Skip to main content

Essential Eight Baseline

Canonical reference. Audience-neutral. The security-maturity anchor referenced from every audience's Strategy and Tactical tiers.

Transition notice — Essential Eight is being retired

ASD has announced it is retiring the Essential Eight over the next two years and replacing it with a broader ASD Essentials series (starting with Essentials for Enterprise IT), currently out for consultation. Organisations that have invested in Essential Eight aren't starting over — ASD has indicated the new guidance will align closely with existing controls. Until the Essentials series is finalised, the Essential Eight remains the live, supported baseline, so this page and the rest of the Technical Library continue to reference it. We'll publish a full breakdown of the ASD Essentials series once it lands — more on this coming soon.

The Essential Eight is a set of eight baseline mitigation strategies published by the Australian Signals Directorate (ASD) through the Australian Cyber Security Centre (ACSC). It's been the de facto security baseline for Australian organisations — and because it's measurable, it doubles as a shared language between technicians, management, and boards.

Note — Currency

The Essential Eight Maturity Model is maintained by the ACSC and updated periodically (most recently a significant revision in November 2023), and is now in its retirement/transition phase (see notice above). Always work from the current guidance at cyber.gov.au. The summary below is an orientation, not a substitute for the official model.

The eight mitigation strategies​

  1. Application control — allow only approved applications to execute, preventing malicious code from running.
  2. Patch applications — keep applications current; remediate vulnerabilities quickly. (See Patch Management.)
  3. Configure Microsoft Office macro settings — block macros from the internet and limit their use, closing a common malware vector.
  4. User application hardening — harden browsers and applications (e.g. block Flash, ads, and Java where unnecessary) to reduce attack surface.
  5. Restrict administrative privileges — limit and control admin rights so a compromised account does less damage. (See MFA & Entra ID Hardening.)
  6. Patch operating systems — keep operating systems current and replace end-of-life systems. (See Patch Management.)
  7. Multi-factor authentication — verify identity with more than a password. (See MFA & Entra ID Hardening.)
  8. Regular backups — maintain and test backups so you can recover from an incident. (See Backup & Disaster Recovery.)

The maturity model​

The model defines four maturity levels, and an organisation's maturity is assessed across all eight strategies together:

  • Maturity Level Zero — not aligned with the intent of the strategy; meaningful weaknesses exist.
  • Maturity Level One — basic protection against opportunistic, unsophisticated attacks.
  • Maturity Level Two — protection against more capable adversaries using better tools and techniques.
  • Maturity Level Three — protection against adaptive, highly capable, targeted adversaries.

The ACSC recommends implementing all eight strategies to the same maturity level before moving the whole set up — uneven implementation leaves exploitable gaps. Choose a target level proportionate to your threat profile and risk appetite.

How to use this baseline (during the transition)​

  • Business Owners — keep treating Essential Eight maturity as a board-level metric for now: pick a target level, fund the gap as a project, and report on it. Expect the reporting metric to shift once the ASD Essentials series lands. (See Business Owners — Strategy and Tactical.)
  • MSPs — keep productising Essential Eight uplift as a defined, repeatable offering, and plan to fold in the ASD Essentials series once it's published. (See MSP — Strategy.)
  • Internal IT — keep running it as an internal program with an owner, a roadmap, and ongoing reporting; treat the upcoming Essentials series as the next iteration of that program, not a restart. (See Internal IT — Strategy.)

The other pages in this library are the concrete implementations of individual strategies. This page is the map that ties them together, and will be updated to the ASD Essentials series once it's finalised.