The Essential Eight comes up in tenders, insurance renewals and vendor questionnaires, usually without explanation. This is what it actually is, in plain language.
What is the Essential Eight?
The Essential Eight is a set of eight cybersecurity mitigation strategies published by the Australian Cyber Security Centre, part of the Australian Signals Directorate. It exists because a small number of controls prevent the large majority of real-world intrusions, and it is deliberately narrow so that organisations can actually implement it.
What are the eight strategies?
They divide into three goals: preventing attacks, limiting the damage, and recovering data.
Preventing malware from running
- Application control. Only approved software is permitted to execute, so unknown programs cannot run.
- Patch applications. Software vulnerabilities are closed on a defined schedule, with critical internet-facing patches applied within 48 hours at higher maturity levels.
- Configure Microsoft Office macro settings. Macros are blocked or restricted, closing a long-standing malware delivery path.
- User application hardening. Risky browser and application features such as Flash, ads and Java are disabled.
Limiting the extent of an incident
- Restrict administrative privileges. Few people hold admin rights, so a single compromised account cannot take the whole network.
- Patch operating systems. Windows and server operating systems are kept current and unsupported versions removed.
- Multi-factor authentication. Passwords alone do not grant access to email or key systems.
Recovering data
- Regular backups. Backups are taken, retained, and critically, tested by performing actual restores.
How do maturity levels work?
Each strategy is assessed independently across four levels from 0 to 3.
| Level | What it means |
|---|---|
| Level 0 | Significant weaknesses. The control is absent or ineffective. |
| Level 1 | Mitigates common, opportunistic attacks using widely available tooling. |
| Level 2 | Mitigates adversaries willing to invest time and effort in a specific target. Commonly required in tenders. |
| Level 3 | Mitigates adaptive, persistent adversaries. Required for the most security-sensitive contracts. |
The point most often missed: maturity is measured per strategy, not as a single overall score. An organisation can sit at Level 2 for multi-factor authentication and Level 0 for application control. When a tender asks for your maturity level, the answer is generally set by your weakest control.
Who has to comply?
Maturity Level 2 is mandatory for Australian non-corporate Commonwealth entities under the Protective Security Policy Framework. For private businesses there is no legal obligation, but the requirement now arrives contractually: through government tenders, through prime contractors passing obligations down their supply chain, and through cyber insurers whose renewal questionnaires ask about MFA, patching and backups.
How long does it take?
For a small or medium business starting from a standard Microsoft 365 environment, Maturity Level 2 typically takes three to six months. Multi-factor authentication, patch cadence and backup testing move quickly. Application control and macro hardening take longest, because both must be tested against how people actually work before enforcement.
Is the Essential Eight enough on its own?
No, and the ACSC does not claim otherwise. It is a baseline covering the most common intrusion methods. It does not address physical security, insider threat, supply chain risk or staff awareness in any depth. It is a strong foundation, not a complete security program.
Xen IT delivers Essential Eight work as assess, remediate, evidence and maintain: benchmarking current maturity across all eight strategies, implementing the controls to reach the target level, documenting the evidence auditors and insurers ask for, then maintaining it as the environment changes.
Ready to stop fighting your IT?
Book a free, no-obligation IT assessment. We'll identify your biggest vulnerabilities and opportunities, and give you a clear roadmap, whether you engage us or not.