The Essential Eight is a set of eight mitigation strategies published by the Australian Signals Directorate (ASD) through the Australian Cyber Security Centre. It is the baseline much Australian cyber security advice is built on, and it works as a practical checklist for a business with five staff.
Update, October 2026: on 15 October 2026 ASD released the Essentials series, which it describes as an evolution of the Essential Eight. ASD is maintaining both frameworks during the transition, and no end date for the Essential Eight has been set, so the advice below still applies. Read what ASD Essentials means for your business.
This article covers what the eight strategies are, what the maturity levels mean, and a practical place to start.
The eight strategies
The strategies fall into three rough groups: stopping malicious code from running, limiting the damage if an attacker gets in, and being able to recover.
Stop attacks from running
- Application control. Only approved programs are allowed to run on your computers. Anything else, including a malicious file someone downloads, is blocked.
- Patch applications. Keep software such as web browsers, Microsoft Office, PDF readers and online services up to date, and remove software the vendor no longer supports.
- Configure Microsoft Office macro settings. Macros are small programs inside Office files. Attackers hide malicious code in them, so macros from the internet should be blocked.
- User application hardening. Turn off features in browsers and other applications that attackers commonly abuse and that your staff do not need.
Limit the damage
- Restrict administrative privileges. Staff should not use administrator accounts for everyday work like email and browsing. Admin rights go only to the people who need them, for the tasks that need them.
- Patch operating systems. Keep Windows, macOS and other operating systems current, and replace versions that no longer receive security updates.
- Multi-factor authentication (MFA). A password alone is not enough to sign in. A second factor, such as an authenticator app, is required.
Recover
- Regular backups. Back up important data, software and settings, keep the backups protected, and test that you can actually restore from them.
What the maturity levels mean
Each strategy can be implemented to a maturity level. The levels describe the type of attacker you are defending against.
- Maturity Level Zero. There are weaknesses in the organisation's overall cyber security posture. Most businesses that have never looked at the Essential Eight sit here for at least some strategies.
- Maturity Level One. Aimed at adversaries who are content to use commodity tradecraft: widely available tools, public exploits for unpatched systems, and stolen or weak passwords. This is the opportunistic attacker who targets whoever is easiest.
- Maturity Level Two. Aimed at adversaries with a modest step up in capability. They are more selective, use phishing, and try to get around weak MFA.
- Maturity Level Three. Aimed at adversaries who are more adaptive and much less reliant on public tools. They look for weaknesses such as older software and poor logging, go after privileged accounts and try to avoid detection.
The guidance is to pick a target maturity level that suits your environment and risk, then progressively implement each level until you reach that target. For most small businesses, Maturity Level One across all eight strategies is the right first target. Reaching level one on every strategy gives you far more protection than reaching level three on two strategies while the rest sit at zero.
What "patched" means at level one
Patching is where vague intentions usually fall down, so it helps to know the actual timeframes. At Maturity Level One:
- Security fixes for online services are applied within 48 hours of release when the vendor rates the vulnerability as critical or a working exploit exists.
- Non-critical fixes for online services are applied within two weeks of release.
- Fixes for office suites, web browsers and their extensions, email clients, PDF software and security products are applied within two weeks of release.
- Those same types of software, and online services, are removed once the vendor stops supporting them.
If nobody in your business could tell you when the last browser update was applied on each computer, that is the first gap to close.
Where a small business should start
The Essential Eight does not set a strict order between the strategies. In practice, a small business gets the quickest gains from the strategies that need the least ongoing effort once they are set up. This is a sensible sequence.
- Turn on MFA everywhere. Start with email and Microsoft 365, then remote access, accounting software, banking and any cloud system holding client data. Use an authenticator app over text messages where you can.
- Get backups right. Confirm what is backed up, including Microsoft 365 mailboxes, OneDrive and SharePoint. Make sure at least one copy cannot be deleted or encrypted by someone who gets into your network. Then restore a file and a mailbox to prove it works.
- Take away everyday admin rights. Staff accounts should be standard users. Keep a separate admin account for the person or provider who manages your systems.
- Automate patching. Use a management tool such as Microsoft Intune to push Windows and application updates on a schedule, and to report which devices are behind.
- Block internet macros and harden browsers. These are policy settings that can be applied across every device at once.
- Add application control. This takes the most planning because you need a list of the software your business actually uses.
Microsoft 365 Business Premium includes tools that cover several of the strategies, including Intune, Defender for Business and Conditional Access for MFA. The licence alone does nothing until the settings are configured and checked.
How to know where you stand
Assess each strategy honestly against the level you are targeting, and write it down. A simple table with the eight strategies, your current level, the gap and an owner is enough to start. Revisit it every quarter, because settings drift as devices and staff change. If you would like a quick view of your current position, our free two-minute Cyber Risk Scorecard covers the same ground.
Summary checklist
- Know the eight strategies and record your current maturity level for each.
- Set Maturity Level One across all eight as your first target.
- Turn on MFA for email, remote access and every cloud system first.
- Back up Microsoft 365 data as well as files and servers, and test a restore.
- Remove admin rights from everyday accounts.
- Patch online services within 48 hours for critical issues and two weeks otherwise.
- Remove software that no longer receives vendor updates.
- Plan application control as the final step to level one.
- Review the table every quarter.