Short answer
No. The Essential Eight does not have a control that directly requires security awareness training. Only 4 of its 31 mitigation strategies even mention staff, and the closest training-related reference (strategy 69, on external web and email traffic inspection) mentions awareness only as a side note for users. If you are chasing Essential Eight maturity, a training programme will not score you a single point.
That said, this is the control everyone asks about, because auditors and insurers keep bringing it up anyway. Here is what the framework actually says, what sits next to it, and how to handle the training question without wasting budget.
What the Essential Eight actually says about training
This is what a straight search for the word "staff" across the published Essential Eight mitigation strategies turns up:
- Strategy 52 (Patch applications): staff reporting of faulty applications.
- Strategy 58 (Restrict Microsoft Office macros): staff reporting of warnings and security warnings.
- Strategy 69 (Inspect and analyse external web and email traffic): users made aware of inspection; web and email content inspection.
- Strategy 87 (Patch operating systems): staff reporting of faulty operating systems.
That is the full list. There is no strategy that says "deliver X hours of training" or "run a phishing simulation every quarter". Strategy 69's mention of awareness is about users knowing their web and email traffic is inspected - a privacy transparency note, not a training control.
Two related strategies sit nearby and are worth knowing about:
- Strategy 78 (Communications between voice and video conferencing software and SIP gateways) - mentions communication but is about technical configuration, not people.
- Strategy 97 (Service throttling for internet-facing services) - a resilience control, nothing to do with staff.
So if a vendor tells you their training platform is "Essential Eight certified" or that buying it moves you up a maturity level, that is not what the framework says.
Why it still matters
Just because training is not a scored control does not mean it is irrelevant. Most real incidents start with a person: a clicked link, a rushed invoice approval, a password reused from a personal account. The technical controls in the Essential Eight (patching, MFA, application control, macro restrictions, least privilege, logging) are designed assuming people will click things. Training is what reduces how often that happens in the first place, and it is the layer that helps everything else work.
Auditors also frequently ask for evidence of security awareness training even though it is not a scored Essential Eight control - it fits into the broader governance conversation (for example, ISO 27001 Clause 7.2 and A.6.3 do require competence and awareness training, and many Australian businesses run Essential Eight and ISO 27001 programmes side by side). So the practical answer for most Australian organisations is: Essential Eight does not require it, but something else in your compliance stack probably does.
What the Essential Eight does require
Rather than chase a training control that does not exist, focus on the eight strategies that actually score:
| # | Strategy | Typical implementation effort |
|---|---|---|
| 1 | Patch applications | Weeks (inventory and change control) |
| 2 | Patch operating systems | Weeks (inventory and change control) |
| 3 | Application control | Weeks to months (whitelisting) |
| 4 | Restrict Microsoft Office macros | Days to weeks (policy and tooling) |
| 5 | User application hardening | Days to weeks (browser and email hardening) |
| 6 | Restrict administrative privileges | Days to weeks (identity cleanup) |
| 7 | Multi-factor authentication | Days (identity platform configuration) |
| 8 | Regular backups | Days (backup tooling and testing) |
Effort varies by environment, but the point stands: the maturity journey is almost entirely technical. Budget and attention should go there first.
Where training fits in a practical programme
If you are an Australian business working toward Essential Eight maturity, training is not wasted - it is just not what the framework measures. The most useful place it lands is as a supplement to the technical controls:
- Supporting strategy 58 (macro restrictions): staff who understand why Office macros are blocked are less likely to try to work around it.
- Supporting strategy 55 (MFA): staff who can spot a phishing email are less likely to hand over an MFA code to an attacker.
- Supporting strategy 90 (continual access revalidation): staff who understand why they lose access to a system they had yesterday are less likely to quietly build workarounds.
For every one of those, training is the human-behaviour layer that makes the technical control actually hold. It just does not score a maturity level on its own.
How to handle the training question with auditors and insurers
When an auditor or insurer asks about security awareness training in an Essential Eight context:
- Answer honestly: it is not a scored Essential Eight control. Do not let anyone present it as one.
- Show what you do have anyway. A training platform with completion records, phishing simulation history, and per-user risk reporting gives you something to show for the people side of risk.
- Point to the specific strategies training supports (58, 55, 90 above). This frames training as a support layer, not a scored control.
- Check what your other frameworks require. ISO 27001 A.6.3, the ISM's people-focused guidelines, and most cyber insurance questionnaires all mention training. Cover those requirements there instead.
If you want a platform that produces auditor-ready evidence of training, security awareness training runs on a monthly cadence with completion records, and human risk reporting gives per-user risk evidence you can hand to an auditor or insurer.
Practical checklist
If you are building or reviewing an Essential Eight programme right now:
- Score yourself honestly against all 31 mitigation strategies across the 8 strategies - not just the ones your vendor sells to.
- Put budget toward the technical controls that actually score, especially patching and MFA, which most businesses can move fastest on.
- Add training as a supporting layer: monthly short modules, a phishing simulation each month, and remediation for anyone who fails.
- Track training evidence in a form your auditor can use (completion records, simulation results, per-user reporting) rather than a certificate nobody reads.
- Check your other frameworks (ISO 27001, ISM, insurance) for what they actually require from training, and cover that separately.
The Australian Cyber Security Centre publishes the Essential Eight and its maturity model at cyber.gov.au, which is the authoritative reference for what is and is not a scored control.
FAQ
Is security awareness training one of the Essential Eight mitigation strategies? No. The Essential Eight covers eight technical strategies broken into 31 specific mitigation strategies, and none of them are training controls. Only 4 of the 31 even mention staff, and those are about reporting faults or being aware that traffic is inspected - not about delivering training.
Will a training platform help me reach Essential Eight maturity? Not directly. Maturity levels are assessed on the technical controls. Training helps those controls hold in practice, and it supports the staff-facing parts of strategies 58, 55 and 90, but it will not score you points on an assessment.
Does ISO 27001 require security awareness training? Yes. ISO 27001:2022 requires awareness and competence under Clause 7.2 and Annex A.6.3. This is separate from the Essential Eight, and many Australian businesses run both frameworks together.
Do auditors ask about training in an Essential Eight assessment? Often, yes, as a governance question rather than a scored control. Having completion records and phishing simulation history on hand is the easiest way to answer well.
What should a small business do if it can only afford one thing? Fix the technical controls first - MFA and patching give the biggest risk reduction for the least spend. Add training as a second step, not the first.
Where is the authoritative list of Essential Eight strategies? The Australian Cyber Security Centre publishes it at cyber.gov.au. Any vendor claim about "Essential Eight certified training" should be checked against what the framework actually scores.