually reduce the most risk for the least disruption.
  5. 05

    Work through the rest

    Application control, macro settings and application hardening take more planning and testing. Roll them out in stages.
  6. 06

    Keep it maintained

    Maturity drifts as staff, devices and software change. Review regularly so the controls stay in place.

Want help with the Essential Eight?

Our managed cybersecurity service includes a formal Essential Eight assessment and uplift. If we run your IT, the baseline is part of managed IT security. For a longer read, see the Essential Eight compliance guide.

FAQ

Essential Eight: common questions

Is the Essential Eight mandatory for private businesses?

Not by law in general. It is required for Commonwealth government entities, and private businesses may be asked to meet it by customers, government contracts or insurers.

Can a business be certified against the Essential Eight?

No. There is no official certification. Organisations assess their maturity against the ACSC model, either themselves or with an external assessor.

Which maturity level should we aim for?

The ACSC asks organisations to choose a target suited to their environment and threats. Many businesses use Maturity Level Two as a reference point because it is the level Commonwealth entities must reach.

Does the Essential Eight cover everything?

No. It is a strong baseline, not a complete security programme. The ACSC publishes a wider set of strategies to mitigate cyber security incidents, and areas such as email security, staff awareness and incident response planning still matter.

Does it apply if we use Macs or are fully in the cloud?

The model was designed for Windows-based networks, so some controls need adapting. The principles of patching, MFA, limited admin rights and tested backups apply everywhere.

Related

Talk to us about your ERP or IT

Tell us where things stand and what is getting in the way. We will tell you plainly whether and how we can help.

Start a conversation How pricing works