Remote SupportASD consultation closed 12 July 2026
ASD is evolving the Essential Eight into a new Essentials series.
The first chapter, Essentials for enterprise IT, has been through public consultation via the ASD Cyber Security Partnership Program, which closed on 12 July 2026. ASD expects to begin deprecating the Essential Eight at roughly the 12-month mark and retire it entirely at around 24 months, with both frameworks running concurrently in the meantime. The mitigation strategies behind today's Essential Eight remain the foundation, so if your organisation is mid-flight on ML1 to ML3, keep going. We have written a Real Bytes view on what is changing and what to do between now and the final framework.
Why Essential Eight Matters
The Australian Cyber Security Centre analysed thousands of intrusions and distilled the controls that actually stop attacks. The Essential Eight is not theoretical. It is the set of controls that, if implemented correctly, blocks most targeted intrusions.
It is also the de facto standard for Australian businesses. Cyber insurers, government tenders, major customers, and compliance frameworks (ISO 27001, SMB1001, CPS 234) reference it. Not having a maturity rating is increasingly a commercial and insurance problem.
Eight Controls, Three Jobs
The Essential Eight is usually drawn as a wheel, which hides the useful part. The eight controls are not eight equal boxes to tick. They do three different jobs: stop the attack landing, contain it if it does, and get you back on your feet.
Job one
Stop malicious code running
Four controls that close the front door.
Application control
Only approved software is allowed to execute. Everything else is blocked by default.
Patch applications
Browsers, Office, PDF readers and the rest, patched fast. Critical flaws inside two weeks, or 48 hours when actively exploited.
Configure Office macro settings
Macros off for users who do not need them, blocked from the internet, and scanned when they are allowed.
User application hardening
Turn off the risky bits users never asked for: web ads, Java in the browser, legacy scripting.
Job two
Limit how far an incident spreads
Three controls that decide whether one compromised account becomes a company-wide event.
Restrict administrative privileges
Admin rights granted on request, reviewed regularly, and never used for email or web browsing.
Patch operating systems
Same urgency as applications, and unsupported versions retired rather than nursed along.
Multi-factor authentication
On for every user, every remote service, and phishing resistant where it matters most.
Job three
Get the business back
The control everyone assumes is handled, and the one ransomware tests first.
Regular backups
Backed up on a schedule that matches what you can afford to lose, kept where an attacker with admin rights cannot reach them, and restored as a test rather than as a surprise.
Maturity Levels
You do not need ML3 overnight. Most SMBs target ML1 to ML2. ML3 is for high-risk or regulated organisations. Having all eight controls in place is not the same as being at a given maturity level. Most businesses that believe they are compliant sit at level zero on two or three controls, usually application control and backups.
ML0
Level zero
Weaknesses an opportunistic attacker can walk through.
ML1
Level one
Holds up against widely available tooling and commodity attacks.
ML2
Level two
Holds up against attackers willing to spend time on you specifically.
ML3
Level three
Holds up against adaptive attackers with real resources.
The 8 Controls in Detail
1. Application Control
CriticalWhat it means
Only approved applications can run. Windows Defender Application Control (WDAC) or AppLocker.
Common mistakes
Rolled out too fast, breaks business apps. Not applied to servers. No monitoring of blocked attempts.
Why it matters
Blocks 85-95% of malware execution. Single highest-impact control.
2. Patch Applications
CriticalWhat it means
All internet-facing apps patched within 48 hours of critical CVE. Office, browsers, PDF readers, Java.
Common mistakes
Only patching OS, not apps. No inventory. Manual patching that slips.
Why it matters
Most exploited CVEs are in third-party apps, not Windows.
3. Configure Microsoft Office Macros
CriticalWhat it means
Block macros from the internet. Only allow signed macros from trusted publishers.
Common mistakes
All macros enabled. No signing policy. No block for Mark-of-the-Web.
Why it matters
Macros remain a primary initial access vector despite Microsoft defaults.
4. User Application Hardening
HighWhat it means
Disable Java, Flash (dead but still present), ads and pop-ups in browsers. Harden Office.
Common mistakes
No managed browser policy. Legacy Java still installed on accounts team laptops.
Why it matters
Reduces drive-by and credential-harvesting attacks from the browser.
5. Restrict Administrative Privileges
CriticalWhat it means
Admins use separate admin accounts. No daily work on admin accounts. Privileged Access Management.
Common mistakes
Daily user is also a domain admin. Admin rights granted and never revoked. No review cycle.
Why it matters
Blocks lateral movement and privilege escalation. Most attacker goals require admin.
6. Patch Operating Systems
CriticalWhat it means
All OS patched within 48 hours for critical, 30 days for others. Unsupported OS retired.
Common mistakes
Windows Server 2012 still running. Patches deferred indefinitely. No reboot windows.
Why it matters
Unpatched OS is one of the top three initial access vectors.
7. Multi-Factor Authentication
CriticalWhat it means
MFA on all remote access, privileged accounts, and cloud services. Phishing-resistant for admins at ML3.
Common mistakes
SMS on admin accounts. Legacy auth still enabled. No CA policy for external apps.
Why it matters
Blocks 99%+ of automated credential attacks. Non-negotiable.
8. Regular Backups
CriticalWhat it means
Daily, tested, immutable, offsite. 3-2-1-1-0 rule applied.
Common mistakes
Backups on the same domain. Never tested. Retention too short. No SaaS backup.
Why it matters
Recovery from ransomware, hardware failure, and human error. Your last line.
Implementation Roadmap (Practical)
Order of implementation matters. Do not try to do all eight at once. Recommended 6-month plan for SMBs:
Month 1
MFA everywhere (control 7). Patch critical OS and app CVEs (controls 2 and 6). Low effort, highest impact.
Month 2
Backup review and immutability (control 8). Office macro hardening (control 3). Measurable wins quickly.
Month 3
Admin account review and segregation (control 5). Remove unnecessary admin rights. Privileged account workflow.
Month 4
User application hardening (control 4). Managed browser policies. Disable legacy Java. Office attack surface reduction.
Month 5
Application control (control 1) in audit mode. Build allowed-software inventory. Move to enforce for pilot group.
Month 6
Application control enforce mode. Final gap audit. Document for insurance renewal. Plan ML2 or ML3 uplift.
The Gaps Every Audit Finds
App control never reached enforce mode
Audit mode is not control. Must move to enforce or it does not count.
Patches managed manually via RDP
Automated patching with reporting is expected. Manual does not scale and will fail.
Macros allowed from trusted locations
Trusted locations bypass macro policy. Remove them.
Domain admin used as daily account
The single most common audit finding. Split the accounts.
No offsite or immutable backup
Local backup alone is not compliant. Must be air-gapped or immutable.
No MFA on VPN
Often overlooked. Remote access without MFA fails Essential Eight.
The recommended next step: SMB1001 certification
Essential Eight gives you the technical baseline. SMB1001 wraps it in a certifiable, tiered Australian standard that procurement teams, insurers and enterprise clients increasingly ask for. For most Australian SMBs we work with, this is the most practical certification pathway alongside Essential Eight uplift.
Built for Australian SMBs
Five tiers from Bronze to Diamond. Achievable, affordable, and updated annually.
Recognised in procurement
Increasingly specified in Australian government tenders, enterprise vendor onboarding and cyber insurance underwriting.
Real Bytes is CyberCert Gold
We hold the certification ourselves. We guide you from the same playbook we ran on our own business.
Essential Eight and Cyber Insurance
Most Australian cyber insurers reference the Essential Eight in renewal questionnaires. Maturity Level 1 is typically the minimum for cover. ML2 often unlocks better premiums. Gaps on MFA, backup, and admin controls are the top reasons for denied claims.
Related: Cyber Insurance Readiness, IT Risk Guide, SMB1001 certification.
Achieve Essential Eight Maturity
We run Essential Eight uplifts end to end: gap assessment, ML1 to ML3 roadmap, implementation, audit, and quarterly reviews. ACSC Network Partner.