Summary
The Essential Eight is a set of eight prioritised cybersecurity mitigation strategies developed by the Australian Signals Directorate (ASD). It is designed to make it harder for attackers to compromise internet-connected business systems. The framework covers patching, multi-factor authentication, administrative privileges, application control, Microsoft Office macro controls, application hardening and backups.
For many small and medium businesses, Maturity Level One is a practical starting point. The Australian Cyber Security Centre (ACSC) specifically recommends that small businesses work towards Maturity Level One after completing its basic cybersecurity guidance.
The important point is that the Essential Eight is not a cybersecurity product. It is a framework that can help your organisation identify, prioritise and improve important security controls.
Quick answer: If your business has not yet established strong patching, MFA, application controls, restricted administrator access and reliable backups, the Essential Eight can provide a practical starting point for improving your cybersecurity posture.
The table below summarises the eight strategies and what they are designed to achieve.
What Is the Essential Eight?
The Essential Eight is an Australian cybersecurity framework developed by the Australian Signals Directorate to help organisations protect internet-connected information technology networks.
The framework was created around a practical question:
What cybersecurity controls can an organisation prioritise to make common attacks significantly harder to carry out?
The Essential Eight brings eight mitigation strategies together:
| Essential Eight strategy | What it helps address |
|---|---|
| Patch applications | Reduces exposure to known application vulnerabilities |
| Patch operating systems | Reduces vulnerabilities in operating systems |
| Multi-factor authentication | Helps protect accounts from compromised credentials |
| Restrict administrative privileges | Limits what compromised privileged accounts can do |
| Application control | Helps prevent unauthorised software from executing |
| Restrict Microsoft Office macros | Reduces risks from malicious macros |
| User application hardening | Reduces opportunities for applications to be exploited |
| Regular backups | Supports recovery when systems or data are compromised |
The ACSC describes these eight strategies as a baseline that can make it significantly harder for malicious actors to compromise systems.
Why Does the Essential Eight Matter for Australian Businesses?
Cybersecurity can quickly become complicated.
A business could potentially invest in endpoint protection, cloud security, email security, vulnerability management, SIEM, identity protection and dozens of other technologies.
The problem is that buying more security products does not automatically create better security.
The Essential Eight provides a structured way to focus on fundamental controls first.
For example, an organisation may have sophisticated security software but still have serious weaknesses if:
- Critical applications are not patched
- Users do not have MFA
- Too many employees have administrator privileges
- Important data is not backed up properly
- Unauthorised applications can execute
- Business applications are not securely configured
The Essential Eight helps organisations address these foundational areas before moving towards more advanced security capabilities.
What Are the 8 Essential Eight Strategies?
1. Patch Applications
Applications can contain vulnerabilities that attackers exploit to gain access to systems or sensitive information.
Application patching involves identifying vulnerable software and applying appropriate updates or mitigations.
The Essential Eight places particular emphasis on higher-risk applications, including software that interacts with untrusted content such as web browsers, email clients and office productivity applications. The current maturity model also includes specific requirements for responding quickly to critical vulnerabilities or vulnerabilities with working exploits.
For businesses, this means patching should not simply be an occasional IT task.
It should be a managed process.
Businesses should consider:
- Maintaining an inventory of applications
- Identifying vulnerable software
- Prioritising critical vulnerabilities
- Applying vendor security updates
- Monitoring patch status
- Removing software that is no longer required
2. Patch Operating Systems
Operating systems are another major part of the attack surface.
Windows, macOS, Linux and other operating systems regularly receive security updates that address vulnerabilities.
If these updates are ignored, attackers may be able to exploit known weaknesses.
A strong patch management process should identify which operating systems are being used across the organisation and ensure security updates are applied within appropriate timeframes.
This becomes particularly important for:
- Internet-facing systems
- Employee laptops
- Business desktops
- Servers
- Remote devices
- Systems handling sensitive information
The Essential Eight’s maturity requirements include specific expectations around patching operating systems and responding quickly to certain critical vulnerabilities.
3. Multi-Factor Authentication
Multi-factor authentication, commonly called MFA, adds another layer of protection when someone attempts to access an account.
Instead of relying only on a password, MFA requires additional verification.
This matters because passwords can be:
- Stolen through phishing
- Reused across services
- Guessed
- Brute-forced
- Exposed through previous data breaches
The ACSC identifies MFA as one of the three starting measures it recommends to small businesses, alongside software updates and backups.
Businesses should also review their identity and access security to ensure authentication and permissions are properly managed.
For higher-risk environments, organisations should also consider stronger forms of authentication and phishing-resistant MFA as part of a broader identity security strategy.
4. Restrict Administrative Privileges
Administrator accounts have significantly more control over systems than standard user accounts.
If an attacker compromises an administrator account, the potential impact can be much greater.
Restricting administrative privileges means users should receive only the access they need to perform their role.
Businesses should consider:
- Separate administrator and standard accounts
- Limiting the number of administrators
- Reviewing privileged accounts regularly
- Removing unnecessary administrator access
- Using privileged access controls
- Limiting administrator access to appropriate environments
The ASD’s guidance emphasises narrowly scoped privileges and separate privileged environments as ways to reduce the attack surface associated with privileged accounts.
Organisations can address these risks through stronger identity and access security controls and regular access reviews.
5. Application Control
Application control helps organisations determine which software is allowed to run.
Without appropriate controls, users may download and execute unauthorised applications, scripts or other executable content.
Application control can help businesses:
- Prevent unauthorised software
- Reduce malware execution
- Control applications on workstations
- Limit execution from temporary directories
- Reduce the attack surface created by unapproved software
The ACSC provides technical guidance showing how application control can prevent certain types of executable content from running in locations commonly used by attackers.
This does not mean every organisation needs to block every application.
The controls should reflect the organisation’s actual business requirements.
6. Restrict Microsoft Office Macros
Microsoft Office files can contain macros that perform automated actions.
Historically, malicious macros have been used to deliver malware or execute unwanted activity when users open compromised documents.
The Essential Eight therefore includes controls around Microsoft Office macros.
Businesses should review:
- Which macros are required
- Which users need them
- Whether macros from untrusted locations should be blocked
- Whether legitimate business processes can work without them
- Whether exceptions are properly controlled
The objective is to reduce the opportunity for attackers to use malicious Office documents as an initial access or execution mechanism.
7. User Application Hardening
User application hardening focuses on reducing security weaknesses in applications that employees regularly use.
This can include browsers, email clients, PDF software and other applications that interact with potentially untrusted content.
For example, businesses may need to review:
- Browser security settings
- Email client configurations
- PDF application settings
- Unnecessary browser features
- Content execution settings
- Security-related application configurations
This strategy is particularly relevant because employees regularly interact with websites, emails, documents and other content that may originate outside the organisation.
8. Regular Backups
Backups are one of the most important parts of cyber resilience.
If ransomware, accidental deletion, system failure or another incident affects important information, reliable backups can help an organisation recover.
But simply having a backup does not mean a business is prepared.
Effective backup practices should consider:
- What information needs to be backed up
- How frequently it should be backed up
- Where backups are stored
- How backups are protected
- How long backups are retained
- Whether restoration has been tested
The Essential Eight includes regular backups as one of its eight core strategies.
Businesses should therefore test their ability to restore important systems and information rather than assuming their backups will work when needed.
What Are the Essential Eight Maturity Levels?
The Essential Eight uses four maturity levels, from Maturity Level Zero through Maturity Level Three.
The levels represent increasing levels of protection against increasingly capable and targeted threat activity.
| Maturity level | General purpose |
|---|---|
| Maturity Level Zero | Indicates weaknesses in the organisation’s overall security posture |
| Maturity Level One | Addresses common and opportunistic attack techniques |
| Maturity Level Two | Addresses more capable attackers and attempts to bypass controls |
| Maturity Level Three | Addresses more adaptive and targeted threat activity |
The ACSC states that Maturity Level One may generally be suitable for small and medium enterprises, while Level Two may be suitable for larger organisations and Level Three for critical infrastructure and other higher-threat environments. However, organisations should choose their target based on their own environment, risk and consequences of compromise.
What Does Essential Eight Maturity Level One Mean?
For many Australian small and medium businesses, Maturity Level One is the logical place to start.
The goal is to address common weaknesses that opportunistic attackers can exploit.
At this level, businesses need to establish controls across all eight strategies rather than treating the framework as a pick-and-choose list.
The ASD recommends organisations implement the strategies progressively and aim to achieve the same maturity level across all eight strategies before moving to higher maturity levels.
A practical Maturity Level One starting checklist
Businesses should review whether they have:
- A managed application patching process
- Operating system patching
- MFA for relevant accounts
- Restricted administrative privileges
- Appropriate application control
- Microsoft Office macro controls
- Hardened user applications
- Secure and tested backups
This should be treated as a security improvement program, rather than a one-time checkbox exercise.
Does Every Australian Business Need the Same Essential Eight Maturity Level?
No.
The appropriate maturity target depends on factors such as:
- Business size
- Industry
- Sensitive information handled
- Technology environment
- Internet exposure
- Regulatory requirements
- Critical business systems
- Consequences of downtime
- Existing cybersecurity capabilities
- Threat environment
The ASD specifically recommends a risk-based approach when implementing the Essential Eight.
For example, a small professional services firm may have a very different risk profile from a large organisation operating critical infrastructure.
The framework should therefore be used as a risk-based security baseline, not as a universal checklist where every organisation must immediately implement the highest maturity level.
Is the Essential Eight a Compliance Requirement?
This is an important distinction.
The Essential Eight is a cybersecurity framework and baseline. It is not automatically a legal requirement for every Australian business.
Some organisations may have specific obligations because of:
- Government contracts
- Industry regulations
- Client requirements
- Insurance requirements
- Internal security policies
- Regulatory expectations
The ASD notes that an Essential Eight implementation may need independent assessment where this is required by a government directive or policy, regulatory authority or contractual arrangement.
Businesses should therefore determine whether they need to implement, assess or demonstrate compliance with specific controls based on their individual obligations.
How Do You Assess Your Business Against the Essential Eight?
An Essential Eight assessment should look beyond whether a security product has been purchased.
The important question is whether the required controls are actually implemented and working effectively.
A practical review can begin with:
1. Identify your technology environment
Document:
- Users
- Devices
- Applications
- Servers
- Cloud services
- Important data
- Internet-facing systems
2. Review each Essential Eight strategy
Assess the current state of each control.
3. Identify gaps
Document where requirements are missing, inconsistent or ineffective.
4. Establish your target maturity level
Your target should reflect your organisation’s risk profile.
5. Prioritise improvements
Address the most important gaps first.
6. Test the controls
Security controls should be validated rather than simply marked as implemented.
The ASD has published a dedicated Essential Eight assessment process guide, including assessment methods and example test plans for different maturity levels.
Essential Eight vs Other Cybersecurity Controls
The Essential Eight should not be viewed as the complete cybersecurity strategy for every organisation.
It provides a strong baseline, but businesses may need additional controls depending on their environment.
For example:
| Security area | How it can complement the Essential Eight |
|---|---|
| Email security | Helps reduce phishing and malicious email threats |
| Endpoint security | Adds protection and monitoring for business devices |
| Identity security | Strengthens authentication and access management |
| Cloud security | Addresses risks in cloud environments |
| SIEM | Centralises security logs and supports investigation |
| EDR | Helps detect and investigate endpoint threats |
| Threat detection | Improves visibility into suspicious activity |
| Incident response | Helps organisations prepare for security incidents |
| Security awareness | Helps employees recognise and report threats |
This is where businesses can move from basic security controls towards a more mature security strategy.
CyberXera’s organisational services include corporate cybersecurity training and advisory, security posture review, incident response simulations, SIEM and security tool enablement, SOC workflow improvement, cloud and endpoint security, and identity and access security.
What Should a Small Business Do First?
If your business has not yet started working towards the Essential Eight, don’t try to solve everything at once.
Start by understanding your current security position.
A practical first step
- Identify your important systems and information.
- Turn on MFA for important accounts.
- Establish a reliable patching process.
- Review administrator privileges.
- Check whether unauthorised applications can run.
- Review Microsoft Office macro settings.
- Harden commonly used applications.
- Check whether important data is backed up.
- Test whether backups can actually be restored.
- Document remaining security gaps.
- Set a realistic target maturity level.
- Create a plan for improving the remaining controls.
The ACSC’s small business guidance starts with MFA, software updates and backups, then recommends progressing towards Essential Eight Maturity Level One.
Is the Essential Eight Changing in 2026?
Yes, this is an important development for Australian businesses.
The Australian Signals Directorate announced in June 2026 that it was consulting on the evolution of the Essential Eight into a new Essentials series. The proposed approach is intended to provide organisations with greater flexibility while maintaining a clear path towards stronger cyber resilience.
This does not mean businesses should ignore the Essential Eight today.
The existing Essential Eight remains an established framework, and the proposed evolution is intended to maintain strong alignment with existing controls and investments.
For businesses currently improving their cybersecurity, the practical approach is to continue using the current Essential Eight guidance while monitoring official ASD updates about the new Essentials series.
How Can CyberXera Help?
CyberXera works with organisations that want to strengthen their cybersecurity readiness through practical cybersecurity solutions, training and advisory services.
Its organisational services include:
- Corporate cybersecurity training and advisory
- Security posture review and advisory
- Security tool onboarding and usage guidance
- Incident response simulations
- SOC workflow design and improvement
- Cloud and endpoint security
- Identity and access security
CyberXera also works with enterprise security technologies including SIEM platforms, EDR tools, cloud and endpoint security platforms, and identity and access security solutions.
For a business considering the Essential Eight, the first step should not necessarily be buying another security product.
It should be understanding where the current security gaps are, what maturity level makes sense and which improvements should be prioritised first.
A security posture review can help turn the Essential Eight from a list of controls into a practical security improvement plan.
Frequently Asked Questions
What is the Essential Eight?
The Essential Eight is a set of eight prioritised cybersecurity mitigation strategies developed by the Australian Signals Directorate. It is designed to make it harder for attackers to compromise internet-connected information technology systems.
What are the eight Essential Eight controls?
They are patch applications, patch operating systems, multi-factor authentication, restrict administrative privileges, application control, restrict Microsoft Office macros, user application hardening and regular backups.
Is Essential Eight mandatory for Australian businesses?
Not automatically. The framework may become relevant through specific government, regulatory, contractual or industry requirements, but not every Australian business is subject to the same obligations.
What Essential Eight maturity level should a small business target?
The ASD states that Maturity Level One may generally be suitable for small and medium enterprises. Businesses should still determine their target based on their own risk profile and environment.
Is Essential Eight the same as cybersecurity compliance?
No. The Essential Eight is a cybersecurity mitigation framework. Whether an organisation needs to demonstrate compliance or undergo an assessment depends on its specific obligations.
Can the Essential Eight protect a business from every cyber attack?
No cybersecurity framework can guarantee complete protection. The ASD describes the Essential Eight as a baseline and recommends considering other mitigation strategies and security guidance based on the organisation’s environment and risk.
Is the Essential Eight still relevant in 2026?
Yes. The current Essential Eight remains an established Australian cybersecurity framework. ASD is also consulting on evolving it into a broader Essentials series, so businesses should monitor official updates while continuing to use current guidance.
How can a business prepare for an Essential Eight assessment?
Start by documenting your technology environment, reviewing each of the eight strategies, identifying gaps, selecting an appropriate maturity target and testing whether controls are actually implemented and effective. The ASD provides an assessment process guide and example test plans.
Final Takeaway
The Essential Eight is not about buying eight cybersecurity products.
It is about implementing eight prioritised security strategies that make common attacks harder to carry out and improve an organisation’s overall security posture.
For many Australian small and medium businesses, Maturity Level One provides a practical starting point. From there, organisations can strengthen their security based on their risk, technology environment and business requirements.
The most effective approach is to start with the fundamentals, measure where your business currently stands and then improve the controls that matter most.
And as Australia’s cybersecurity guidance evolves in 2026, businesses should continue monitoring ASD updates around the proposed Essentials series rather than treating cybersecurity as a one-time compliance exercise.
If you want to understand where your organisation currently stands, CyberXera provides security posture review and advisory, cybersecurity training, security tool guidance, incident response simulations, cloud and endpoint security, and identity and access security for organisations.
