The Essential Eight is a set of eight mitigation strategies published by the Australian Signals Directorate’s Australian Cyber Security Centre (ACSC). It’s mandatory for many government agencies, and it has become the yardstick Australian insurers, clients and IT providers use when they ask “how secure is your business?”
It isn’t a product you buy. It’s a list of things to do, with levels describing how thoroughly you do them.
The eight strategies
| Strategy | What it means in practice |
|---|---|
| Patch applications | Install security updates for browsers, Office, PDF readers and other software quickly, especially for internet-facing apps. |
| Patch operating systems | Keep Windows, macOS, servers and network devices updated; replace systems the vendor no longer supports. |
| Multi-factor authentication | Require a second factor (an app, a key) for email, remote access and anything holding important data. |
| Restrict administrative privileges | Staff use normal accounts day to day; admin rights go only to the people who need them, and are reviewed. |
| Application control | Only approved software can run, so a malicious file someone downloads simply won’t execute. |
| Restrict Microsoft Office macros | Block macros from the internet; allow only those your business actually needs. |
| User application hardening | Turn off risky features in browsers and Office, such as old plug-ins and ads. |
| Regular backups | Back up important data and settings, keep copies attackers can’t delete, and test that restores work. |
Maturity levels
Each strategy is assessed at a maturity level from zero (not implemented in a meaningful way) to three. Level one targets opportunistic attackers using widely available tools; the higher levels assume more capable, targeted attackers.
The ACSC’s advice is to pick a target level that suits the threats you face and reach it across all eight strategies before moving higher. Being at level three on backups and zero on patching leaves an obvious gap.
Where most small businesses start
The usual first steps are the cheapest:
- Turn on multi-factor authentication for Microsoft 365 or Google Workspace and any remote access.
- Take admin rights off everyday accounts.
- Automate patching for Windows and common apps.
- Check your backups include a copy that ransomware can’t reach, and run a test restore.
Application control and macro restrictions take more planning, and that’s where a provider earns their fee.
Getting help
An assessment against the Essential Eight is a common, fixed-scope engagement. Ask for a written report showing your current level for each strategy and a prioritised plan to reach your target. The ACSC publishes the full Essential Eight Maturity Model free at cyber.gov.au.
Outside Australia?
The eight strategies are a good baseline anywhere, because they target the way most attacks actually start. Other countries publish their own equivalents, such as the UK’s Cyber Essentials scheme and the CIS Critical Security Controls; if a client or insurer names one, use that as your checklist.
Browse cybersecurity providers in the directory.
