Short answer: the Essential Eight itself does not require security awareness training at all - awareness is not one of the eight strategies. But the framework the Essential Eight maps to, the Australian Signals Directorate's Information Security Manual (ISM), does require it: control ISM-1565 mandates tailored privileged user training, annually, for everyone with privileged access. And three of the eight strategies only work if the people holding administrative privileges behave. So for any Australian organisation running the Essential Eight, the practical answer is yes - administrators need their own track, and the requirement lives in the ISM rather than in the eight strategies themselves.
TL;DR
- The eight strategies are technical: patch applications, patch operating systems, multi-factor authentication, restrict administrative privileges, application control, restrict Microsoft Office macros, user application hardening and regular backups. Awareness training is not among them.
- The Essential Eight maps to the ISM, whose personnel security guidelines carry the training controls: ISM-0252 (annual awareness training for all personnel) and ISM-1565 (annual tailored privileged user training, revised September 2026).
- ASD publishes its own free Privileged User Training video series for exactly this audience, aligned with the ISM.
- Restrict administrative privileges is the strategy most sensitive to admin behaviour, and the one an assessor probes hardest.
- Build the privileged track as a separate annual course on top of the general baseline, and record both in a training register (ISM-2022) so the split is visible.
What the eight strategies actually cover
The Essential Eight is a set of technical mitigation strategies, published by the Australian Signals Directorate (Essential Eight overview). The eight are:
- Patch applications
- Patch operating systems
- Multi-factor authentication
- Restrict administrative privileges
- Application control
- Restrict Microsoft Office macros
- User application hardening
- Regular backups
None of them is a training control. A compliance reading of the Essential Eight alone could conclude that no awareness programme is required at all - which is exactly the trap. The maturity model explicitly maps to the ISM, so anything the ISM requires of an organisation implementing the Essential Eight is in scope, and the ISM's personnel security guidelines are unambiguous about training.
Where the training requirement actually lives
Three controls in the ISM's guidelines for personnel security do the work:
- ISM-0252 - cyber security awareness training is undertaken annually by all personnel, covering the purpose of the training, security contacts, authorised use of systems, protection of systems, and how to report incidents and suspected compromises.
- ISM-1565 (revision 1, updated September 2026) - tailored privileged user training is undertaken annually by all personnel with privileged access to systems and their resources. The guidelines name application administrators, system administrators and network administrators as the groups meant.
- ISM-2022 - a cyber security awareness training register is developed, implemented and maintained, so per-person completion records exist and can be produced on request.
The tailoring matters. The ISM is explicit that general awareness training does not cover privileged users: the manual states that personnel with privileged access require tailored privileged user training on top of the general programme. That is the separate track this article is about.
Why admin behaviour decides three of the eight
A technical assessor can test most of the eight with tooling. Three of them break from the admin side of the keyboard:
- Restrict administrative privileges. The control requires that admin accounts are used only for administrative tasks, that privileged access is revalidated (Level 2 requires revalidation every 12 months and disabling after 45 days of inactivity), and that privileged use of systems is logged. All of that depends on administrators actually using separate accounts - a habit, not a setting.
- Multi-factor authentication. Phishing-resistant MFA at Level 2 is defeated the moment an administrator approves a prompt they should not. Simulated push-bombing and MFA-fatigue scenarios are how that habit is built.
- Regular backups. Backups must be protected from unprivileged modification - and from privileged misuse. The behaviour that matters here is the administrator who never bypasses backup integrity controls "just this once".
That is the case for a separate track: the failure modes are different from general staff's. A general course covering invoice fraud and password hygiene does not teach an administrator why their admin account should never touch email.
What ASD's Privileged User Training covers
ASD publishes its own answer to ISM-1565: Privileged User Training, a free series of short video modules for privileged users across government, business and critical infrastructure. The modules cover the cyber threat landscape and how vulnerabilities are exploited, proactive defence and defence-in-depth, managing cyber security risk in enterprise environments, and building a positive security culture - with the explicit aim of helping organisations meet the annual privileged user training obligation in the ISM.
It is a reasonable free foundation. What it does not do is tailor to your systems, test your administrators, or produce per-person completion records in a register. A platform-delivered track does all three: security awareness training delivered annually with per-learner completion dates satisfies both the tailoring and the evidence requirement at once.
Building the privileged track
- List who actually holds privileged access. Not just IT: developers with production access, HR system administrators, anyone who can grant themselves permissions. The list is usually longer than expected.
- Take the general baseline for granted. Privileged users still complete ISM-0252 training like everyone else. The privileged track is additive.
- Build the track around their systems. Account misuse, admin-credential phishing, session hygiene, logging, and why admin tasks happen on admin accounts. ASD's PUT module list is a usable syllabus.
- Add simulation. Privileged-targeted phishing simulations - fake IT escalation requests, fake emergency access approvals - are the fastest way to find who will approve an exception under pressure. Cyber Aware's phishing simulations record who clicked and auto-enrol clickers into remediation the same day.
- Record completion per person with dates. The register (ISM-2022) needs the privileged track distinguishable from the baseline, or an assessor cannot see the split.
Evidencing it at assessment time
Because the Essential Eight assessment process examines the maturity model per requirement, training evidence usually surfaces when the assessor tests the behavioural side of restrict administrative privileges, MFA and backups. What holds up: per-person completion records with dates, content that visibly differs from the general baseline, and an annual cadence that restarted within the last 12 months. What fails: a single all-staff course presented as privileged training, and completion totals with no per-person register behind them.
The maturity-model rule that the same level must be achieved across all eight strategies applies - an organisation that is Level 2 on patching and Level 0 on admin-privilege behaviour is assessed at Level 0. Our Essential Eight maturity levels benchmark explains how the levels are scored.
FAQ
Is awareness training part of the Essential Eight? No. The eight strategies are technical controls; awareness training is not one of them. The training requirements come from the ISM, which the Essential Eight maps to.
Does the ISM require separate training for privileged users? Yes. ISM-1565 requires tailored privileged user training annually for all personnel with privileged access, separate from the general annual awareness training required by ISM-0252.
Is ASD's Privileged User Training mandatory? It is a free resource, not a mandate - the mandate is ISM-1565 itself. Using ASD's modules is one way to meet it; a platform-delivered tailored track is another.
Who counts as a privileged user? Anyone with access beyond a standard user: application, system and network administrators are named in the ISM, and in practice developers with production access and HR-system admins belong on the list too.
How long does the privileged track need to be? The ISM does not set a duration - it requires annual, tailored training. Short modules completed beat a long course skipped; the register is what proves it happened.
One last thing
Count the people who can grant themselves permissions. That number - not the IT team's headcount - is the size of the privileged track, and it is almost always bigger than the first guess.