The Essential Eight Explained: A Plain-English Guide for Australian Businesses (2026 Update)

Updated 14 September 2026 with figures from the ASD Annual Cyber Threat Report 2024-25 and ASD’s consultation on the Essentials series. Earlier TechAssist guides to the Essential Eight now redirect to this page.

What is the Essential Eight?

The Essential Eight is a set of eight baseline cyber security mitigation strategies published by the Australian Signals Directorate (ASD). ASD selected them from its longer list of Strategies to Mitigate Cyber Security Incidents because, implemented together, they stop most of the intrusion techniques used against Australian organisations. The eight strategies are application control, patch applications, restrict Microsoft Office macros, user application hardening, restrict administrative privileges, patch operating systems, multi-factor authentication and regular backups.

ASD first published the Essential Eight in 2017. The current version of the Essential Eight Maturity Model, which sets out how each strategy is assessed, was published in November 2023 and remains in force.

If you run a business in Australia you have probably had the term put to you by an insurer, a large customer, a tender document or your IT provider. This guide explains each strategy in plain English, what the maturity levels mean, what Maturity Level One looks like for a typical 20-person business, and what ASD has announced about the framework’s future.

Who has to comply with the Essential Eight?

Strictly, only Australian Government entities. Under the Protective Security Policy Framework, non-corporate Commonwealth entities must implement the Essential Eight to Maturity Level Two. No law requires a private business to reach a particular maturity level.

In practice the framework reaches well beyond Canberra. Four groups now ask about it:

• Cyber insurers. Renewal questionnaires increasingly ask for the specific controls (MFA coverage, patch cadence, tested backups, separation of admin accounts) rather than a general statement that you “have security”. Our cyber insurance renewal checklist lists the questions Melbourne SMEs are being asked in 2026.
• Government and enterprise customers. Supplier security questionnaires and tender responses routinely ask for an Essential Eight self-assessment. Any business that supplies government at any level should expect the question.
• Regulators. The Essential Eight is not written into the Privacy Act, but organisations with annual turnover above $3 million are covered by the Notifiable Data Breaches scheme, and since 30 May 2025 businesses above that threshold must also report any ransomware or cyber extortion payment to the Australian Government within 72 hours under the Cyber Security Act 2024. The Essential Eight is the framework most often used to show what reasonable security looks like for an Australian SME.
• Your own board or owners. The framework gives a non-technical owner a short, defensible list of questions to ask, and a way to compare answers year on year.

Why the Essential Eight matters in 2026

ASD’s Annual Cyber Threat Report 2024-25, published in October 2025, recorded more than 84,700 cybercrime reports, one every six minutes. The average self-reported cost of a cybercrime rose to $56,600 for a small business (up 14 per cent on the previous year) and $97,200 for a medium business (up 55 per cent). Ransomware made up 11 per cent of reported cybercrime, and ASD responded to more than 1,200 cyber security incidents over the year.

Those figures are averages of what victims chose to report, so they understate the true cost once downtime, legal fees and lost customers are counted. They also show why the Essential Eight exists: the eight strategies map directly onto the techniques behind those reports. Phishing and stolen passwords are blunted by multi-factor authentication. Ransomware is contained by application control, patching, restricted admin rights and tested backups. Malicious attachments are neutralised by macro restrictions and application hardening.

The eight strategies explained

For each strategy we cover what it does, why it matters, and what Maturity Level One expects in practice, because Level One is the realistic first target for most SMEs. The Level One details are summarised from the November 2023 Essential Eight Maturity Model. The model itself is the authority; where a tender or insurer asks for a specific control, check the wording there.

1. Application control

What it is. Allowing only approved software to run and blocking everything else. Instead of trying to recognise every piece of malware, you define what is permitted.

Why it matters. It is the most effective mitigation against malware and ransomware, because a malicious file that cannot execute cannot do harm. It is also the hardest of the eight to implement well, which is why most businesses tackle it after the quick wins.

What Level One expects. Application control on workstations, restricting executables, software libraries, scripts, installers, compiled HTML, HTML applications and control panel applets in user profiles and temporary folders to an organisation-approved set. Servers come in at the higher levels.

In practice. Windows Defender Application Control or AppLocker deployed through Intune, starting in audit mode to learn what actually runs before enforcing. A 20-person office typically needs fewer than 30 approved applications. Read more: application control, the most effective and hardest strategy.

2. Patch applications

What it is. Applying security updates to the software your staff use every day: web browsers and their extensions, Microsoft Office and other office suites, email clients, PDF software, security products, and any online services your business runs.

Why it matters. Most exploited vulnerabilities have a patch available before the attack. The only question is whether you applied it.

What Level One expects. Patches for internet-facing online services within 48 hours when the vendor rates the vulnerability critical or a working exploit exists, otherwise within two weeks. Office suites, browsers, email clients, PDF software and security products patched within two weeks. A vulnerability scanner run at least weekly against those applications and daily against online services. Software the vendor no longer supports is removed.

In practice. A remote monitoring platform or Intune handles the fleet. The failure points are the applications that do not update themselves and the laptop that has been in a drawer for a month. Read more: why 48 hours matters.

3. Restrict Microsoft Office macros

What it is. Preventing macros in Word, Excel and PowerPoint files from running unless there is a demonstrated business need.

Why it matters. Malicious macros in email attachments delivered a large share of ransomware and banking malware for a decade, and still turn up in phishing campaigns aimed at finance teams.

What Level One expects. Macros disabled for users without a demonstrated business requirement. Macros in files from the internet blocked. Antivirus scanning of macros enabled. Users unable to change macro security settings.

In practice. Microsoft now blocks internet macros by default, so this is mostly a matter of enforcing the setting by policy and handling the one finance spreadsheet that needs an exception. It is the quickest win on the list.

4. User application hardening

What it is. Switching off the features in browsers, PDF readers and Office that attackers rely on and staff do not use.

Why it matters. Every unused feature is attack surface. Drive-by downloads and malicious advertisements only work when the browser is allowed to run what they deliver.

What Level One expects. Internet Explorer 11 disabled or removed. Web browsers do not process Java or web advertisements from the internet. Browser security settings cannot be changed by users.

In practice. Browser policies pushed through Intune or Group Policy, plus ad blocking at the browser or DNS layer. The higher levels extend hardening to Office, PDF software and PowerShell.

5. Restrict administrative privileges

What it is. Limiting who holds admin rights, and separating admin work from everyday work.

Why it matters. An attacker who lands on a machine inherits the rights of the logged-in user. If that user is a local or domain administrator, the attacker owns the environment.

What Level One expects. Requests for privileged access are validated when first requested. Privileged accounts, other than those explicitly authorised, cannot browse the internet, read email or use web services. Administrators use separate privileged and unprivileged accounts and operating environments, and neither can log on to the other’s environment.

In practice. The business owner who runs as a domain admin because it is easier is the most common finding in our assessments. Read more: the Essential Eight strategy most businesses get wrong.

6. Patch operating systems

What it is. The same discipline as patching applications, applied to Windows, macOS, Linux and the firmware on servers and network devices.

Why it matters. A compromised operating system gives an attacker the whole machine, and an unsupported operating system never receives fixes.

What Level One expects. Internet-facing servers and network devices patched within 48 hours for critical or exploited vulnerabilities, otherwise within two weeks. Workstations and internal servers patched within one month. Operating systems the vendor no longer supports are replaced. Windows 10 reached end of support on 14 October 2025, so a Windows 10 device without paid Extended Security Updates fails this control.

In practice. Windows Update for Business rings with a hard deadline. The awkward cases are the old server that runs one line-of-business application and the network equipment nobody has logged into for years.

7. Multi-factor authentication

What it is. Requiring a second factor, such as an authenticator app, a security key or a biometric, in addition to a password.

Why it matters. Stolen and phished passwords are the most common way into an Australian business. MFA turns a stolen password into a failed login, and it is the single control that does most to prevent business email compromise.

What Level One expects. MFA for staff signing in to your organisation’s online services that handle sensitive data (Microsoft 365 or Google Workspace, your accounting platform, your CRM), for third-party online services that handle your sensitive data, and for customers signing in to any online service you provide. The higher levels add MFA for privileged users and for workstation logon, and require phishing-resistant methods.

In practice. Turn it on for every user, not only administrators, and prefer app-based or FIDO2 methods over SMS codes. Conditional Access in Microsoft 365 lets you enforce it without exceptions. See our MFA guide for business and why SMS codes are no longer enough.

8. Regular backups

What it is. Backing up data, applications and settings, keeping copies where an attacker cannot reach them, and proving you can restore.

Why it matters. Backups are the last line of defence when everything else fails, and after ransomware they are the difference between a bad week and a closed business.

What Level One expects. Backups performed and retained in line with business continuity requirements, synchronised to a common point in time, held in a secure and resilient manner, and restoration tested as part of disaster recovery exercises. Unprivileged accounts cannot access other accounts’ backups or modify and delete backups.

In practice. Microsoft 365 and Google Workspace are not backed up by default in the way most owners assume. Treat the 3-2-1 rule as the floor, keep one copy immutable or offline, and restore something every quarter. A backup you have never restored is a hope, not a backup. Read more: the 3-2-1-1-0 backup rule and backup and disaster recovery for Melbourne businesses.

The four maturity levels

The Essential Eight Maturity Model rates each of the eight strategies at one of four levels.

ASD’s advice is to bring all eight strategies to the same level before pushing any one of them higher. Attackers look for the weakest control, not the average.

In our experience a Melbourne SME with a reasonably modern Microsoft 365 or Google Workspace environment can reach Maturity Level One across all eight strategies in two to four months, and Level Two in a further four to eight months, depending on how much legacy equipment and software is in the way. For a fuller breakdown of the levels, read Essential Eight maturity levels: where does your business sit?

What Maturity Level One looks like for a 20-person business

The language of the Maturity Model is written for government assessors. Translated for a 20-person Melbourne office on Microsoft 365, Level One looks like this:

• Application control. Windows Defender Application Control or AppLocker in enforce mode on every workstation, with a short approved list: Microsoft 365 apps, your browser, your accounting and line-of-business software, Teams or Zoom, a PDF reader and the handful of utilities you actually use. Anything else is blocked and staff know who to ask for an exception.
• Patching. Windows Update for Business rings that force updates within a month for workstations, faster for anything internet-facing. Third-party applications updated by the RMM platform within two weeks. A weekly vulnerability report that someone reads. Every device on a supported operating system.
• Macros. Macros blocked from the internet and disabled by policy for everyone except the two or three people who need them for a specific file.
• Application hardening. Browser policies that block Java and web ads, Internet Explorer removed, and settings locked so staff cannot switch them off.
• Admin privileges. Every day-to-day account is a standard user. The two people who need admin rights have separate admin accounts that cannot read email or browse the web, and a written record of why they hold them.
• MFA. Enforced for every user in Microsoft 365 through Conditional Access, plus every cloud application that holds business data, using the Microsoft Authenticator app or security keys rather than SMS.
• Backups. Daily backups of Microsoft 365 data and any servers to a separate provider, one copy immutable or offline, restore tested and the result recorded every quarter, and no standard user able to delete a backup.
• Evidence. A folder containing the Intune and Conditional Access policy exports, patch compliance reports, the approved application list, the admin account register and the restore test log, each dated. This is what an insurer, a customer or an assessor will actually ask to see.

None of that is exotic. It is discipline, a modest amount of tooling most businesses already pay for, and someone accountable for keeping it running. Our 90-day Essential Eight roadmap sets it out phase by phase.

Where businesses fall short, and why the project stalls

Across the Essential Eight assessments we run for Melbourne SMEs, the same gaps come up:

• No application control at all. Antivirus is treated as sufficient. It is necessary, but it is not this control.
• Patching that happens eventually. Updates are applied, but not inside the two-week or 48-hour windows, and nobody can produce a report showing when.
• Admin accounts used for everyday work. Often by the owner or the most senior person, which is exactly who an attacker wants to impersonate.
• MFA with gaps. Enabled on email but not on the accounting platform, the remote access tool or the shared mailbox that pays the invoices.
• Backups that have never been restored. The job runs green every night. The first real restore discovers it excluded the folder that mattered.

The reasons the uplift stalls are rarely technical. Budget competes with everything else the business needs. Staff push back when admin rights are removed or macros stop working, and without a clear explanation the change gets quietly reversed. And the framework demands ongoing maintenance, not a one-off project, so a business without someone accountable for it drifts back to Level Zero within a year. Each of these is a management problem before it is an IT problem, and each is solved by a named owner, a short schedule and evidence that is reviewed.

A practical roadmap to Level One

Step 1: Assess where you are (week 1). Measure every strategy against the Maturity Model and write down the gaps. An independent IT audit is the fastest way to get an honest baseline. Our assessment guide explains what to expect.

Step 2: Set the target (week 1). For most SMEs that is Maturity Level One across all eight. If you supply government or hold health or financial data, plan for Level Two from the start so you do not rebuild later.

Step 3: Take the quick wins (weeks 2 to 4). MFA everywhere, macros blocked, unsupported software removed, admin accounts separated, a restore tested. These deliver most of the risk reduction for the least disruption.

Step 4: Plan the harder controls (weeks 4 to 12). Application control and application hardening need audit mode, staff communication and a phased rollout. Patching needs a platform and a deadline, not a reminder email.

Step 5: Document as you go. Compliance is the ability to show the control, not just to have it. Export the policies, keep the reports, date everything.

Step 6: Review quarterly. Re-run the patch, MFA and backup reports, check the admin register and the approved application list, and record the review. This is the habit that keeps Level One from decaying.

For what the programme costs, see Essential Eight compliance cost: what Australian businesses actually pay.

The Essential Eight on Microsoft 365, Google Workspace and Mac

The Maturity Model was written with domain-joined Windows fleets in mind, and it translates unevenly to a cloud-first business. Most of the controls still apply directly: MFA, admin separation, patching and backups mean the same thing on any platform. Application control and macro restrictions are the ones that need interpretation on macOS and Google Workspace, where the underlying features differ. We have written up both cases in detail: can you meet the Essential Eight on Google Workspace? and the Essential Eight on macOS. For Microsoft 365 environments, Conditional Access policies do most of the heavy lifting for MFA and admin restrictions.

What is changing in 2026: the Essentials series

On 15 June 2026 ASD opened consultation with its Cyber Security Network partners on replacing the Essential Eight with an “Essentials” series of documents grounded in the Information Security Manual. The first chapter, Essentials for enterprise IT, was circulated in draft with consultation closing on 12 July 2026. Media reporting later that month quoted an ACSC official expecting the Essential Eight to be deprecated in about 12 months and retired in about 24 months, with both frameworks running side by side in between. ASD itself has not published a date.

Three things follow for an Australian SME. First, nothing has changed yet: the November 2023 Maturity Model is still current and still what insurers and contracts reference, so finish the uplift you are on. Second, ASD has said organisations already using the Essential Eight “can expect strong alignment with their existing controls and investments”, and the eight strategies are exactly the mitigations any successor will still expect. Third, evidence will matter more than labels: a business that can show how each control is implemented will map to the new structure easily, whatever it is called.

We cover what has been announced, what has only been reported, and five things to do before the final document lands in The Essential Eight is being retired: what Melbourne SMEs should do now. We will update this guide when ASD publishes the final Essentials for enterprise IT.

How TechAssist helps

TechAssist runs Essential Eight assessments and uplift programmes for Melbourne SMEs as part of our cyber security services and managed IT. We assess against the current Maturity Model, give you a prioritised roadmap with the quick wins first, implement the controls in Microsoft 365, Intune and your backup platform, and hand you the evidence folder an insurer or customer will ask for. For managed clients the quarterly review is built into the service, so Level One does not decay.

We do not sell fear and we do not recommend tooling you do not need. Most of what Level One requires is already inside a Microsoft 365 Business Premium licence; the work is configuration, discipline and reporting.

Not sure where you stand? Get in touch or call 1300 028 324 and we will start with a no-obligation conversation about your current maturity and what Level One would take.

Frequently asked questions

What is the Essential Eight in simple terms?

Eight baseline security controls published by the Australian Signals Directorate that, together, stop most cyber attacks on Australian organisations: application control, patching applications, restricting Office macros, hardening user applications, restricting admin privileges, patching operating systems, multi-factor authentication and regular backups.

Is the Essential Eight mandatory for Australian businesses?

Not for private businesses. It is mandatory for non-corporate Commonwealth entities under the Protective Security Policy Framework, which requires Maturity Level Two. Private businesses meet it because insurers, government and enterprise customers, and tender processes ask for it.

What are the Essential Eight maturity levels?

Four levels, Zero to Three. Level Zero means the control is missing or weak. Level One stops opportunistic attackers using commodity tools. Level Two stops attackers who put effort into a specific target. Level Three stops adaptive attackers using their own tradecraft. ASD recommends reaching the same level across all eight strategies.

How long does it take to reach Maturity Level One?

In our experience two to four months for an SME with a modern Microsoft 365 or Google Workspace environment, longer where there is legacy equipment, unsupported software or a large fleet of unmanaged devices.

How much does Essential Eight compliance cost?

It depends on your starting point, your size and how much legacy technology is in the way. Most of Level One can be met with tooling already included in Microsoft 365 Business Premium plus a managed backup platform, so the main cost is the assessment and implementation work. Our compliance cost guide breaks down the components.

Does the Essential Eight apply to Macs and Google Workspace?

Yes. The controls are platform-neutral even though the Maturity Model’s examples are Windows-centric. MFA, patching, admin separation and backups apply directly. Application control and macro restrictions need interpretation on macOS and Google Workspace, which we cover in separate guides.

Is the Essential Eight being replaced?

ASD opened consultation in June 2026 on replacing it with an Essentials series grounded in the Information Security Manual. No final document or retirement date has been published. The Essential Eight Maturity Model remains current, and ASD has said existing Essential Eight controls and investments will align strongly with the new series.

What is the difference between the Essential Eight and ISO 27001?

The Essential Eight is a short list of technical controls with a maturity rating; ISO 27001 is a certifiable management system standard covering governance, risk and process as well as controls. Most Melbourne SMEs need the Essential Eight; only those selling into large enterprise or overseas markets usually need ISO 27001. See ISO 27001 vs Essential Eight.

Sources

• Australian Signals Directorate, Essential Eight Maturity Model, November 2023.
• Australian Signals Directorate, Annual Cyber Threat Report 2024-25, October 2025.
• Australian Signals Directorate, Consultation on evolution of Essential Eight, 15 June 2026.
• Attorney-General’s Department, Protective Security Policy Framework.
• Department of Home Affairs, Mandatory ransomware and cyber extortion payment reporting factsheet.