The Essential Eight is Australia's baseline cyber security standard: eight mitigation strategies the Australian Signals Directorate considers the minimum protection every organisation should have against the most common attacks. They are mostly technical controls — patching, multi-factor authentication, backups — but two of them quietly depend on staff behaviour, and that dependence is where most small businesses fail an assessment. This guide explains what the eight are, what the maturity levels mean, and who actually needs to care in 2026.
TL;DR
- The Essential Eight is ASD's set of eight priority mitigation strategies, first published in 2017 and updated regularly since.
- Four maturity levels (ML0 to ML3) grade how thoroughly each strategy is implemented — ML2 is the common target for Australian organisations.
- Only 22% of Commonwealth entities hit Maturity Level 2 at their 2025 assessment — the standard is demanding even for well-funded agencies.
- Two of the eight strategies (patching applications and user application hardening) include user-behaviour components that awareness training directly supports.
- Government agencies must implement it; private businesses adopt it voluntarily — usually because insurers, clients or tenders ask.
Why it exists
Australia's signals intelligence agency, the ASD, publishes cyber security guidance through its Australian Cyber Security Centre. After years of incident response, the agency distilled the patterns it kept seeing into eight controls that stop the majority of common attacks: not every attack, and not the most sophisticated ones, but the bulk of what actually hits Australian organisations. The Essential Eight is that distillation, and it has become the de facto benchmark for is-this-organisation-taking-cyber-security-seriously across government, insurance and enterprise procurement.
The eight strategies, briefly
- Patch applications. Fix known vulnerabilities in desktop software within 48 hours of an exploit being published.
- Patch operating systems. Same discipline for Windows, macOS and Linux systems.
- Multi-factor authentication. A second factor on anything that touches the internet — email, VPN, cloud apps.
- Restrict administrative privileges. People use standard accounts for daily work; admin rights are separate and audited.
- Application control. Only approved software can run; everything else is blocked by default.
- Restrict Microsoft Office macros. Macros in documents are a common malware delivery route; they're blocked unless explicitly needed.
- Hardening user applications. Browsers and PDF readers locked down so hostile content can't execute.
- Daily backups. Backup, offline and tested — so ransomware can be rolled back without paying.
Notice what's missing: there's no train-your-staff strategy. But strategies like patching fail when staff delay restarts, MFA fails when people approve push notifications they didn't trigger, and macros fail when someone enables one to open an urgent document. The human layer is assumed, not stated — which is why assessors increasingly look for evidence it's trained.
Maturity levels in one minute
Each strategy is assessed at four levels. ML0 means the strategy isn't in place. ML1 means partial implementation — the baseline for organisations getting started. ML2 means all eight strategies are implemented at a level considered to address the majority of intrusions, and it's the target most organisations (and the Commonwealth's own benchmark) aim for. ML3 means each strategy is implemented to resist even targeted, sophisticated attacks. An assessment grades you per strategy; you can't cherry-pick six of eight and claim a level.
Who needs the Essential Eight in 2026
Australian Government agencies at ML2 is the mandate — non-corporate Commonwealth entities must implement and be assessed, and the 2025 benchmark showed only 22% of assessed entities reached ML2. Private businesses face no federal mandate, but three forces push adoption: cyber insurers increasingly reference it in questionnaires; government and enterprise tenders ask for maturity statements; and industry certification schemes borrow from its logic. For an SMB, the practical question isn't are-we-required but what-do-our-clients-and-insurers-expect — and a security gap assessment answers that against your actual setup.
Where training fits
Two strategies lean directly on staff behaviour. Patching applications at higher maturity levels includes blocking users from circumventing controls — which assumes users understand why the controls exist. User application hardening covers browser and reader configurations users must not bypass. Beyond the written strategies, the assumptions underneath the whole model — people who don't approve unexpected MFA prompts, don't enable suspicious macros, and report phishing quickly — are exactly what a security awareness training programme builds. In 2026 the pairing is standard: technical controls assessed against the Essential Eight, human controls measured through monthly phishing simulations and tracked in human risk reporting.
How to start
- Baseline. Run a security gap assessment — score your current setup against the eight strategies and the maturity levels.
- Fix the cheap ones first. MFA and admin-privilege restrictions are often configuration changes, not purchases.
- Back up properly. Daily, offline, tested — not a cloud sync that ransomware can also encrypt.
- Train the human layer. Monthly micro-training plus simulations, with records kept as assessment evidence.
- Reassess annually. Maturity is a moving target; the strategies are updated as the threat changes.
FAQ
Is the Essential Eight mandatory for private businesses? No — it's mandatory for Australian Government agencies at Maturity Level 2. Private businesses adopt it voluntarily, usually driven by insurers, tenders or clients who ask for a maturity statement.
What's the difference between the Essential Eight and ISO 27001? The Essential Eight is eight specific technical strategies; ISO 27001 is a management-system standard covering governance, processes and controls broadly. Organisations often use the Essential Eight as the technical benchmark inside an ISO 27001 framework — the platform comparison shows which training vendors map evidence to both.
What maturity level should a small business aim for? Maturity Level 1 is the realistic first target; ML2 is where most organisations that sell to government or enterprise want to land. A gap assessment tells you where you stand today.
Does the Essential Eight require staff training? Not as a named strategy — but reaching any maturity level assumes staff who recognise phishing, don't bypass controls and report quickly. Assessors increasingly expect training evidence as part of the human-layer picture.
How long does implementation take? For an organisation starting from ML0, reaching ML1 typically takes months of configuration work, and ML2 longer — the strategies must all be in place simultaneously, not one at a time.
One last thing
The Essential Eight is a floor, not a ceiling — the baseline that makes everything else (insurance, tenders, client trust) possible. Start with the gap assessment, fix the cheap controls first, and train the layer the strategies assume but never name.