# The Essential Eight

> ASD’s Essential Eight mitigation strategies and the four maturity levels, in plain English, with what each control actually requires in practice.

Source: https://www.malware.com.au/essential-eight/
Last updated: 2026-08-24

---

The **Essential Eight** is ASD's baseline set of eight mitigation strategies,
drawn from its broader *Strategies to Mitigate Cyber Security Incidents*. It
is mandatory for non-corporate Commonwealth entities, and in practice it is
the question set you will be asked by government buyers, large enterprise
procurement, and cyber insurers.

Its value is not that the eight controls are exotic. It is that they are the
eight that empirically stop the most attacks for the least money.

## The eight

Grouped by what they are actually for.

**Stop malicious code running**

1. **Application control**: only approved executables, libraries and scripts
   run. The highest-effort control on the list and the most effective.
2. **User application hardening**: disable or block the risky features in
   browsers and productivity software: Flash, ads, Java, browser plugins,
   unnecessary object embedding.
3. **Restrict Microsoft Office macros**: blocked by default, allowed only
   where there is a demonstrated business need, and only from trusted
   locations or with a validated signature.

**Close the holes**

4. **Patch applications**: with a strong bias to internet-facing software,
   where ASD's expected windows are measured in hours to days, not months.
5. **Patch operating systems**: same discipline, including firmware and
   network appliances, which are routinely forgotten and routinely exploited.

**Limit what a compromise reaches**

6. **Restrict administrative privileges**: validated on request, reviewed
   regularly, and separated from day-to-day accounts. No email or web browsing
   from a privileged account.
7. **Multi-factor authentication**: phishing-resistant where possible. SMS
   codes are MFA, but they are the weakest kind and they are defeated routinely.

**Survive it anyway**

8. **Regular backups**: of data, software and configuration, retained per
   business need, and **restore-tested**. An untested backup is a hypothesis.
   Critically, backups must be inaccessible from a compromised privileged
   account, or ransomware will simply encrypt them too.

## Maturity levels

Each strategy is assessed against four levels. The levels describe the
*adversary* you are resistant to, not how much effort you have expended.

| Level | Resistant to |
| --- | --- |
| **0** | Nothing meaningful. Significant weaknesses; vulnerable to commodity, unsophisticated attacks. |
| **1** | Adversaries using widely available commodity tooling and known exploits, targeting opportunistically. |
| **2** | Adversaries willing to invest more time and effort, and to use better tooling against a chosen target. |
| **3** | Adversaries who are adaptive, targeted, and less reliant on public tooling. |

Two points that are easy to miss:

- **Implement all eight to the same level.** ASD is explicit that the levels
  are meant to be reached across the whole set. Level 3 application control
  alongside Level 0 backups is not a Level 3 posture. It is a Level 0 posture
  with expensive decoration.
- **Level 3 is not "the goal".** Pick a target level from your threat
  environment. For most organisations that is Level 1 or 2, reached properly.

The eight controls and the maturity model have not changed structurally since
ASD's November 2023 revision, though ASD has signalled it is considering a
next generation of the framework. Always assess against the current version on
cyber.gov.au rather than a vendor's summary, including this one.

## What it does not cover

The Essential Eight is a baseline for a traditional Windows corporate network.
It says little about SaaS configuration and identity federation, cloud
posture, third-party and supply chain risk, OT and industrial control systems,
or incident response capability, all of which are where a growing share of
real Australian incidents now originate.

Treat it as a floor, not a program.

## Common questions

### Is the Essential Eight mandatory in Australia?

It is mandatory for non-corporate Commonwealth entities under the Protective Security Policy Framework. For everyone else it is guidance, but it is widely written into government contracts, tender requirements and cyber insurance questionnaires, which makes it effectively mandatory for anyone selling to government.

### What maturity level should we target?

ASD’s guidance is to select a target level based on your threat environment and implement all eight strategies to that level together, rather than reaching a high level on some and leaving others at zero. Maturity Level Two is the common target for organisations handling sensitive data.

### How many federal entities reach Maturity Level Two?

A minority. ASD reported 22 per cent of federal entities reached overall Maturity Level Two in 2025. Useful context if you are benchmarking your own program against government.


## Primary sources

- [ASD: Essential Eight maturity model](https://www.cyber.gov.au/business-government/asds-cyber-security-frameworks/essential-eight/essential-eight-maturity-model)
- [ASD: Strategies to Mitigate Cyber Security Incidents](https://www.cyber.gov.au/resources-business-and-government/essential-cyber-security/strategies-mitigate-cyber-security-incidents)

---

General information only, not legal advice. Whether an obligation applies
turns on facts about your organisation and the incident. Check the primary
sources above and obtain legal advice.

Emergency: Australian Cyber Security Hotline 1300 CYBER1 (1300 292 371), 24/7.