What is the Essential Eight?
The Essential Eight is a set of baseline cyber security mitigation strategies published by the Australian Signals Directorate (ASD). It is designed to make it much harder for attackers to compromise systems, and it is increasingly referenced in government tenders, supply chain requirements and cyber insurance questionnaires.
1. Application control
Only approved applications can run. This blocks most malware, which relies on running unapproved executables and scripts. Tools such as ThreatLocker implement this as allow-listing.
2. Patch applications
Security updates for browsers, Office, PDF readers and other apps are applied within set timeframes, with faster timelines for internet-facing software and known exploited vulnerabilities.
3. Configure Microsoft Office macro settings
Macros from the internet are blocked, and only trusted, signed macros are allowed where the business genuinely needs them.
4. User application hardening
Browsers and Office are configured to block risky features, such as unnecessary web content and Office creating child processes.
5. Restrict administrative privileges
Admin accounts are separate from everyday accounts, limited to the people who need them, and reviewed regularly.
6. Patch operating systems
Windows, macOS and server operating systems are kept up to date, and unsupported versions are replaced.
7. Multi-factor authentication
MFA protects email, remote access and admin accounts, with phishing-resistant methods required at higher maturity levels.
8. Regular backups
Important data, software and settings are backed up, stored securely, protected from deletion and test-restored.
Maturity levels
Each strategy is assessed from Maturity Level Zero to Maturity Level Three. Level One addresses opportunistic attackers; Levels Two and Three address progressively more capable and targeted adversaries. Most growing businesses start by targeting Level One or Two across all eight.
How to get started
Begin with a gap assessment against your target level, then follow a prioritised, costed roadmap. Implement the controls, collect evidence, and review maturity regularly. Xen IT runs Essential Eight assessments and uplift programs.
Sources
Australian Signals Directorate, Essential Eight and Essential Eight Maturity Model (cyber.gov.au).
Free IT assessment
Ready to stop fighting your IT?
Book a free, no-obligation IT assessment. We'll identify your biggest vulnerabilities and opportunities, and give you a clear roadmap, whether you engage us or not.
Prefer to talk? Call us directly
(07) 5619 6555
Suite 8 (West Wing), 2 Fortune Street, Coomera QLD 4209