ASD Essential Eight

The ASD Essential Eight is a baseline set of eight mitigation strategies published by the Australian Signals Directorate through the Australian Cyber Security Centre, designed to make it significantly harder for adversaries to compromise systems. The eight strategies cover application control, patching applications, configuring Microsoft Office macros, user application hardening, restricting administrative privileges, patching operating systems, multi-factor authentication, and regular backups.

The Essential Eight represents a minimum preventative baseline rather than a complete security program. It is most effective when used alongside broader frameworks such as the ASD Information Security Manual (ISM), NIST CSF, or ISO27001 to cover detection, response, and governance areas that the Essential Eight doesn't address directly.

The Essential Eight maturity model defines four levels (Maturity Level 0 to Maturity Level 3), reflecting an organisation's resilience against increasingly sophisticated adversaries. Maturity Level 1 protects against opportunistic attackers using publicly available exploits. Maturity Level 2 protects against more capable adversaries using common tradecraft. Maturity Level 3 protects against well-resourced and sophisticated adversaries.

Required maturity depends on your sector, risk profile, and contractual obligations. Maturity Level 2 is mandatory for Australian non-corporate Commonwealth entities under the Protective Security Policy Framework. Most private-sector organisations target Maturity Level 1 or 2 as a practical baseline, with critical infrastructure operators and organisations handling sensitive data aiming for Maturity Level 3. The ACSC recommends achieving the same maturity level across all eight strategies before moving up, to avoid weak links in your security posture.

Our Essential Eight assessments are led by certified consultants with hands-on Microsoft 365 and Azure security expertise. We provide a comprehensive evaluation of your current security posture against the Essential Eight maturity model, identifying gaps against your target maturity level, prioritising recommendations based on risk reduction and remediation effort, and producing an actionable roadmap to achieve your desired level of protection.

Each of the eight mitigation strategies is assessed against the published ACSC requirements, with evidence collected from your existing security tools, configuration, and operational practices. For Microsoft 365 environments, we can also help automate ongoing compliance through Microsoft Purview Compliance Manager - providing continuous monitoring, configuration drift detection, and improvement actions tailored to Australian organisations.

The eight strategies are: application control (preventing execution of unapproved software), patching applications (keeping applications up to date), configuring Microsoft Office macros (restricting macros to those vetted and required), user application hardening (reducing the attack surface of browsers, PDF readers, and other user-facing software), restricting administrative privileges (limiting admin access to authorised users on hardened devices), patching operating systems (keeping OS versions current and supported), multi-factor authentication (requiring MFA for important systems), and regular backups (ensuring data can be restored after an incident).

The strategies are designed to be applied in a specific order recommended by the ACSC, addressing the most common malware delivery and execution vectors first. While the Essential Eight focuses primarily on Microsoft Windows networks, the strategies can be applied effectively to Linux, cloud, and other infrastructure that supports them.

Essential Eight aligns well with broader compliance frameworks rather than competing with them. The Essential Eight controls support specific requirements within ISO27001 (access control, cryptography, operations security), NIST CSF (protective controls under the Protect function), APRA CPS 234 (information security capability), and PCI DSS (system patching, access control, MFA). For Microsoft 365 environments, Essential Eight implementation also strengthens controls relevant to IRAP-aligned deployments.

Most organisations implement Essential Eight as a baseline preventative layer and use other frameworks to cover the governance, detection, response, and recovery requirements that Essential Eight doesn't address. We design Essential Eight implementations so the controls produce evidence usable across multiple compliance programs, rather than running parallel projects that duplicate effort.

Essential Eight Maturity Level 2 is mandatory for all Australian non-corporate Commonwealth entities subject to the Public Governance, Performance and Accountability Act (PGPA), under Section 14.2 of the Protective Security Policy Framework. For other Australian organisations, Essential Eight is not legally mandatory but is widely treated as a de facto baseline, appearing in customer security questionnaires, government contract requirements, cyber insurance applications, and industry compliance expectations.

Critical infrastructure operators under the SOCI Act, APRA-regulated entities under CPS 234, and organisations pursuing IRAP assessments all benefit from Essential Eight implementation as supporting evidence for broader compliance obligations. We assess each organisation's specific obligations and recommend a target maturity level aligned to both regulatory requirements and practical risk reduction.

Essential Eight maturity should be reassessed at least annually, with continuous monitoring of configuration drift in between. The ACSC updates the Essential Eight Maturity Model regularly - including significant November 2023 changes that added requirements for incident response plans, MFA enhancements, and hardening guides - meaning a maturity rating from two years ago may no longer reflect current expectations.

Beyond annual reassessment, we recommend continuous monitoring through Microsoft Purview Compliance Manager (for Microsoft 365 environments) or equivalent tooling, with alerts for configuration drift, policy changes, and excessive privileges. Organisations subject to government contracts, IRAP assessment, or APRA CPS 234 obligations should also reassess after major infrastructure changes, cloud migrations, or workforce restructuring.

Our Essential Eight assessments are delivered by senior consultants with deep Microsoft 365, Azure, and Australian compliance expertise. Engagements are led by certified professionals holding CISA, CISM, and CRISC certifications, with hands-on experience implementing Essential Eight controls across Australian government, financial services, healthcare, and education sectors.

Our team's particular depth in Microsoft Defender, Entra ID, Intune, and Microsoft Purview means our Essential Eight remediation recommendations are technically grounded, not generic advice that requires you to figure out the implementation yourself. ISO 27001 Lead Auditors on staff ensure that Essential Eight evidence maps directly to broader compliance programs where you need it to, and Australian-based delivery means engagements meet government and IRAP-related residency expectations where applicable.