The Essential Eight is a set of eight baseline cyber security strategies published by the Australian Cyber Security Centre (ACSC). It is the most widely used starting point for protecting Australian businesses from common attacks. This guide lists the eight strategies, explains the maturity levels and shows how to find out where you stand.
What the Essential Eight Is
The Essential Eight is a prioritised list of mitigation strategies from the ACSC. It does not cover every threat. It targets the most common ways attackers get in and spread, such as unpatched software, stolen passwords and malicious macros.
Australian government entities are expected to implement it, and many private businesses now use it as their security baseline. Insurers and customers increasingly ask about it too.
The Eight Strategies
- Application control
- Patch applications
- Configure Microsoft Office macro settings
- User application hardening
- Restrict administrative privileges
- Patch operating systems
- Multi-factor authentication
- Regular backups
Together they cover prevention (stopping malware running), limiting damage (restricting admin rights) and recovery (backups that actually restore).
Essential Eight Maturity Levels
The ACSC rates each strategy from Maturity Level Zero to Maturity Level Three. Level Zero means significant gaps. Levels One to Three match increasing attacker skill and effort, with Level Three the hardest to defeat.
Most organisations aim first for Level One across all eight strategies, then raise the level for the strategies that protect their most important systems.
How to Check Where You Stand
Start with an honest assessment against each strategy. Our free Essential Eight self-assessment takes minutes and scores you on each of the eight. For evidence-based results, a full assessment checks real configurations, not just answers.
If the results show gaps, our cybersecurity services and compliance and audit service can help you close them in a sensible order.
Where Most Businesses Fall Short
The usual gaps are slow patching, too many staff with admin rights and backups nobody has tested. Fixing these three delivers the largest improvement for the effort. The official guidance is on the Australian Cyber Security Centre website.
Frequently Asked Questions
What is the Essential Eight?
It is a baseline of eight mitigation strategies from the Australian Cyber Security Centre that helps organisations defend against common cyber attacks.
Is the Essential Eight mandatory?
Australian government entities are expected to implement it. For private businesses it is not a legal requirement in most cases, but customers, insurers and contracts often expect it.
What are the Essential Eight maturity levels?
Maturity Level Zero to Maturity Level Three. Each level represents stronger protection against more capable attackers.
How long does an Essential Eight assessment take?
A self-assessment takes minutes. A full assessment with evidence checks takes longer, depending on the size of your environment.