Australia · Australian Signals Directorate (ASD) / ACSC · Essential 8

Essential Eight

The eight baseline mitigation strategies the ASD considers most effective against targeted cyber intrusion.

What it is

The Essential Eight is the ASD's priority list of mitigation strategies. It is drawn from the wider Strategies to Mitigate Cyber Security Incidents. Each strategy has a three-level Maturity Model (ML1, ML2, ML3) showing how well it stops stronger attackers. It is mandatory for non-corporate Commonwealth entities under the Protective Security Policy Framework (PSPF). State and local government, and much of the regulated private sector, use it as a baseline too.

Who it applies to

Mandatory for non-corporate Commonwealth entities under the PSPF. The ACSC recommends it for all Australian organisations. State governments, insurers and boards often treat it as the minimum expectation.

Essential Eight

Requirements

Application control

Block unapproved or malicious code from running, including executables, scripts, installers and compiled HTML.

Patch applications

Apply patches to internet-facing applications within 48 hours; others within two weeks.

Configure Microsoft Office macros

Turn off macros for users who don't need them. Block macros from the internet by default.

User application hardening

Set browsers to block Flash, ads and Java. Turn off untrusted Office add-ins.

Restrict administrative privileges

Limit privileged access to people who need it; review regularly.

Patch operating systems

Apply patches for internet-facing operating systems within 48 hours; others within two weeks.

Multi-factor authentication

Turn on MFA for privileged users, remote access and important data repositories.

Regular backups

Daily backups of important data, retained for three months, tested and held offline or immutable.

Sources

Start with a conversation.

Speak to us about your cyber governance and compliance requirements.

Send us a message

What can we help with?

A sentence or two is plenty. We'll ask for detail when we reply.