The Essential Eight is a set of eight mitigation strategies published by the Australian Cyber Security Centre (ACSC) to make it much harder for attackers to compromise your systems. It is the Australian Government’s recommended baseline, and a practical benchmark for any business that wants to show it takes security seriously.
The eight controls
Application control stops unapproved programs from running on your devices.
Patch applications keeps software such as browsers, Office and PDF readers up to date.
Configure Microsoft Office macro settings blocks macros from the internet and untrusted sources.
User application hardening switches off risky features in browsers and Office that attackers abuse.
Restrict administrative privileges means only the people who need admin access have it, and only for the tasks that need it.
Patch operating systems keeps Windows, macOS and servers updated.
Multi-factor authentication requires a second proof of identity, not just a password.
Regular backups keeps copies of important data that can be restored, and are tested.
The maturity levels
The ACSC measures how well each control is implemented using maturity levels from zero to three. Each level is designed to counter a more capable kind of attacker. Level one targets opportunistic attacks using widely available tools, while higher levels address more determined and better-resourced attackers.
For most small and medium businesses, reaching maturity level one across all eight controls is a realistic and worthwhile first goal. You can then work upward as your risk, clients or contracts demand.
Who needs to care about the Essential Eight?
Government agencies are expected to meet it, but it is increasingly requested by private sector clients, insurers and suppliers. If you handle personal, financial or legal information, a clear Essential Eight position helps you answer security questionnaires and win work.
Where to start
You do not need to fix all eight at once. A sensible order for most businesses:
Turn on multi-factor authentication for every user, starting with email and admin accounts.
Make sure devices and applications update automatically.
Reduce admin accounts to those who genuinely need them.
Set up backups and test a restore.
Work through the remaining controls with an assessment against the maturity model.
How The Bitrates helps
Our cyber security service includes Essential Eight uplift. We assess where you are today, fix the highest-risk gaps first, and keep controls in place through managed IT.
Read more about our cyber security services or book a free IT health check.
Related reading: Cyber security checklist for Australian small business
FAQ
Is the Essential Eight mandatory?
It is mandatory for some government bodies, but voluntary for most private businesses. Many clients and insurers still ask for it.
Does the Essential Eight stop every attack?
No. It greatly reduces risk but is not a complete security program. It works best alongside staff training and email protection.
How long does it take to reach maturity level one?
It depends on your starting point and number of devices. An assessment will give you a realistic plan.
