The Essential Eight is the Australian Government’s baseline cyber security framework. It is a set of eight practical strategies, published by the Australian Signals Directorate (ASD), that make systems much harder to break into when they are used together. Progress is measured in three maturity levels, and this guide explains what each level means for your business.
Not sure where you stand today? Book a cyber health check and find out.
The Eight Controls in Plain English
Each control blocks a real attack path. Here they are in ASD’s order.
- Application control. Only approved software can run on your computers. If ransomware or an unknown program tries to start, it is blocked by default.
- Patch applications. Browsers, Office and PDF readers are updated quickly, so known security holes are closed before attackers use them. Higher maturity levels shorten the deadlines, down to 48 hours in some cases.
- Configure Microsoft Office macro settings. Macros are hidden code inside Office files that criminals use to deliver malware. They are blocked for staff who don’t need them and only allowed from trusted sources for those who do.
- User application hardening. Risky features nobody needs, such as Internet Explorer 11, Java in the browser and web ads, are switched off. This shrinks the target your team presents every day.
- Restrict administrative privileges. Admin accounts are limited, kept separate from everyday accounts and reviewed regularly, so one stolen password can’t hand over your whole network.
- Patch operating systems. Windows and other systems get the latest security fixes, and unsupported versions are replaced. Old, unpatched systems are the easiest way in.
- Multi-factor authentication (MFA). A second check at sign-in, such as an app prompt or security key, means a stolen password isn’t enough on its own. It blocks most account takeover attempts, and at higher levels it must be Our Microsoft Entra ID service can help set it up.
- Regular backups. Recent, tested copies of your important data are kept where ransomware can’t reach them, and restores are practised so recovery is a procedure rather than a hope. See our backup services.
You can read the full framework on the ASD’s cyber.gov.au page.
Essential Eight Maturity Levels: Level 1, 2 and 3
The maturity levels use the same eight controls, applied more strictly depending on who you need to keep out.
Maturity Level 1: The Baseline
This suits most Australian businesses. It protects against opportunistic attackers using common tools, such as the everyday phishing and malware campaigns that catch so many businesses out. All eight controls are in place to the Level 1 standard.
Maturity Level 2: For Businesses That Get Targeted
This level defends against attackers who are willing to spend real time and effort on you. Expect faster patching, stronger MFA and more logging. It is commonly expected for government and defence-related work.
Maturity Level 3: The Highest Level
This level is built to withstand determined, well-resourced attackers who adapt as they go. It is the strictest version of all eight controls, for organisations that can’t afford “almost”.
How Codehyper Can Help
Our managed IT and network security services help Australian businesses work towards the level they need. We start by checking where you are today, then give you a clear, prioritised list of fixes in plain English. You can also explore our full range of IT services on the Codehyper homepage.
Frequently Asked Questions
What does Essential Eight mean?
It means eight cyber security strategies from the Australian Signals Directorate that, together, make it much harder for attackers to compromise your systems.
Is the Essential Eight mandatory for Australian businesses?
Generally no. It is mandatory for some government bodies, but many private businesses adopt it because clients, insurers and tenders ask for it.
What is Essential Eight Maturity Level 1?
It is the baseline level. It covers all eight controls and defends against common, opportunistic attacks.
How much does Essential Eight compliance cost?
It depends on your size, your current setup and the level you are aiming for. A health check is the easiest way to get a realistic figure.
Who publishes the Essential Eight?
The Australian Signals Directorate, through its Australian Cyber Security Centre.
How do I find my current maturity level?
An assessment compares your systems against each control. Our Microsoft 365 security assessment is a good place to start.
Find Out Your Essential Eight Maturity Level
Contact our team and we’ll walk you through where your business stands, which level to aim for and what to fix first.
