The Essential Eight: a practical guide

By Paul Gillet · Updated 2026-10-17

The Essential Eight is the Australian Signals Directorate's (ASD) baseline of eight mitigation strategies against the most common cyber attacks. ASD publishes it with a Maturity Model that sets out what each strategy requires at Maturity Levels One, Two and Three, and the requirements themselves are controls in ASD's Information Security Manual (ISM).

The eight strategies

• Patch applications: find and patch vulnerabilities in applications, and remove unsupported ones.
• Patch operating systems: the same for operating systems, drivers and firmware.
• Multi-factor authentication: for online services, remote access, privileged users and, at higher levels, data repositories, with stronger (phishing-resistant) methods as the levels rise.
• Restrict administrative privileges: grant, review and log privileged access, and separate privileged environments.
• Application control: only approved programs, scripts, installers and libraries can run.
• Restrict Microsoft Office macros: block macros from the internet and allow only trusted ones.
• User application hardening: harden browsers, Office and PDF software, and restrict PowerShell.
• Regular backups: back up important data, software and settings, test restoration, and protect backups from change and deletion.

Maturity levels

Each level targets a more capable adversary. Level One stops opportunistic attackers using commodity tools. Level Two stops adversaries willing to invest more time and effort. Level Three stops adaptive adversaries who are less reliant on public tools. ASD recommends reaching the same level across all eight strategies before moving any one of them higher, and choosing a target level from your threat environment.

Who must implement it

Australian Government non-corporate Commonwealth entities must implement the Essential Eight under the Protective Security Policy Framework, with Maturity Level Two as the target. Many state governments, regulated businesses and cyber insurers in Australia ask for it too. For everyone else it is a well-tested, prioritised technical baseline.

How assessment works

There is no Essential Eight certificate. Assessments follow ASD's Essential Eight Assessment Process Guide and can be done internally or by a third-party assessor. Each strategy is assessed separately, and a strategy reaches a level only when every requirement at that level, and every level below, is met. Evidence quality matters: testing a control directly is the strongest evidence, reviewing a configuration is good, documentation is weaker, and an interview alone is the weakest.

The steps

1. Choose a target maturity level for the organisation, usually Level Two to start.
2. Assess your current level for each strategy, using system-level testing where you can.
3. Prioritise the gaps, bringing every strategy up to the same level first.
4. Implement and evidence the controls, recording any exceptions with compensating controls and an owner.
5. Reassess regularly: patching and privilege controls drift quickly.

The Essential Eight and other frameworks

ISO 27001 and NIST CSF describe outcomes; the Essential Eight prescribes specific technical settings and timelines. So most Essential Eight controls are only loosely related to ISO or NIST requirements: those frameworks ask you to manage vulnerabilities or control access, but don't tell you to block internet macros or patch within a set time. ASD publishes no crosswalk, so every Essential Eight link on this site is ControlMapping's editorial judgement, with its reason.

How this site helps

ControlMapping lists the ISM controls ASD tags for the Essential Eight, grouped by strategy with their maturity levels, from a pinned ISM release (CC BY 4.0). The table below shows how much of the Essential Eight your existing frameworks already cover; expect it to be modest, which is the point of the Essential Eight.

Already have another framework?

How many Essential Eight requirements each framework you may already follow maps to. Open a gap report for the requirement-by-requirement list.

Crosswalk a published crosswalk (NIST, ENISA, CIS, PCI SSC) makes the link · Editorial ControlMapping's judgement where no crosswalk exists; the reason is shown · Loosely related only shares a CSF 2.0 outcome: worth checking, not a mapping · No mapping in our data nothing mapped in our data; often new work, but check the coverage notes. Counts come from the same data as the gap analysis; a mapping means related requirements, not proof that one satisfies the other.

Questions

Is the Essential Eight mandatory?

For Australian Government non-corporate Commonwealth entities, yes, under the Protective Security Policy Framework. For other organisations it is voluntary, though customers, regulators and insurers may require it.

What maturity level should we aim for?

ASD suggests choosing a level from your threat environment and reaching it across all eight strategies before going further. Level Two is the usual first target.

Is there an Essential Eight certification?

No. Organisations are assessed against ASD's Essential Eight Assessment Process Guide, internally or by third-party assessors, but no certificate is issued.

Not legal or compliance advice. Check the official text and your auditor, assessor or regulator before relying on it.