Australia · Australian Signals Directorate (ASD) / ACSC
Essential 8

Essential Eight

The eight baseline mitigation strategies the ASD considers most effective against targeted cyber intrusion.

Status · Maturity Model (current)

What Essential 8 actually is.

The Essential Eight is the ASD's prioritised list of mitigation strategies, drawn from the broader Strategies to Mitigate Cyber Security Incidents. Each strategy is measured against a three-level Maturity Model (ML1, ML2, ML3) that describes progressively stronger adversary capability being mitigated. It is mandatory for non-corporate Commonwealth entities under the Protective Security Policy Framework (PSPF) and widely adopted by state government, local government and regulated private sector as a reasonable baseline.

Applies to

Mandatory for non-corporate Commonwealth entities (via PSPF). Recommended by the ACSC for all Australian organisations and is commonly referenced by state governments, insurers and boards as a minimum expectation.

Key requirements

The control areas the framework covers.

Summary of the control families and outcomes the framework drives. Always validate against the official publication for the authoritative wording.

  1. 01

    Application control

    Prevent execution of unapproved or malicious code, including executables, scripts, installers and compiled HTML.

  2. 02

    Patch applications

    Apply patches to internet-facing applications within 48 hours; other applications within two weeks.

  3. 03

    Configure Microsoft Office macros

    Disable macros for users without a demonstrated business need; block macros from the internet by default.

  4. 04

    User application hardening

    Configure web browsers to block Flash, ads and Java; disable untrusted Office add-ins.

  5. 05

    Restrict administrative privileges

    Limit privileged access to those with a demonstrated need; regularly revalidate.

  6. 06

    Patch operating systems

    Apply patches for internet-facing operating systems within 48 hours; others within two weeks.

  7. 07

    Multi-factor authentication

    MFA for privileged users, remote access and access to important data repositories.

  8. 08

    Regular backups

    Daily backups of important data, retained for three months, tested and held offline or immutable.

Official source

Read it from the issuing body.

For anything with a regulator or certification body behind it, the authoritative text is what counts - not our summary.

Security, engineered around you.

Talk to an engineer - not a call centre. Most Vectra conversations start with a 30-minute technical briefing and end with a written plan.