Originally published 5 September 2023. Fully updated for 2026.
When it comes to IT security, no organisation can afford a lax approach. The Essential Eight, published by the Australian Signals Directorate (ASD) through the Australian Cyber Security Centre (ACSC), is still the most practical starting blueprint for Australian businesses. It won't stop every attack, but it shuts the doors that the most common ones walk through: malicious attachments, unpatched software, stolen passwords and ransomware.
This guide covers what each control means, how the maturity levels work, what has changed since we first wrote about it, and how to get started without boiling the ocean.
What is the Essential Eight?
The Essential Eight is a prioritised set of eight mitigation strategies, first published in 2017. ASD grades implementation against a maturity model with four levels:
- Maturity Level Zero: weaknesses exist across the organisation's overall posture.
- Maturity Level One: defends against opportunistic attackers using commodity tools and publicly available techniques.
- Maturity Level Two: defends against attackers willing to invest a bit more time and effort, including targeting specific credentials.
- Maturity Level Three: defends against more adaptive, persistent adversaries.
ASD's guidance is to pick a target maturity level based on your risk, then reach that level across all eight controls before moving higher. Being excellent at three controls and absent on the other five leaves obvious gaps. You can read the full model on cyber.gov.au.
The eight controls in plain English
The controls fall into three groups: stopping malicious code from running, limiting the damage if something gets through, and making sure you can recover.
Prevent attacks from executing
- Application control. Only approved applications, scripts and installers are allowed to run, starting with user profile and temporary folders where malware typically lands. Unknown code simply doesn't execute.
- Patch applications. Keep browsers, Microsoft Office, PDF readers, email clients and security products up to date, and remove software the vendor no longer supports.
- Restrict Microsoft Office macros. Disable macros for anyone without a demonstrated business need, and block macros in files that come from the internet. Macro-laden attachments remain a favourite way in.
- User application hardening. Browsers should not process Java or web ads from the internet, legacy browsers like Internet Explorer 11 should not process internet content, and users should not be able to switch these protections off.
Limit the extent of an incident
- Restrict administrative privileges. Fewer admins, validated requests for privileged access, and admin accounts that can't browse the web or read email. If an everyday account is compromised, the attacker doesn't inherit the keys to everything.
- Patch operating systems. Keep Windows, macOS, servers and network devices current, and replace operating systems that are out of vendor support.
- Multi-factor authentication (MFA). Require a second factor for online services, remote access and privileged accounts. At the higher maturity levels ASD requires phishing-resistant MFA such as passkeys, FIDO2 security keys or Windows Hello for Business, because text-message codes and simple push approvals can be phished or fatigue-bombed.
Recover data and availability
- Regular backups. Back up data, applications and settings in line with how critical they are to the business, keep backups secure and resilient, and test that you can actually restore them. Ordinary users should not be able to access or delete backups.
Our original article called the last control "daily backups". The current model calls it regular backups and focuses on outcomes: frequency and retention set by business criticality, restores tested as part of disaster recovery exercises, and backups protected from the same accounts an attacker might compromise. ASD's November 2023 update also hardened Maturity Level Two, including tighter expectations around phishing-resistant MFA and logging.
What Maturity Level One looks like in practice
For most small and mid-sized Australian businesses, Maturity Level One is the sensible first target, and Level Two is where insurers, larger customers and government supply chains increasingly expect you to land. A few examples of what Level One asks for:
| Control | Maturity Level One expectation (summary) |
|---|---|
| Patch applications | Patches for internet-facing services applied within two weeks of release, or within 48 hours if a working exploit exists. Unsupported applications removed. |
| Patch operating systems | Internet-facing systems patched within the same two-week or 48-hour window; workstations and servers within one month. |
| MFA | Enforced for online services holding sensitive data and for users accessing third-party services with company data. |
| Office macros | Disabled for users without a business need; macros from the internet blocked; users can't change macro settings. |
| Admin privileges | Privileged access validated when requested; privileged accounts barred from email and web browsing. |
| Regular backups | Backups performed and retained to business continuity requirements, restoration tested, backups protected from unprivileged users. |
This is a summary, not a substitute for the model itself. The exact wording matters when an assessor or insurer is asking the questions.
The Essential Eight is evolving: the new Essentials series
In June 2026, ASD announced that the Essential Eight will evolve into a broader body of guidance called the Essentials series. The first chapter, Essentials for enterprise IT, builds on the current Essential Eight and went through public consultation that closed in July 2026, with further chapters planned for other technology environments. The stated direction is more flexibility and a stronger focus on intended outcomes rather than purely prescriptive controls.
What matters for most businesses:
- The Essential Eight remains live and supported during a transition period, so current assessments, insurance questionnaires and contracts that reference it still apply.
- Existing work carries over. ASD has said organisations already using the Essential Eight should find their current controls and tools map naturally into the new framework.
- Don't pause your uplift. Patching, MFA, admin restrictions and tested backups will be foundational under any version of the guidance.
We will update this article as the final Essentials guidance is published.
How to get started
- Assess where you are. An honest baseline across all eight controls, ideally with evidence rather than self-reported answers. Our compliance & security auditing service starts exactly here.
- Fix the quick, high-impact gaps first. MFA everywhere, admin account separation, macro settings and automated patching are usually the fastest wins in a Microsoft 365 environment.
- Protect your ability to recover. Make sure Microsoft 365 or Google Workspace data is backed up independently and that restores are tested. See cloud backup & disaster recovery.
- Tackle application control deliberately. It delivers a lot of protection but needs planning so it doesn't block legitimate work.
- Monitor and keep evidence. Controls drift. Continuous monitoring, such as a Security Operations Centre watching your environment, keeps you honest between assessments.
The Essential Eight lays the groundwork, but it is the start of the journey, not the finish line. Treat it as an ongoing commitment rather than a checklist: reach a consistent level across all eight controls, prove it with evidence, then build from there with security awareness training, phishing simulation and regular penetration testing.
If you are weighing up platforms as part of this work, our comparison of Microsoft 365 vs Google Workspace covers how each handles security administration.