If an insurer, an auditor or a nervous board member has asked about your Essential Eight position, this is the guide we give clients. No acronym soup, no scare tactics, just the eight things, what they mean, and where to start.
- The Essential Eight is eight baseline security controls from the Australian Signals Directorate (ASD). It is the closest thing Australia has to an agreed answer to "what should every organisation do first?"
- Each control is measured on a maturity scale from Level Zero to Level Three. Aim for a genuine Level One across all eight before chasing Level Two on any single one.
- If you can only start two things this year, start with multi-factor authentication and tested backups, unless you already know of exposed admin access. That comes first.
What is the Essential Eight?
The Essential Eight is a set of eight mitigation strategies published by the Australian Signals Directorate through the Australian Cyber Security Centre. It is not a law and it is not a certification. It is a prioritised baseline: the eight controls that stop or slow the widest range of real attacks for the least effort.
It exists because most organisations, faced with a hundred possible security projects, freeze. The Essential Eight answers the freeze with a short, ordered list.
The eight controls, in plain English
1. Application control. Your computers will run anything you double-click, including things an attacker sends you. Application control flips that default: only approved software runs, and everything else is refused. It is the difference between a guest list and an open door.
2. Patch applications. The software you use every day ships with flaws, and vendors fix them constantly. Patching quickly keeps the window between “flaw made public” and “flaw fixed on your machines” too short to climb through.
3. Configure Microsoft Office macro settings. Macros are small programs inside documents, and one of the most common ways malware arrives dressed as an invoice. This control blocks macros that come from the internet and allows only the ones with a genuine business reason to exist.
4. User application hardening. Browsers and PDF readers carry features from a more trusting era of the internet. Hardening switches off the ones attackers rely on and nobody at your office actually uses.
5. Restrict administrative privileges. Admin accounts are the keys to the building. This control means fewer people hold them, they are used only when needed, and an attacker who gets into an ordinary account cannot simply promote themselves.
6. Patch operating systems. The same logic as patching applications, applied to Windows and macOS. Unsupported operating systems carry flaws that are public knowledge, with step-by-step instructions attached.
7. Multi-factor authentication. A password by itself is a single point of failure that can be phished, guessed or bought. MFA means a stolen password is not enough on its own. If you adopt one control this year, adopt this one.
8. Regular backups. Not “we think the backups run.” Tested restores, kept separate enough that ransomware cannot encrypt them along with everything else. The question is never “do you back up?” It is “when did you last restore something, and did it work?”
How the maturity levels work
Each control is measured at a maturity level from Zero to Three. The levels describe how well the control holds up against progressively more capable and more patient attackers.
The mistake we see most often is a business with one control polished to Level Two and three others sitting at Level Zero. That is a house with an excellent front door and seven open windows. Eight decent locks beat one perfect one.
Where to start when you cannot do everything at once
You do not have to do all eight in a week. Sequence them by how much they change the outcome of a bad day, for the least disruption. The right order also depends on the gaps you already have.
One exception goes to the front of the queue whatever the general order says: administrative access that is exposed or unnecessary. Admin accounts still active for people who have left, and everyday accounts that read email and browse the web while holding admin rights, turn a single successful phish into a full compromise. Removing them is usually quick and does not need the full privileged access project. The planned part, separate admin accounts and the rules around them, can still come later.
Why the Essential Eight matters for your industry
The regulatory and commercial weight varies by sector, but the pattern is consistent.
| Sector | Why it comes up |
|---|---|
| Accounting and legal | You hold tax file numbers, trust accounts and privileged files. Clients and regulators expect evidence of basic controls. |
| Allied health | Health information carries a higher duty of care, and a breach is often notifiable regardless of your size. |
| Financial services | Alongside the Essential Eight, APRA regulated entities carry obligations under the CPS 234 information security standard. |
| Not-for-profit | Grant funders and government contracts increasingly ask for a security baseline before releasing funds. |
For a deeper look at how a breach becomes a legal obligation, see our guide to notifiable data breaches in Australia. If you would rather have someone run all of this for you, that is what our managed security service does.
Turning it into evidence
Insurers, tenders and enterprise customers increasingly ask for your Essential Eight position in writing. If you do not know what you would put on the page, that is a solvable problem, and solving it is quieter and cheaper than most people expect.
We map your current maturity across all eight controls, give you a board-ready summary, and scope the work to close the gaps that matter. Start a conversation and the first one costs nothing.
