Australia has a clear, sensible cybersecurity baseline. Here it is, without the jargon.
The Essential Eight is the Australian Signals Directorate's shortlist of eight baseline cyber security controls, published through its Australian Cyber Security Centre (ACSC). Done properly, they make the everyday attacks on Australian businesses — ransomware, stolen passwords, malware hidden in documents — much harder to pull off. It is the most practical security yardstick an Australian business can work to, and you do not need to be technical to follow it. Below, Key IT explains each control, how the maturity levels work and how to check where you stand.
Update, 15 October 2026: ASD has released ASD Essentials to succeed the Essential Eight, and this guide still applies for now. The Essential Eight remains on cyber.gov.au through a transition expected to last a year or two, and insurers, tenders and clients are still asking for Essential Eight evidence. Work you put into these controls still counts, though ASD advises checking them against Essentials rather than assuming they are equivalent. For what changes and five steps to take this quarter, read what ASD Essentials means for your business.
What are the Essential Eight controls?
The Essential Eight controls are application control, application patching, Office macro settings, user application hardening, restricted administrator privileges, operating system patching, multi-factor authentication (MFA) and regular backups. Here is what each one means in plain English:
Application control
Only programs you have approved are allowed to run, so a malicious file someone downloads or opens from an email simply won't launch.
Patch applications
Keep your software updated, because updates close the security holes attackers exploit.
Configure Office macros
Restrict the little automated scripts in Office documents that are a common malware delivery method.
User application hardening
Switch off risky features in browsers and apps that attackers abuse.
Restrict administrator privileges
Limit who has "admin" powers, because those accounts are the keys to everything.
Patch operating systems
Keep Windows and your servers updated for the same reason as applications.
Multi-factor authentication (MFA)
Require a second proof of identity, such as an authenticator app or passkey, so a phished or leaked password on its own won't let an attacker in.
Regular backups
Keep daily, tested, tamper-proof backups so you can recover from ransomware without paying.
How do the Essential Eight maturity levels work?
The ACSC grades each control on four maturity levels in ASD's Essential Eight Maturity Model, from Level Zero (the baseline isn't met) to Level Three (built to resist skilled, adaptive attackers):
Level Zero
Gaps an opportunistic attacker could walk straight through.
Level One
Designed to stop opportunistic attackers using widely available tools; the right first target for most small businesses.
Level Two
Holds up against attackers who invest more time in a specific target; worth reaching if you hold sensitive client data or an insurer or major customer asks for it.
Level Three
Aimed at adaptive attackers who rely far less on public tools; generally only needed by organisations likely to attract them.
Your overall rating is your lowest control's level, not an average: seven controls at Level One with backups at Level Zero is a Level Zero business, because attackers go looking for the gap. The ACSC's own advice is to bring all eight to the same level before pushing any one higher. Turning on MFA is often the quickest win; application control usually takes the most planning.
Why does the Essential Eight matter?
It matters because the people you do business with are starting to ask about it. Even where it is not legally mandated, the Essential Eight is increasingly expected — by insurers deciding whether to cover you, by larger customers and government before awarding contracts, and by regulators. More to the point, it works: these eight measures stop the attacks that actually happen, and being a small business doesn't take you off attackers' lists. It is the difference between hoping you are secure and knowing where you stand.
How do you find out where you stand?
You find out by checking each control against the maturity levels, with evidence rather than guesswork. Start with Key IT's free Essential 8 self-assessment for a baseline in minutes. For a proper assessment, our Essential 8 compliance service has security-certified engineers score your maturity honestly and build a roadmap to lift it. If you would rather start with the bigger picture, our cybersecurity health check looks at the Essential Eight alongside the rest of your security.
Frequently asked questions
What does the Essential Eight mean in plain English?
It is the ACSC's list of eight security basics: control which programs can run, patch apps and operating systems, lock down Office macros, harden browsers and everyday apps, limit admin accounts, turn on MFA and keep backups you can restore. For the jargon around them, from phishing-resistant MFA to immutable backups, see our plain-English cyber security glossary.
Is the Essential Eight mandatory for private businesses?
Not by law for most private businesses. Many government agencies must implement it, and it increasingly appears in cyber insurance questionnaires, tenders and large-customer contracts, making it effectively a condition of winning some work.
What maturity level should my business aim for?
Start with Maturity Level One across all eight controls — it is designed to block the opportunistic attacks most small businesses face. Step up to Level Two if you hold sensitive client data or an insurer, contract or regulator asks for it.
How is overall maturity calculated?
It equals the lowest level reached by any one of the eight controls, never an average. Strong patching cannot make up for missing backups, so lift your weakest control first.
Does the Essential Eight apply to Macs and Microsoft 365?
Partly. It was designed for business IT networks, mainly Windows PCs and servers, but MFA covers online services like Microsoft 365, and the patching and macro controls cover your Office apps. On Macs and phones the principles still help, though some controls were written with Windows in mind.
Does the Essential Eight stop every cyber attack?
No framework does. It closes the most common doors, but people can still be tricked and logins still leak. Add staff awareness (a free phishing simulation shows how your team responds), a free dark web scan for exposed logins, and Key IT's 24/7 SOC monitoring to spot what slips through.
Who publishes the Essential Eight, and has it changed recently?
The Australian Signals Directorate, through the ACSC. It was introduced in 2017, and the current maturity model dates from ASD's November 2023 update. On 15 October 2026 ASD released ASD Essentials as its successor. The Essential Eight stays on cyber.gov.au during a transition expected to take a year or two, and insurers and larger clients still ask for Essential Eight evidence for now.
Where do you stand on the Essential Eight? Tick the controls you have in place in a free 60-second self-check.
Take the Self-Check