The Essential Eight, explained in plain English

What it is

The Essential Eight is a set of eight mitigation strategies published by the Australian Signals Directorate (ASD) through its Australian Cyber Security Centre. It was first published in June 2017 and the maturity model was last updated in November 2023.

“The Essential Eight has been designed to protect organisations' internet-connected information technology networks.”

ASD, Essential Eight Maturity Model

It is a prioritised baseline, not a complete security program. The idea is that doing these eight things properly stops most common attacks, and makes the rest much more expensive for the attacker.

The eight strategies

The names are ASD's. The plain-English descriptions are ours.

1. 1Patch applicationsKeep the software your staff use up to date, so known holes are closed quickly.
2. 2Patch operating systemsThe same for Windows, macOS and servers. Replace versions the vendor no longer supports.
3. 3Multi-factor authenticationA second proof of identity on top of a password, above all for email, remote access and admin accounts.
4. 4Restrict administrative privilegesAdmin rights only for the people and tasks that need them, kept apart from everyday accounts.
5. 5Application controlOnly approved software is allowed to run, which stops most malware before it starts.
6. 6Restrict Microsoft Office macrosBlock macros that arrive from the internet. Allow them only where there is a real business need.
7. 7User application hardeningSwitch off the risky extras in browsers, Office and PDF readers that attackers lean on.
8. 8Regular backupsBack up important data and settings, protect the copies, and prove that a restore works.

One useful way to hold them in your head is by the job each one does:

• Keep attackers out: patch applications, application control, restrict Office macros, user application hardening.
• Limit how far they get: multi-factor authentication, restrict administrative privileges, patch operating systems.
• Get back up again: regular backups.

The maturity levels

ASD defines four maturity levels. Each is set by the skill of the attacker it is meant to stop, which is a more honest measure than a percentage score. The quoted words are ASD's.

1. ML0
   Maturity Level Zero

   Signifies “weaknesses in an organisation's overall cybersecurity posture.”

2. ML1
   Maturity Level One

   Aimed at “malicious actors who are content to simply leverage commodity tradecraft”: widely available tools, used against anyone who happens to be vulnerable.

3. ML2
   Maturity Level Two

   Aimed at “malicious actors operating with a modest step-up in capability”: willing to spend more time on a chosen target.

4. ML3
   Maturity Level Three

   Aimed at “malicious actors who are more adaptive and much less reliant on public tools and techniques.”

Two rules matter more than the labels. First, a level only counts when every one of the eight strategies meets it. Being at Level Two for backups and Level Zero for patching makes you Level Zero. ASD's instruction is that “organisations should plan their implementation to achieve the same maturity level across all eight mitigation strategies before moving onto higher maturity levels.”

Second, the right target depends on you. ASD says the choice should weigh how likely you are to be targeted and what an incident would cost you. For most smaller businesses, Maturity Level One across all eight is a sensible first target, and it is harder than it sounds.

Does my business have to comply?

For most private businesses, no. The Essential Eight is guidance, not law.

It is mandatory for some. Non-corporate Commonwealth entities are required to reach Maturity Level Two under the Protective Security Policy Framework.

The practical answer is different from the legal one, though. The Essential Eight is commonly referenced in government supply-chain contracts, tender documents and cyber insurance questionnaires, and larger customers ask about it in security reviews. You may never be required to comply and still be asked where you stand.

Is there an Essential Eight certificate?

No. ASD does not issue one, and its maturity model says “there is no requirement for organisations to have their Essential Eight implementation certified by an independent party.”

An independent assessment can still be required by a government directive, a regulator or a contract. When one is done properly it follows ASD's Essential Eight Assessment Process Guide, which sets out how each control is tested and how the results are recorded. Treat any “Essential Eight certified” badge with care and ask who did the assessment and against which version of the model.

Where to start

If you are starting from very little, these usually give the most protection for the least disruption:

1. Multi-factor authentication on email and every administrator account.
2. Automatic patching for operating systems, browsers and Microsoft 365 apps.
3. Backups you have tested by restoring something real.
4. No everyday admin rights. Staff, and owners, work from standard accounts.
5. Macros from the internet blocked.

Application control is usually the hardest of the eight and is best planned rather than rushed. If you would rather know exactly where you stand first, that is what a gap analysis is for.

What is changing

In June 2026 ASD opened consultation on evolving the Essential Eight into a broader “Essentials” series, with “Essentials for enterprise IT” as the first chapter. Consultation closed on 12 July 2026.

At the time of writing, in October 2026, ASD had not published final guidance, and the Essential Eight Maturity Model last updated in November 2023 remained the current version. ASD has not published a retirement date for it.

The sensible response is to keep going. Multi-factor authentication, fast patching, tight admin privileges and tested backups are not going out of date under any framework. Check cyber.gov.au for the latest, since this section will age faster than the rest of the guide.

How Lumetra helps

• On our Fortified plan we work your environment toward Essential Eight alignment and report monthly on which controls are in place and which are outstanding. That is implementation work, not a rating of it.
• Our Gap Analysis, from $3,500 as a fixed fee, gives you a control-by-control position on an environment we didn't build, with a costed roadmap.
• If you need independent assurance for an insurer, auditor or tender, we'll point you to an independent assessor rather than grade our own work.

This guide is general information for Australian businesses, correct to the best of our knowledge when it was last reviewed. It is not legal, financial or security advice for your specific situation.