The Essential Eight explained for Australian businesses
The Essential Eight is a set of 8 baseline security strategies published by the Australian Signals Directorate (ASD). This page explains what each one means and where a business should start.
What the Essential Eight is
The Essential Eight is ASD's shortlist of mitigation strategies that make it much harder for attackers to compromise a system. Commonwealth bodies are directed to implement it, and many businesses use it as a practical benchmark.
It is guidance, not a certificate. Some contracts, insurers and customers ask whether you follow it, so check the terms that apply to you.
The 8 strategies
- Application control
- Only approved programs can run, which stops most malware that arrives as an unknown file.
- Patch applications
- Security updates for software such as browsers, PDF readers and Office are installed quickly, serious flaws first.
- Configure Microsoft Office macro settings
- Macros are blocked unless there is a clear business need and a trusted source.
- User application hardening
- Web browsers, Office and PDF software are set up to block features that attackers commonly abuse.
- Restrict administrative privileges
- Administrator access goes only to the people who need it, and is used only for administrator tasks.
- Patch operating systems
- Windows, macOS and server systems are updated promptly, and versions that no longer get updates are replaced.
- Multi-factor authentication
- Signing in needs more than a password, especially for remote access, administrators and important data.
- Regular backups
- Important data, software and settings are backed up, stored apart from the main network and tested by restoring.
Maturity levels
ASD describes maturity levels from 0 to 3. Level 0 means significant gaps. Levels 1 to 3 describe how closely a business matches each strategy and how well it holds up against more capable attackers. ASD updates the model from time to time, so read the current version on cyber.gov.au.
Where a small business should start
Most small businesses gain the most from multi-factor authentication on every account, prompt updates for devices and software, and backups that have been tested by restoring. Those 3 strategies cover a large share of everyday risk.
Our Microsoft 365 security review, managed cyber and IT and vulnerability assessment give you a ranked view of the gaps behind these strategies.
Common questions
What is the Essential Eight?
A set of 8 baseline mitigation strategies from the Australian Signals Directorate: application control, patching applications, Microsoft Office macro settings, user application hardening, restricting administrative privileges, patching operating systems, multi-factor authentication and regular backups.
Is the Essential Eight mandatory for private businesses?
Not as a general rule. It is government guidance, but some contracts, insurers and customers ask for it.
How many Essential Eight maturity levels are there?
ASD defines maturity levels 0 to 3.
Does following the Essential Eight stop every attack?
No. It makes compromise much harder. You still need monitoring, staff awareness and a plan for when something goes wrong.
Start with the free cyber checkup.
The checkup is free and runs on its own site. If you would rather talk first, email the team.