Understanding the Essential Eight
The Essential Eight is an Australian Signals Directorate baseline for making systems harder to compromise. It is not certification, a guarantee of security or a general legal requirement for every private business.
What is the Essential Eight?
The Essential Eight is a set of eight mitigation strategies published by the Australian Signals Directorate:
- Application control
- Patch applications
- Restrict Microsoft Office macros
- User application hardening
- Restrict administrative privileges
- Patch operating systems
- Multi-factor authentication
- Regular backups
The current maturity model describes criteria across three maturity levels, plus Maturity Level Zero where weaknesses in overall cyber-security posture exist.
Primary source: ASD/ACSC Essential Eight and current Essential Eight Maturity Model
Why does assessment scope matter?
Any maturity finding is only meaningful when the scope is clear. The scope may include business units, users, devices, applications, cloud services, servers, sites and third parties.
A finding applies to that scope and the evidence available at the time. It is not a blanket judgement about the whole organisation.
How should an organisation choose a target maturity level?
The appropriate target depends on the organisation’s threats, consequences, environment and external requirements. The ASD maturity model is intended to be considered as a package across all eight strategies rather than as isolated controls.
Is the Essential Eight mandatory?
It is mandatory for some Australian Government entities under applicable government policy. For many private businesses it is guidance rather than a general legal requirement, although contracts, tenders, clients, insurers or regulators may set their own requirements.
Will the Essential Eight stop every cyber incident?
No. It is a baseline designed to make systems harder to compromise and reduce the impact of some incidents. It does not remove all risk or replace governance, staff processes, monitoring, incident response and other controls appropriate to the organisation.