Update: ASD has confirmed the Essential Eight will be retired over roughly the next two years and replaced by the new Essentials series. The Essential Eight remains the framework in force today, so the guidance below still applies. Read our takeaways from the recent Crayon webinar on the changing Essential Eight.
If you’ve spoken to an insurer, a government client or an auditor lately, there’s a good chance the Essential Eight has come up. Developed by the Australian Signals Directorate’s Australian Cyber Security Centre (ACSC), it has become the benchmark for cyber security in Australian organisations of every size.
Here’s a plain‑English guide to what it is and how to get started.
What is the Essential Eight?
The Essential Eight is a set of eight mitigation strategies that, together, make it much harder for attackers to compromise your systems. They focus on three goals: preventing malware from running, limiting the damage of an incident, and making sure you can recover.
The eight strategies are:
- Application control – only approved applications can run.
- Patch applications – keep software up to date, prioritising known vulnerabilities.
- Configure Microsoft Office macro settings – block macros from untrusted sources.
- User application hardening – reduce the attack surface of browsers and common applications.
- Restrict administrative privileges – give admin access only to those who need it, only when they need it.
- Patch operating systems – keep Windows, macOS and server operating systems current and supported.
- Multi‑factor authentication – require more than a password, especially for remote access and privileged accounts.
- Regular backups – back up important data and test that you can restore it.
Understanding maturity levels
Each strategy is assessed against maturity levels from Zero to Three. Higher levels defend against more capable attackers, but also require more effort to implement and maintain. The ACSC recommends that organisations choose a target maturity level based on their risk profile, then implement all eight strategies to that level before aiming higher.
For many small and medium businesses, Maturity Level One or Two is a realistic and valuable target. The important thing is to approach the strategies as a set, because a gap in one area can undermine strong controls elsewhere.
Where to start
- Assess where you are today. A gap assessment shows which controls are in place and which need work.
- Pick a target maturity level. Base it on your risk, your clients’ expectations and any contractual or insurance requirements.
- Tackle the quick wins. Multi‑factor authentication, macro settings and reviewing admin accounts are often achievable quickly.
- Build a roadmap. Application control and patching processes take more planning, so schedule them deliberately.
- Keep it current. The Essential Eight is updated over time, and your environment changes too. Review regularly.
How AfterDark can help
AfterDark helps organisations assess their Essential Eight maturity, build a practical roadmap and implement the controls across Microsoft 365, Intune, Defender and the wider environment. Our Virtual CISO service provides ongoing security leadership to keep you on track, while our Data Protection services cover backup and recovery.
To discuss your Essential Eight journey, contact our sales team on 1300 55 3101.
