The Essential Eight, explained

What the Essential Eight is

The Essential Eight is a set of eight baseline mitigation strategies published by the Australian Signals Directorate (ASD) through the Australian Cyber Security Centre. It is drawn from a longer list of 37 Strategies to Mitigate Cyber Security Incidents. The eight are the ones ASD rates "essential".

ASD presents the strategies as a baseline, not a guarantee:

While no set of mitigation strategies are guaranteed to protect against all cyber threats, organisations are recommended to implement eight essential mitigation strategies from the Strategies to mitigate cyber security incidents as a baseline.

ASD says the guidance draws on its experience responding to cyber security incidents, conducting vulnerability assessments and performing penetration testing across Australian government organisations.

The eight strategies

In ASD's own order and wording, from Essential Eight explained:

1. Patch applications
2. Patch operating systems
3. Multi-factor authentication
4. Restrict administrative privileges
5. Application control
6. Restrict Microsoft Office macros
7. User application hardening
8. Regular backups

Why the names and order differ

ASD uses two different orders and two different names across current documents.

The maturity model, above, lists application control fifth and calls strategy six "restrict Microsoft Office macros". The 2017 Strategies to Mitigate Cyber Security Incidents (still live, still cited in Commonwealth policy) lists application control first and calls the same strategy "configure Microsoft Office macro settings".

Both remain current ASD wording. When comparing documents, check which order and naming convention each one uses.

The eight also group into three of ASD's four outcome categories: prevent malware delivery and execution, limit the extent of cyber security incidents, and recover data and system availability. No "detect and respond" strategy is among the eight. The November 2023 model instead introduced centralised event logging as a cross-cutting requirement at Maturity Level Two.

The four maturity levels

Maturity is measured per strategy, on a scale of Zero to Three. Each level above Zero is defined by the level of adversary tradecraft it mitigates, not by the adversary's identity.

Two rules determine how maturity is assessed:

Implement across all eight before going up. ASD says organisations should reach the same maturity level across all eight strategies before moving higher. The Assessment Process Guide adds that an organisation that has never demonstrated Maturity Level One should not begin an assessment against Level Two.

Your overall level is your least mature strategy. If one strategy sits at Level One and the other seven at Level Two, the organisation is at Level One. Within a strategy, every requirement must be met: if a single control is assessed ineffective, that maturity level cannot be claimed.

Risk acceptance without compensating controls does not preserve a maturity level. ASD states that declining an entire strategy on the basis of risk acceptance or risk transference results in Maturity Level Zero for that strategy and for the overall implementation.

Organisations may exceed a level's requirements. ASD says they "should not be penalised for implementing more robust security measures than specified for the given maturity level". For example, an organisation may adopt security keys even where the level would also accept one-time-password tokens.

The requirements matrix sets out every requirement at every level.

Is there Essential Eight certification?

No. Independent assessments are available commercially, but ASD does not offer Essential Eight certification.

ASD's maturity model says it in one sentence:

Finally, there is no requirement for organisations to have their Essential Eight implementation certified by an independent party.

ASD does not certify Essential Eight implementations, endorse or register Essential Eight assessors, or publish a list of approved products. Its maturity model FAQ answers "does ASD provide a list of approved products for implementing the Essential Eight?" with "No."

ASD designed an Essential Eight Assessment Course, delivered in partnership with TAFEcyber. Graduates are told that they "must not state or imply that they are endorsed by ASD or ACSC to conduct Essential Eight assessments."

An independent assessment may still be required by a government directive, regulator or contract. That is an assessment obligation, not ASD certification or endorsement of the assessor. The same distinction applies to IRAP; see why "IRAP certified" does not exist.

Who must implement it

Two recurring claims about these obligations need clarification.

There is no "PSPF Direction 002-2023". The register of Protective Security Directions contains no direction with that identifier. The obligation for non-corporate Commonwealth entities instead comes from an amendment to PSPF Policy 10, effective 1 July 2022. The same obligation now appears in Policy 14 of the current PSPF Release.

The Australian Prudential Regulation Authority's CPS 234 does not reference the Essential Eight. It is outcomes-based: it requires controls commensurate with the threat and leaves the choice of framework to the entity. The Essential Eight also does not appear in:

• APRA CPG 234, the practice guide to CPS 234
• APRA CPS 230 and CPG 230, on operational risk
• The Cyber Security Act 2024

WA sets Maturity Level One, not the Commonwealth's Level Two, and its scope reaches the five WA universities and all Government Trading Enterprises, while local government is only encouraged. WA also mandates the ACSC "Further Five" on top of the Essential Eight.

Commonwealth implementation

Only 22% of Commonwealth entities reached overall Maturity Level Two in 2024–25, according to The Commonwealth Cyber Security Posture. That is up from 15% the year before but below the 25% recorded in 2023. The November 2023 update raised the assessment standard between those reporting periods. Multi-factor authentication had the lowest strategy result, with 34% at Level Two or higher.

Audit findings show a similar implementation gap. The Australian National Audit Office (ANAO) has found entities "relied on documenting policies and procedures to achieve compliance" rather than implementing the strategies, and that entities overstated their maturity in reporting.

The WA Auditor General audited ten entities. Five had not achieved Level One in any control. None achieved it in all. And seven of the ten overstated their self-assessed maturity.

Those findings support testing controls rather than relying on survey responses. ASD ranks evidence in four tiers, with "a policy or verbal statement of intent" at the bottom.

What changed in the last update

The current model is the November 2023 release. The previous release dates from November 2022, so older guidance may contain superseded timeframes and requirements.

Three changes deserve emphasis.

One requirement got easier. Operating system patching for workstations and non-internet-facing servers moved from two weeks to one month. ASD describes this as a counter-balance to tighter patching timeframes for higher-risk scenarios. Guidance describing the update as uniformly stricter does not reflect the changes document.

One requirement disappeared. Macro execution-event logging was removed because Windows lacks native support for it and incident responders advised ASD that the events provided limited benefit. A checklist that still requires it uses a pre-November 2023 model.

The MFA standard changed the reported result. Moving phishing-resistant MFA to Level Two raised the technical standard. ASD says the previous model had led to weaker implementations using biometrics, security questions or Trusted Signals. The proportion of Commonwealth entities at Level Two or above fell from 54% to 23%, then recovered to 34% by 2024–25.

ASD also aligned the model with Information Security Manual (ISM) control language and published machine-readable mappings for compliance tooling. That alignment supports the proposed move to a broader, ISM-grounded Essentials series.

The requirements matrix carries the current numbers in full.

The proposed Essentials series

On 15 June 2026 ASD announced a consultation on evolving the Essential Eight into a broader, ISM-grounded Essentials series, beginning with a chapter called Essentials for enterprise IT. Consultation closed on 12 July 2026.

ASD describes the proposal as an "evolution" and has published no retirement date. The claim that the Essential Eight will be retired by 2028 comes from a media interview, not an ASD publication.

We track the difference, with sources, on the Essentials transition page.

Where to go next

• Requirements matrix — every strategy at every maturity level, with the current timeframes.
• Glossary and sources — 53 sourced terms explained in plain language, plus the primary ASD documents used by this hub and the separate instruments that establish compliance obligations. Start here when a document uses unfamiliar terminology.
• Essentials transition tracker — what ASD has and has not said.
• Knowledge quiz — ten random questions drawn from a bank of forty, with an immediate explanation after every answer.
• Self-assessment — score yourself against the published requirements.
• If you build software — why the Essential Eight says nothing about the software you ship, and what does.