Skip to content
malware.com.au
Menu

The Essential Eight

ASD’s Essential Eight mitigation strategies and the four maturity levels, in plain English, with what each control actually requires in practice.

Last updated

DiagramHow malware gets in, by how often
Stolen or bought credentialsNo malware needed to start. Phishing-resistant MFA is the controlthat breaks it.Unpatched internet-facing systemsVPN appliances, firewalls, file transfer products. Exploitedwithin days of a patch, sometimes hours.Phishing and real-time relay kitsDefeats every code-based MFA method. The route into invoice fraud.Fake installers and malicious search adsThe top result can be an advertisement. The main infostealerroute.Supply chainA supplier, a managed service provider, or a software update.Rare, but reaches everyone at once.
The top two involve no user mistake at all, which is why awareness training cannot address most of this.

The Essential Eight is ASD’s baseline set of eight mitigation strategies, drawn from its broader Strategies to Mitigate Cyber Security Incidents. It is mandatory for non-corporate Commonwealth entities, and in practice it is the question set you will be asked by government buyers, large enterprise procurement, and cyber insurers.

Its value is not that the eight controls are exotic. It is that they are the eight that empirically stop the most attacks for the least money.

The eight

Grouped by what they are actually for.

Stop malicious code running

  1. Application control: only approved executables, libraries and scripts run. The highest-effort control on the list and the most effective.
  2. User application hardening: disable or block the risky features in browsers and productivity software: Flash, ads, Java, browser plugins, unnecessary object embedding.
  3. Restrict Microsoft Office macros: blocked by default, allowed only where there is a demonstrated business need, and only from trusted locations or with a validated signature.

Close the holes

  1. Patch applications: with a strong bias to internet-facing software, where ASD’s expected windows are measured in hours to days, not months.
  2. Patch operating systems: same discipline, including firmware and network appliances, which are routinely forgotten and routinely exploited.

Limit what a compromise reaches

  1. Restrict administrative privileges: validated on request, reviewed regularly, and separated from day-to-day accounts. No email or web browsing from a privileged account.
  2. Multi-factor authentication: phishing-resistant where possible. SMS codes are MFA, but they are the weakest kind and they are defeated routinely.

Survive it anyway

  1. Regular backups: of data, software and configuration, retained per business need, and restore-tested. An untested backup is a hypothesis. Critically, backups must be inaccessible from a compromised privileged account, or ransomware will simply encrypt them too.

Maturity levels

Each strategy is assessed against four levels. The levels describe the adversary you are resistant to, not how much effort you have expended.

Level Resistant to
0 Nothing meaningful. Significant weaknesses; vulnerable to commodity, unsophisticated attacks.
1 Adversaries using widely available commodity tooling and known exploits, targeting opportunistically.
2 Adversaries willing to invest more time and effort, and to use better tooling against a chosen target.
3 Adversaries who are adaptive, targeted, and less reliant on public tooling.

Two points that are easy to miss:

  • Implement all eight to the same level. ASD is explicit that the levels are meant to be reached across the whole set. Level 3 application control alongside Level 0 backups is not a Level 3 posture. It is a Level 0 posture with expensive decoration.
  • Level 3 is not “the goal”. Pick a target level from your threat environment. For most organisations that is Level 1 or 2, reached properly.

The eight controls and the maturity model have not changed structurally since ASD’s November 2023 revision, though ASD has signalled it is considering a next generation of the framework. Always assess against the current version on cyber.gov.au rather than a vendor’s summary, including this one.

What it does not cover

The Essential Eight is a baseline for a traditional Windows corporate network. It says little about SaaS configuration and identity federation, cloud posture, third-party and supply chain risk, OT and industrial control systems, or incident response capability, all of which are where a growing share of real Australian incidents now originate.

Treat it as a floor, not a program.

Common questions

Is the Essential Eight mandatory in Australia?

It is mandatory for non-corporate Commonwealth entities under the Protective Security Policy Framework. For everyone else it is guidance, but it is widely written into government contracts, tender requirements and cyber insurance questionnaires, which makes it effectively mandatory for anyone selling to government.

What maturity level should we target?

ASD’s guidance is to select a target level based on your threat environment and implement all eight strategies to that level together, rather than reaching a high level on some and leaving others at zero. Maturity Level Two is the common target for organisations handling sensitive data.

How many federal entities reach Maturity Level Two?

A minority. ASD reported 22 per cent of federal entities reached overall Maturity Level Two in 2025. Useful context if you are benchmarking your own program against government.

Primary sources