Essential Eight: Australia's Baseline Cyber Mitigations and Maturity Levels

The Essential Eight is the Australian Signals Directorate's prioritised set of eight mitigation strategies that make it much harder for adversaries to compromise systems. Together with its Maturity Model, it is the most widely used cyber security baseline in Australia: mandatory for many federal government entities, referenced in procurement and cyber insurance, and increasingly expected of the IT and software suppliers that serve Australian organisations.

The Maturity Model was last updated in November 2023 and remains the version organisations are assessed against. In June 2026, ASD released a draft "Essentials" series for consultation, describing it as the evolution of the Essential Eight, with a more principles-based, threat-informed design. This guide explains the eight strategies, maturity levels, key requirements, assessment, who must comply, and how to prepare for the transition.

What is the Essential Eight?

The Essential Eight comes from ASD's broader Strategies to Mitigate Cyber Security Incidents. ASD selected eight strategies as a baseline because, when implemented together, they are effective against a wide range of common threats, particularly those targeting Microsoft Windows-based networks connected to the internet. The Essential Eight Maturity Model, first published in 2017 and updated several times since, defines what implementation looks like at different levels of maturity.

ASD's guidance is designed primarily for Windows desktops and servers and internet-connected networks. It can be applied to other environments, such as cloud services and other operating systems, but alternative guidance may be more suitable for some technologies.

The eight mitigation strategies

Strategy	Purpose
Application control	Allow only approved applications, scripts, libraries and drivers to run.
Patch applications	Fix vulnerabilities in applications such as browsers, office software, PDF readers and internet-facing services quickly, and remove unsupported applications.
Configure Microsoft Office macro settings	Block macros from the internet and allow only vetted or trusted macros.
User application hardening	Configure browsers and applications to block risky content, such as web advertisements, Java and unneeded features.
Restrict administrative privileges	Limit and validate privileged accounts, separate them from daily use, and remove unnecessary access.
Patch operating systems	Fix operating system vulnerabilities quickly and use supported versions.
Multi-factor authentication	Require MFA for users, online services, privileged actions and important data repositories, with phishing-resistant methods at higher levels.
Regular backups	Back up important data, software and configuration, test restoration, and protect backups from unauthorised change.

The strategies group into three aims: preventing malware delivery and execution (the first four), limiting the extent of incidents (the next three), and recovering data and availability (backups).

Maturity levels

The Maturity Model defines four levels, from zero to three, based on the sophistication of adversaries the organisation aims to resist:

Level	Adversary assumption
Maturity Level Zero	Weaknesses in overall cyber security posture.
Maturity Level One	Opportunistic adversaries using widely available tools and known weaknesses.
Maturity Level Two	Adversaries willing to invest more time and use more effective tools, targeting weaknesses and bypassing some controls.
Maturity Level Three	Adaptive adversaries who exploit new weaknesses quickly, target privileged credentials and evade detection.

ASD recommends that organisations aim for the level appropriate to their threat environment, and implement all eight strategies to the same level before moving higher, rather than reaching level three in some and level zero in others.

Key requirements by level

Each strategy has specific requirements at each level. Examples from the current model include:

• Patching: vulnerabilities in internet-facing services patched within two weeks of release, or within 48 hours when a working exploit exists; vulnerabilities in common applications such as browsers and office suites patched within a set time, which shortens at higher levels; vulnerability scanning frequency increases with maturity; unsupported applications and operating systems removed.
• MFA: required for users of online services holding sensitive data at level one; extended to privileged users, system administrators and important data repositories at level two; phishing-resistant MFA increasingly expected at higher levels.
• Administrative privileges: requests validated, privileged accounts prevented from accessing the internet, email and web services, privileged access reviewed and disabled after a period of inactivity, and, at higher levels, just-in-time administration and logging of privileged actions.
• Application control: applied to workstations at lower levels and extended to servers and more file types at higher levels, with event logging.
• Backups: performed and retained according to business continuity requirements, restoration tested, and unprivileged accounts prevented from modifying or deleting backups, with stricter protection at higher levels.

Refer to the current Maturity Model on cyber.gov.au for the full requirements, which are detailed and change with updates.

Who must comply?

• Non-corporate Commonwealth entities under the Protective Security Policy Framework, which expects implementation of the Essential Eight to Maturity Level Two and annual reporting.
• Other government bodies, including many state agencies, which adopt it through their own policies.
• Suppliers and managed service providers to government and large enterprises, through contracts.
• Businesses that use it voluntarily, often prompted by boards, insurers or customers.

Is it mandatory or voluntary?

Mandatory for non-corporate Commonwealth entities; voluntary for others. There is no formal certification, but self-assessments, assessor reports and maturity statements are widely requested. ASD's own reporting has shown that many federal entities still had not reached Maturity Level Two, which is why the government continues to emphasise it.

The 2026 transition to the Essentials series

In June 2026, ASD released a draft standard for consultation, describing it as the start of an "Essentials" series that the Essential Eight guidance will evolve into, beginning with Essentials for enterprise IT and adding operational technology guidance over time. ASD describes the series as prioritised, threat-informed mitigations for contemporary technology environments, designed to be flexible, compatible with existing Essential Eight programmes and future-focused. Reporting on the consultation indicates the new approach may move away from a single maturity ladder, and that existing maturity ratings will not simply carry over, so organisations would need to be assessed again under the new framework. Until ASD publishes the final framework and transition timetable, the November 2023 Maturity Model remains the reference.

Assessing maturity and evidence quality

ASD publishes an assessment process guide to help assessors test Essential Eight controls consistently. Good assessments rely on evidence that directly shows controls working, such as running a test to confirm an unapproved executable is blocked, or checking system configuration and patch data, rather than relying on policy documents or interviews alone. A strategy only achieves a maturity level when all requirements for that level are met for the systems in scope. Organisations should keep evidence current, because a single unpatched internet-facing server or an admin account without MFA can drop the assessed level.

Applying it in cloud-native and SaaS companies

Software companies with few Windows desktops and mostly cloud infrastructure can still use the Essential Eight as a baseline. Practical translations include: application control on engineers' laptops and management workstations; patching container images, managed runtimes and dependencies as "applications"; hardening browsers and disabling Office macros for staff; strict separation of cloud console administrator roles with just-in-time elevation; patching virtual machine images and keeping managed services on supported versions; enforcing phishing-resistant MFA for the identity provider, cloud consoles and code repositories; and immutable, cross-account backups with restore tests. Customers in Australia will often ask suppliers to describe their position against each strategy, even if formal maturity levels do not map perfectly to cloud environments.

Beyond the Essential Eight

The Essential Eight is a baseline, not a complete security programme. ASD's wider Strategies to Mitigate Cyber Security Incidents include many more measures, such as network segmentation, centralised logging and monitoring, email content filtering, data loss prevention and incident response planning. The Information Security Manual provides detailed controls for government systems. Organisations that reach their target maturity should consider these additional strategies according to their risks.

Benefits and limitations

• Benefits: clear priorities, measurable maturity, strong recognition in Australian government and industry, and good protection against common attacks for the effort involved.
• Limitations: designed mainly for Windows-based networks, can be hard to map to cloud-native environments, focuses on technical controls rather than governance, and is about to change as ASD moves to the Essentials series.

How to implement, step by step

1. Choose a target maturity level based on your threat environment and customer or regulatory requirements.
2. Assess current maturity for each of the eight strategies, using ASD's assessment process guidance.
3. Prioritise gaps so all strategies reach the same level.
4. Implement controls through device management, identity, patching and backup tooling.
5. Collect evidence such as configuration reports, patch compliance, MFA coverage and restore tests.
6. Reassess regularly, at least annually, and after major changes.
7. Track the Essentials series and plan for reassessment under it.

Reporting maturity to boards and customers

Because maturity is measured per strategy, a simple table of the eight strategies with current and target levels is an effective way to brief boards, insurers and customers. It shows progress at a glance and highlights the weakest strategy, which usually limits overall maturity. Pair the table with a few metrics, such as percentage of devices patched within target time, MFA coverage for privileged and remote users, number of privileged accounts, and date of the last successful restore test. Keep claims precise: say which systems are in scope and when they were assessed, rather than stating that the whole organisation is at a given level.

Documentation you will need

• Target maturity statement and scope.
• Maturity assessment results per strategy.
• Application control policies and logs.
• Patch and vulnerability scan reports.
• Macro and application hardening configurations.
• Privileged access registers and reviews.
• MFA coverage reports.
• Backup schedules and restore test records.

Timeline and cost considerations

Reaching Maturity Level One across all strategies can take a few months for a small organisation with modern tooling. Level Two and especially application control and level three privileged access controls take longer and need investment in device management, identity and logging. Costs are mainly tooling and staff time; many controls can be achieved with features already in modern operating systems and cloud identity platforms.

Common mistakes

• Uneven maturity, with strong MFA but no application control.
• Admin accounts used for email and browsing.
• Backups never restored or deletable by ordinary admins.
• Patching only operating systems, not applications and internet-facing services.
• Treating cloud and SaaS as out of scope for MFA and admin controls.
• Self-assessments without evidence.

Best practices, tools and technologies

• Use endpoint management to enforce patching, macro settings and hardening.
• Deploy application control with publisher rules and logging.
• Use phishing-resistant MFA such as security keys or passkeys for administrators.
• Adopt just-in-time privileged access and log all admin actions.
• Keep immutable backups and test restores regularly.
• Scan internet-facing services daily and patch quickly.

We build and maintain web and SaaS systems with MFA, fast patching, least privilege, hardened configurations and tested backups through our maintenance and support and migration services.

How it relates to other frameworks

Framework	Relationship
Cyber Essentials	UK baseline certification with similar controls but a pass or fail model.
CIS Controls	Broader prioritised control set with implementation groups.
ISO/IEC 27001	Full management system; Essential Eight provides concrete technical controls within it.
Australian Privacy Act	APP 11 security duty; Essential Eight is common evidence of reasonable steps.
NIST CSF	Outcome framework into which the eight strategies map.

Real-world example

An Indian managed service provider supporting Australian councils is asked to show Maturity Level Two for the systems it manages. It enforces phishing-resistant MFA for its engineers, moves administration to separate privileged accounts with just-in-time elevation, sets patching targets within the model's timeframes with daily scans of internet-facing services, deploys application control on management workstations, and keeps immutable backups with quarterly restore tests. It provides each council with an evidence pack mapped to the eight strategies and tracks ASD's Essentials series to plan for reassessment.

Next steps

1. Pick a target maturity level.
2. Assess all eight strategies.
3. Close gaps evenly.
4. Collect evidence.
5. Watch for the final Essentials series.

Frequently asked questions

What is the Essential Eight?

Eight prioritised mitigation strategies from the Australian Signals Directorate to protect against common cyber threats.

What are the eight strategies?

Application control, patch applications, configure Microsoft Office macros, user application hardening, restrict administrative privileges, patch operating systems, MFA and regular backups.

Is the Essential Eight mandatory?

For non-corporate Commonwealth entities, yes, to Maturity Level Two; for others it is voluntary but often required by buyers.

What are the maturity levels?

Levels zero to three, reflecting increasing adversary capability the organisation can resist.

Is there an Essential Eight certification?

No formal certification exists; organisations self-assess or use independent assessors.

Is the Essential Eight being replaced?

ASD consulted in 2026 on an Essentials series that will evolve from it; until finalised, the November 2023 Maturity Model applies.

Will my maturity level carry over to the new framework?

Reports indicate existing ratings will not simply carry over, so reassessment will be needed.

Does the Essential Eight apply to cloud services?

It is designed mainly for Windows networks but its principles, especially MFA, patching, admin control and backups, apply to cloud environments.

Which level should a supplier target?

Usually the level the customer requires; Maturity Level Two is a common expectation for government work.

How does it compare with Cyber Essentials?

Both set baseline controls; Cyber Essentials is a UK pass or fail certification, while the Essential Eight uses maturity levels.

How often should maturity be assessed?

At least annually, and after significant changes to systems, because a single gap such as an unpatched internet-facing service can lower the assessed level.

Does the Essential Eight cover governance and incident response?

Not directly. It focuses on technical mitigations; organisations add governance, logging and incident response from other ASD guidance or frameworks such as ISO/IEC 27001.