The Essential Eight comes up in government tenders, cyber insurance questionnaires and board meetings, usually phrased as "what is our maturity level?" This guide explains what the Essential Eight is, what each maturity level means, which level your organisation is likely to need, and how to get there in a sensible order.
The Australian Signals Directorate (ASD) publishes the Essential Eight and its maturity model on cyber.gov.au, and that is the authoritative source for the detailed requirements. The model was last substantially updated in November 2023. This article is a practical overview, not a substitute for it.
What the Essential Eight is
The Essential Eight is a set of eight mitigation strategies that ASD considers the most effective baseline for protecting internet-connected networks against common cyber threats. They fall into three groups:
- Stopping malware from being delivered and run: application control, patch applications, restrict Microsoft Office macros, and user application hardening.
- Limiting the damage when something gets in: restrict administrative privileges, patch operating systems, and multi-factor authentication.
- Recovering data and systems: regular backups.
ASD designed the Essential Eight for Microsoft Windows-based networks connected to the internet. It can be applied to other environments, such as cloud services and Linux servers, but there it is a guide to the protections you need rather than a literal checklist.
The eight strategies in plain English
| Strategy | What it means in practice |
|---|---|
| Patch applications | Browsers, office suites, PDF software, email clients, security products and internet-facing services updated quickly, with scanning to find what is missing. Unsupported software removed. |
| Patch operating systems | Workstations, servers and network devices updated on a schedule, fastest for internet-facing systems and vulnerabilities with known exploits. Unsupported operating systems replaced. |
| Multi-factor authentication | MFA for online services, remote access and privileged users, moving to phishing-resistant methods at higher levels. |
| Restrict administrative privileges | Admin rights only for the people and tasks that need them, separate privileged accounts, and no web browsing or email from those accounts. |
| Application control | Only approved programs, scripts and installers can run on workstations, extending to servers at higher levels. |
| Restrict Microsoft Office macros | Macros blocked for users without a business need, and macros from the internet blocked for everyone. |
| User application hardening | Browsers and office applications configured to block risky content, such as web advertisements and Java from the internet, with Internet Explorer 11 disabled or removed. |
| Regular backups | Important data, software and settings backed up in line with business criticality, protected from change or deletion, and tested by restoring them. |
The maturity levels
The maturity model defines four levels. Each is built around the kind of adversary it is designed to stop.
- Maturity Level Zero: weaknesses in your overall posture. Any strategy that falls short of Level One sits here.
- Maturity Level One: aimed at adversaries using widely available tools who look for any victim with a common weakness, such as an unpatched internet-facing service or an account without MFA.
- Maturity Level Two: aimed at adversaries who will invest more time and use more effective tools, and who choose targets more deliberately, for example with phishing aimed at your staff.
- Maturity Level Three: aimed at adaptive adversaries who rely less on public tools, exploit weaknesses quickly and work to get around your controls, for instance by going after privileged credentials.
Each level adds requirements to every strategy. As a rough guide to how the bar rises: patching timeframes and scanning coverage tighten, MFA has to become phishing-resistant, application control extends from workstations to servers, privileged access becomes time-limited and more closely watched, and event logs have to be collected centrally, protected and actually reviewed.
One strategy across the levels: patching
Patching shows how the levels work in practice. Under the November 2023 model, Maturity Level One expects, among other things:
- Patches for vulnerabilities in internet-facing services applied within two weeks of release, or within 48 hours when a working exploit exists.
- Patches for office productivity suites, web browsers, email clients, PDF software and security products applied within two weeks.
- Operating system patches for workstations and non-internet-facing servers applied within one month.
- Automated asset discovery and a vulnerability scanner used to find what is missing, and unsupported software removed.
Levels Two and Three extend the same discipline to more software, scan more often and, at Level Three, bring drivers and firmware into scope. The exact requirements for each level are in ASD's maturity model.
Which level do you need?
- Non-corporate Commonwealth entities must implement the Essential Eight to Maturity Level Two under the Protective Security Policy Framework. ASD's Commonwealth cyber security posture report for 2025 found that 22% of entities had reached Level Two across all eight strategies, which shows how demanding it is.
- Suppliers to government are increasingly asked to state their maturity, and Level Two is a common expectation where sensitive information is involved.
- Most private businesses should aim for Level One across all eight strategies first. It blocks the opportunistic attacks behind most incidents and is achievable for a small team.
- Organisations holding sensitive data or facing targeted threats should plan for Level Two, and consider Level Three only where the threat genuinely warrants it.
ASD's guidance is to reach the same maturity level across all eight strategies before moving to a higher one. An organisation at Level Three on backups and Level Zero on MFA is still exposed through MFA, so spreading the effort evenly matters more than excelling at one strategy.
How an Essential Eight assessment works
An assessment tests whether each requirement is actually met on your systems, not whether a policy says it should be. ASD publishes an assessment process guide that sets out how assessors collect evidence, from configuration exports and system queries to checking that a blocked application really is blocked. A good assessment gives you:
- An assessed maturity level for each of the eight strategies.
- The specific requirements not yet met, with the evidence behind each finding.
- A prioritised plan to bring every strategy up to your target level.
There is no Essential Eight certificate. The assessment report, and the evidence behind it, is what customers, insurers and boards ask to see.
Where to start
For most organisations moving from Level Zero to Level One, a sensible order is:
- MFA everywhere it is missing, starting with email, remote access and admin accounts.
- Patching automated for operating systems and common applications, with a scanner to prove it.
- Backups checked, protected from deletion and tested with a real restore.
- Admin rights removed from everyday accounts.
- Office macros and browser hardening set through central policy.
- Application control last, because it needs the most testing to avoid disrupting staff.
In a Microsoft 365 environment, most of this is done with tools you already license: Intune, Defender, Entra ID and Group Policy. The work is in the configuration, the testing and keeping it current, not in buying new products.
Where Orbit3 fits
We run Essential Eight assessments and uplift for Australian organisations: an evidenced maturity level per strategy, a roadmap in priority order, and the controls implemented with your team. Because we also provide managed IT and cloud operations, we can keep the controls working once you reach your target. Get in touch for a free 30-minute call.