Essential 8

The Essential Eight is the Australian Signals Directorate's set of eight prioritized mitigation strategies for internet-connected Windows-based enterprise networks: patch applications, patch operating systems, multifactor authentication, restrict administrative privileges, application control, restrict Microsoft Office macros, user application hardening, and regular backups.

The Essential Eight Maturity Model rates each strategy at Maturity Level Zero through Three, and an organization's overall level is the lowest level it reaches across all eight.

The model was substantially updated in November 2023 to use the same wording as the Information Security Manual (ISM) controls, to require patching of critical vulnerabilities within 48 hours, and to tighten MFA and logging expectations.

Under the Protective Security Policy Framework, non-corporate Commonwealth entities must reach Maturity Level Two, and many state governments, regulated sectors, and large buyers push the same expectation onto suppliers by contract.

The Essential Eight is not a certification. Entities self-assess using ASD's Essential Eight Assessment Process Guide, and independent assessments are commonly performed by IRAP assessors or specialist firms following that guide.

In writing, an organization needs a scope definition, the assessment against each strategy's requirements at the target level, configuration evidence and technical test results (for example application control bypass testing, patch age reports, MFA configuration exports, privileged account inventories), backup and restoration test records, and a remediation plan for gaps.