The Essential Eight is a set of prioritised cybersecurity mitigation strategies developed by the Australian Signals Directorate.
Together, the eight strategies help organisations reduce the likelihood and impact of common cyber incidents affecting internet-connected information technology environments.
Patch Applications
Patch Operating Systems
Multi-Factor Authentication
Restrict Administrative Privileges
Application Control
Restrict Microsoft Office Macros
User Application Hardening
Regular Backups
The Essential Eight is not one product, certification or software platform. It is a coordinated set of mitigation strategies covering patching, identity, administrator access, software execution, application security and recovery.
Implementing only one or two strategies may leave significant gaps. The controls are most effective when they are implemented together and maintained consistently.
Each strategy addresses a different part of the attack path and contributes to stronger overall resilience.
Keep browsers, office applications, PDF software, business applications and other software updated to reduce exposure to known vulnerabilities.
Why it matters
Attackers frequently target outdated applications. A structured patching process helps close known security weaknesses before they are exploited.
Keep Windows, macOS, servers and supported operating systems updated with important security patches.
Why it matters
Unsupported or unpatched operating systems can expose business devices, accounts and data to preventable security incidents.
Require an additional authentication factor for important systems, remote access, cloud applications and privileged accounts.
Why it matters
MFA makes it harder for an attacker to access an account using only a stolen or reused password.
Limit administrator access to people who genuinely require it and use separate privileged accounts where appropriate.
Why it matters
Administrator accounts can make significant system changes. Restricting them reduces the impact of compromised accounts and user mistakes.
Control which applications, scripts, installers and software components are allowed to run within the organisation.
Why it matters
Application control helps prevent unauthorised or malicious software from executing on business systems.
Control when Microsoft Office macros can run and prevent untrusted macros obtained from the internet from executing.
Why it matters
Malicious macros have historically been used to deliver malware and gain access to business environments.
Configure browsers, Microsoft Office and other commonly used applications to reduce unnecessary or risky functionality.
Why it matters
Hardening reduces opportunities for malicious content, scripts, advertisements and vulnerable features to be used against employees.
Back up important business data, systems and configuration, protect backups from unauthorised access and test recovery regularly.
Why it matters
Reliable backups help the business recover from ransomware, accidental deletion, system failure and other disruptive incidents.
The Essential Eight maturity model defines four maturity levels, from Maturity Level Zero through to Maturity Level Three. Increasing levels are designed to address increasingly capable malicious actors and targeting.
The organisation has weaknesses in its implementation of the Essential Eight that may allow malicious actors to compromise systems.
Controls are implemented to reduce exposure to common and opportunistic cyber threats using basic tradecraft.
Controls are strengthened to address malicious actors using more advanced techniques and targeting.
Controls are implemented to resist highly capable malicious actors using advanced tradecraft and targeted operations.
An organisation should consider its overall implementation across all eight strategies. Strong performance in one area does not remove weaknesses in another strategy.
Implementation should begin with understanding the environment, selecting an appropriate target and assessing current controls.
Identify users, devices, applications, operating systems, cloud platforms, administrator accounts, backups and important business data.
Choose a maturity target based on business risk, threat exposure, contractual requirements and the consequences of a security incident.
Review both the implementation and effectiveness of controls against the applicable Essential Eight maturity requirements.
Address the highest-risk weaknesses first, particularly identity, patching, privileged access, application execution and recovery.
Introduce technical controls, policies, monitoring, documentation and clear ownership for each strategy.
Verify that controls work as intended and reassess regularly as systems, threats and ASD guidance change.
The Essential Eight requires evidence that controls are implemented and effective, not merely that a setting exists.
The review should consider devices, operating systems, applications, privileged access, backups and the wider technology environment.
Unsupported operating systems and applications may prevent the organisation from meeting patching requirements.
Permanent administrator access increases the potential impact of phishing, malware and account compromise.
Backups must be monitored, protected and recovery-tested before the business can rely on them.
An organisation should generally achieve the requirements for a maturity level across all eight strategies before claiming that overall level.
ArchZen can review your users, devices, Microsoft 365 environment, applications, administrator access, backups, policies and current security controls.
We identify gaps, explain the business risk and create a practical improvement roadmap aligned with your target maturity level and operating environment.
Review the foundational controls protecting your users, devices, accounts and business information.
Assess updates, encryption, endpoint protection, access, monitoring and device recovery.
Review Microsoft 365 identity, email, sharing, device, backup and monitoring controls.
ArchZen is not the Australian Signals Directorate and is not affiliated with or endorsed by ASD. The Essential Eight and its maturity model are developed and maintained by ASD. Organisations should refer to the latest official ASD publications when selecting requirements or conducting a formal assessment.
ArchZen can assess your current controls, identify gaps and create a practical cybersecurity improvement roadmap.