Security Lights the Way

Cybersecurity frameworks & operations

Essential Eight

Australian Signals Directorate's Essential Eight mitigation strategies and Maturity Model

The Australian Signals Directorate's eight prioritised mitigation strategies against cyber threats, with a maturity model from level zero to three.

Voluntary framework Voluntary (adopted by choice) Australia

Official source: Australian Signals Directorate ↗

Written by
MajorCyber™ Editorial
Last reviewed
Reading time
1 min

Researched and drafted with AI assistance from the official sources listed on this page. See our editorial policy.

Profile. A short orientation to Essential Eight: what it is, who it applies to and its key duties. A full MajorCyber™ guide is on the research roadmap; until then, rely on the official source for detail.

What is the Essential Eight?

The Essential Eight is a prioritised set of mitigation strategies from the Australian Signals Directorate (ASD). It is designed to make it much harder for adversaries to compromise systems. It is part of ASD’s broader Strategies to Mitigate Cyber Security Incidents and comes with a Maturity Model that defines how well each strategy is implemented.

The eight strategies

  1. Application control: only approved applications can run.
  2. Patch applications: fix security vulnerabilities in applications promptly.
  3. Configure Microsoft Office macro settings: block macros from the internet, and allow only trusted, vetted macros.
  4. User application hardening: for example, disable unneeded browser and Office features.
  5. Restrict administrative privileges: limit, validate and review privileged access.
  6. Patch operating systems: promptly, and replace unsupported versions.
  7. Multi-factor authentication: especially for remote access, privileged users and important data repositories. Phishing-resistant at higher levels.
  8. Regular backups: of important data, software and configuration, which are tested and protected from modification.

Maturity levels

  • Level zero: weaknesses in overall posture.
  • Level one: protects against opportunistic adversaries using commodity tools.
  • Level two: protects against adversaries willing to invest more time and effort.
  • Level three: protects against more skilled, adaptive adversaries.

Organisations should aim for the same level across all eight strategies before moving up, because attackers target the weakest link.

Who uses it?

Non-corporate Commonwealth entities must implement the Essential Eight under the Protective Security Policy Framework. Many states, critical infrastructure operators, suppliers to government and private companies adopt it voluntarily. Insurers and customers increasingly ask about Essential Eight maturity.

How does it relate to other frameworks?

It covers a focused but high-impact subset of controls found in ISO/IEC 27001, CIS Controls and NIST CSF, comparable in spirit to the UK’s Cyber Essentials. ASD’s Information Security Manual (ISM) provides the full control catalogue.

Sources and official references

  1. Essential Eight — Australian Signals Directorate (official source)

Links go to the publisher's own site. Where a standard is sold or copyrighted, MajorCyber™ summarises it in original words and links to the official listing instead of reproducing its text.

This page is general educational information, not legal, audit or certification advice. Requirements depend on your organisation's circumstances and the current official text. MajorCyber™ is not affiliated with Australian Signals Directorate's Australian Cyber Security Centre (ASD's ACSC).

Keep exploring

Voluntary framework

NIST CSF 2.0

NIST's voluntary, outcome-based framework for understanding, assessing, prioritising and communicating cybersecurity risk, organised into six functions including the new Govern function.

United States · International

Law / regulation Profile

CERT-In Directions

India's mandatory cyber incident reporting rules: specified incidents must be reported to CERT-In within six hours, with log retention and clock synchronisation duties.

India

Law / regulation Profile

Cyber Resilience Act

The EU regulation that requires hardware and software products with digital elements to be secure by design and supported with security updates for their lifetime.

European Union

Law / regulation Profile

NCA ECC

Saudi Arabia's baseline cybersecurity controls for government bodies and operators of critical national infrastructure, issued by the National Cybersecurity Authority.

Saudi Arabia

Law / regulation Profile

NIS2

The EU directive that sets cybersecurity risk-management, governance and incident-reporting duties for essential and important entities in critical sectors.

European Union