What Is the Essential Eight? A Plain-English Guide for Australian Executives

The short answer

The Essential Eight is a set of eight baseline cyber security mitigation strategies published by the Australian Signals Directorate (ASD). Its maturity model measures how well each strategy is implemented, from Maturity Level Zero to Maturity Level Three. It is mandatory for non-corporate Commonwealth entities and is widely used as a benchmark by private organisations, their customers, and cyber insurers.

What are the eight strategies?

ASD groups the strategies by purpose. The first four help prevent malicious code being delivered and run. Restricting admin privileges, patching operating systems, and multi-factor authentication limit how far an incident can spread. Regular backups support recovery.

What are the maturity levels?

• Maturity Level Zero: weaknesses in the organisation's overall cyber security posture.
• Maturity Level One: protects against opportunistic attackers using widely available tools and techniques.
• Maturity Level Two: protects against attackers willing to invest more time and use more effective tools.
• Maturity Level Three: protects against more adaptive attackers who target specific organisations and are less reliant on publicly available tools.

An organisation's maturity is only as strong as its weakest strategy. ASD recommends reaching the same level across all eight before moving to a higher level.

Is the Essential Eight mandatory?

It is mandatory for non-corporate Commonwealth entities under the Australian Government's Protective Security Policy Framework. For most private businesses and not-for-profits it is not a legal requirement. In practice, it is increasingly referenced in government and enterprise contracts, supply-chain security requirements, and cyber insurance questionnaires. Boards also use it as a shared language for cyber risk.

Which maturity level should your business target?

ASD's guidance is to choose a target level suited to your environment, considering how attractive you are to attackers and the consequences of an incident. As a practical starting point:

• if you are not yet at Level One across all eight strategies, get there first, because it addresses the most common attacks
• many mid-sized organisations then target Level Two, particularly if they hold sensitive personal or financial information or supply government or larger enterprises
• Level Three is usually reserved for high-risk environments or specific critical systems

A genuine Level One across all eight is worth more than a Level Two claim with gaps.

Has the Essential Eight changed recently?

ASD updates the maturity model periodically as attacker techniques change. The most recent substantive update was published in November 2023 and strengthened requirements in areas including multi-factor authentication. In mid-2026 ASD consulted on evolving the Essential Eight into a broader Essentials series. At the time of writing, September 2026, no replacement had been published, so the current maturity model remains the benchmark and work towards it carries forward.

How do you assess Essential Eight maturity?

1. Define the scope. Decide which systems, users, and environments are included. Gaps in scope are a common source of false confidence.
2. Gather evidence, not just policies. Maturity depends on controls that are implemented and working, such as actual patching timeframes and successful restore tests, not documents that say they should happen.
3. Assess each strategy against the target level. The lowest-scoring strategy sets overall maturity.
4. Document exceptions. ASD allows justified exceptions, but they should be approved, kept to a minimum, backed by compensating controls, and reviewed regularly.
5. Build a prioritised uplift plan. Sequence the fixes by risk and effort, with owners and dates.
6. Reassess regularly. Controls drift as systems, suppliers, and staff change.

What should executives and boards ask?

• What is our current maturity for each of the eight strategies, and what is our target?
• Is the assessment based on evidence or self-attestation?
• Which systems are out of scope, and why?
• What exceptions exist, who approved them, and what compensating controls are in place?
• When did we last successfully restore from backup?
• Which accounts are protected by phishing-resistant multi-factor authentication?
• What is the plan, budget, and timeline to reach our target level?

What does the Essential Eight not cover?

The Essential Eight is a minimum baseline, not a complete security program. It does not replace incident response planning, staff awareness, supplier security, monitoring, or data protection. Organisations handling personal information also need to meet their Privacy Act obligations, including the Notifiable Data Breaches scheme where it applies.

Where to get help

If your organisation lacks a security lead, independent cybersecurity governance support can set the target level, commission the assessment, and hold your IT provider to account for the uplift. In Microsoft environments, a Microsoft 365 security review covers many of the controls that underpin Essential Eight maturity. For board reporting, see the board technology risk review.