The Australian Essential Eight Explained: A Practical Guide

The Essential Eight is a prioritised list of mitigation strategies published by the Australian Signals Directorate (ASD) as part of its broader Strategies to Mitigate Cyber Security Incidents. The ASD originally identified 37 mitigation strategies; the Essential Eight represent the most effective subset for preventing malware delivery and execution, limiting the extent of cyber incidents, and recovering data and system availability.

While Australian Government agencies covered by the Protective Security Policy Framework (PSPF) are required to implement the Essential Eight, the framework is strongly recommended for all Australian organisations, including state and local government bodies, critical infrastructure operators, and private enterprises. Many cyber insurance providers and government procurement processes now reference Essential Eight maturity as a baseline requirement.

Application control (sometimes called application whitelisting) restricts which software can execute on a system. Rather than relying solely on antivirus to detect known threats, application control ensures that only approved applications can run. This is one of the most effective strategies for preventing malware execution. In practice, it involves maintaining a list of authorised executables, software libraries, scripts, and installers, and blocking everything else. Tools such as Microsoft AppLocker or Windows Defender Application Control (WDAC) are commonly used to enforce these policies on Windows endpoints.

Vulnerabilities in applications such as web browsers, PDF readers, Microsoft Office, and Java are frequently exploited by attackers. Patching these applications promptly, ideally within 48 hours for critical vulnerabilities, significantly reduces the attack surface. At higher maturity levels, organisations must also use vulnerability scanners to identify missing patches and remove applications that are no longer supported by their vendor.

Office macros are a common delivery mechanism for malware. The Essential Eight recommends that organisations block all macros from the internet and only allow vetted, digitally signed macros where a genuine business requirement exists. At Maturity Level 3, macros must be blocked in files from the internet entirely, and only macros running from trusted locations with restricted write access are permitted.

This strategy focuses on reducing the attack surface of user-facing applications. Specific actions include disabling Flash content (now end-of-life), blocking Java from the internet, disabling unnecessary features in web browsers, and blocking web advertisements. At higher maturity levels, organisations should also disable .NET Framework 3.5 and PowerShell 2.0, and ensure browsers do not process Java or web advertisements.

Administrative accounts are high-value targets for attackers. The Essential Eight requires organisations to limit who has admin access, enforce the principle of least privilege, and ensure that privileged accounts are not used for everyday tasks like reading email or browsing the web. Privileged access should be regularly revalidated, and credentials for break-glass accounts should be stored securely. At Maturity Level 3, privileged access workstations (PAWs) are required for administrative tasks.

Operating system vulnerabilities are just as dangerous as application flaws. Organisations must patch operating systems on workstations, servers, and network devices promptly. At Maturity Level 1, patches for internet-facing services should be applied within two weeks. At Maturity Level 3, critical patches must be applied within 48 hours, and unsupported operating systems must be replaced entirely.

MFA requires users to present two or more authentication factors before gaining access: something they know (password), something they have (a token or phone), or something they are (biometrics). The Essential Eight mandates MFA for all users accessing internet-facing services and for privileged accounts. At higher maturity levels, phishing-resistant MFA such as FIDO2 security keys or certificate-based authentication is required, and SMS-based one-time codes are no longer considered acceptable.

Backups are your last line of defence when all other controls fail. The Essential Eight requires that backups of important data, software, and configuration settings are performed and retained in accordance with business continuity requirements. Backups must be tested regularly to confirm they can be restored, and at least one copy must be stored offline or in a manner that prevents it from being modified or deleted by an attacker who has compromised the network. At Maturity Level 3, unprivileged accounts must not be able to access or modify backups.

The Essential Eight Maturity Model defines four maturity levels (0 through 3) for each strategy. Each level builds upon the previous one, increasing the rigour and scope of implementation. The table below summarises what each maturity level represents.

The ASD provides a detailed self-assessment guide that maps specific controls to each maturity level for every strategy. To assess your organisation, work through each strategy and determine whether your current implementations meet the requirements for Level 1, then Level 2, and so on. Your overall maturity level is determined by the lowest maturity level across all eight strategies. For example, if seven strategies are at Level 2 but one is at Level 1, your overall maturity is Level 1.