The Essential Eight comes up in three situations: a government tender asks for it, a large customer sends a supply chain questionnaire, or a cyber insurer asks on a renewal form. In all three, someone who has never heard of it has a fortnight to work out what it means.
The framework itself is good. The problem is that it was written by and for organisations with security teams, and the official guidance is precise in a way that assumes you already speak the language. This is the translation we give clients.
Who the Essential Eight was written for
The Essential Eight is published by the Australian Signals Directorate, built on ASD's own experience responding to incidents, producing threat intelligence and conducting penetration testing. It has been maintained since 2017 and is revised periodically as attacker behaviour shifts.
It is mandatory for non-corporate Commonwealth entities. For everyone else it is advisory, until it appears in a contract. That distinction matters because it changes what "done" means. If you are doing this for a tender, the bar is evidence a third party will accept. If you are doing it because you would rather not be breached, the bar is whether the control actually works. Those are not the same project, and conflating them is how businesses spend a lot of money on documentation while staying vulnerable.
The eight, translated
| Strategy | What it means day to day | Effort |
|---|---|---|
| Multi-factor authentication | A second factor on email, VPN, remote access and anything internet-facing holding sensitive data | Low |
| Regular backups | Backups on a schedule matched to how much data you can afford to lose, kept where an attacker with your admin password cannot delete them, and restored from as a test | Low–Medium |
| Patch applications | Browsers, Office, PDF readers and anything internet-facing updated on a defined clock, fastest for known-exploited flaws | Medium |
| Patch operating systems | The same discipline for Windows, macOS and Linux, plus retiring versions no longer receiving security updates | Medium |
| Restrict administrative privileges | Admin rights requested and reviewed rather than permanent; separate accounts for admin work; no email or web browsing from a privileged account | Medium |
| Configure Office macro settings | Macros from the internet blocked; macros allowed only where there is a demonstrated business need | Low–Medium |
| User application hardening | Turning off the risky corners of browsers and Office that almost nobody needs | Medium |
| Application control | Only approved executables, scripts and installers can run | High |
The order nobody tells you
The Essential Eight is a list, not a sequence, and the numbering is not a priority order. Worked through top to bottom, the hardest control, application control, lands first, which is the single most common reason these projects stall in month two and never restart.
The order we actually use
- MFA: highest return per hour of effort, full stop.
- Backups, tested: decides how bad your worst day gets.
- Patching (OS and applications): mostly tooling and a calendar.
- Admin privilege restriction: political more than technical.
- Macro settings and user application hardening: policy work, low user impact if scoped well.
- Application control: last, and budget real time for it.
Doing MFA and backups first is not a compromise. Compromised credentials are the root cause of roughly a quarter of the breaches reported to the OAIC, and ransomware notifications rose 24% across 2025. Those two controls sit directly in front of the two things most likely to actually happen to you.
What Maturity Level One really demands
There are four levels, Zero through Three. Level Zero means there are weaknesses in your overall posture. Level One is the baseline, aimed at attackers using commodity, widely available tradecraft, opportunistic rather than targeted. Levels Two and Three step up to adversaries willing to invest more time and effort in a specific target.
ASD's guidance is to reach the same level across all eight strategies before climbing, and to validate it. This is the rule most self-assessments break. A business with Maturity Level Three backups and Maturity Level Zero application control is at Maturity Level Zero. The model does not average.
Two things about Level One consistently surprise people:
Patching has a clock, and it is shorter than yours. Level One expects internet-facing services to be patched on a tight timeframe, dropping to a very short window where a working exploit exists. "We patch monthly" is generally not Level One for internet-facing systems. Check the current timeframes on cyber.gov.au. They are revised, and quoting a number from a two-year-old blog post is how people fail assessments.
Backups are about the restore, not the backup. Level One expects backups retained per business continuity requirements, and restoration tested. It also expects that unprivileged accounts cannot modify or delete backups. That last clause is the one that catches businesses whose "offsite backup" is a sync to a cloud drive the domain admin can wipe, which is precisely what ransomware operators do first.
Where small businesses get stuck
Application control on unmanaged devices. If staff use personal laptops, application control is close to unachievable without first solving device management. That is a bigger project. Recognising it early prevents months of thrash.
The one legacy application. Almost every business has one: the old accounting package, the industry tool from a vendor who stopped answering email. It needs macros, or local admin, or an unsupported runtime. Document the exception, compensate around it (network segment it, restrict who runs it), and be honest in the assessment. An acknowledged exception is defensible; a quiet one is not.
Admin rights as a status symbol. Removing standing admin from someone who has had it for nine years is a conversation, not a config change. Start with the separate-accounts model, same person with two logins, rather than taking the capability away outright. It gets you most of the security benefit and far less resistance.
Treating it as a project rather than a state. Maturity is assessed against how things currently are. A business that reached Level One in March and stopped patching in June is not at Level One in September. The controls that decay fastest are patching and privilege creep.
Evidence, or it did not happen
Whoever is asking, whether an assessor, a customer or an insurer, wants evidence, not assertions. Build the evidence as you go; reconstructing it afterwards costs several times more.
- MFA: a report of enabled users, plus the count of exceptions and why each exists.
- Patching: compliance reporting from the patch tool showing time-to-patch against your defined windows, not just a current-state percentage.
- Backups: a dated restore test record. Which system, who ran it, how long it took, what broke.
- Admin privileges: the current privileged account list and the date of the last review.
- Macros and hardening: exported policy configuration.
- Application control: the ruleset plus a sample of blocked-execution logs proving it is enforcing rather than auditing.
That last distinction matters more than it sounds. Application control deployed in audit mode produces beautiful logs and blocks nothing. It is a legitimate first phase, since you need the discovery period to learn what staff actually run, but it is not the control, and an assessor will ask.
None of this is conceptually hard. It is a few weeks of technical work for most small businesses, wrapped in a longer period of testing and evidence-gathering. The businesses that struggle are the ones that start with application control, discover it is genuinely difficult, and conclude the whole framework is out of reach. Start with MFA and a restore test. You will have addressed the two most likely causes of a bad quarter before you have finished reading the maturity model.
Frequently asked questions
What are the Essential Eight?
Eight mitigation strategies published by the Australian Signals Directorate: application control, patch applications, configure Microsoft Office macro settings, user application hardening, restrict administrative privileges, patch operating systems, multi-factor authentication, and regular backups. They are the baseline ASD recommends for all organisations.
Is the Essential Eight mandatory for Australian businesses?
Not for most private businesses. It is mandatory for non-corporate Commonwealth entities, and it increasingly appears as a contractual requirement: in government tenders, in supply chain questionnaires, and in cyber insurance applications. That is usually why a private business ends up needing it.
What is Maturity Level One?
The first of four levels (Maturity Level Zero through Three). Level One is designed to counter attackers using widely available, commodity techniques, the opportunistic end of the spectrum. ASD advises reaching the same maturity level across all eight strategies before moving up, because a single weak strategy undermines the others.
How long does it take a small business to reach Maturity Level One?
For a typical 20 to 50 person business already on Microsoft 365 with managed devices, the technical work is usually a few weeks. What extends it is application control, which needs a discovery period to learn what staff actually run before you start blocking, and the evidence trail. Most of the elapsed time is documentation and testing, not configuration.
Which Essential Eight control should we do first?
Multi-factor authentication and backups, in that order, not the order they are listed in. MFA addresses compromised credentials, which are the root cause of roughly a quarter of breaches reported to the OAIC. Tested backups are what determine whether a ransomware incident is an expensive week or an extinction event. Application control is the hardest and should be last.