Essential Eight Explained

What is the Essential Eight?

The Essential Eight is a set of eight baseline cyber security controls published by the Australian Signals Directorate (ASD) and the Australian Cyber Security Centre (ACSC). It was developed from ASD's analysis of real-world cyber incidents and represents the controls that, if implemented correctly, would have prevented the majority of those attacks.

It is not a compliance checkbox. It is a practical, prioritised framework designed to make it significantly harder for attackers to compromise your systems, move laterally, and cause damage.

The eight controls

Each control targets a specific attack vector:

• Application control — only approved applications can execute on your systems
• Patch applications — internet-facing and high-risk applications patched within defined timeframes
• Configure Microsoft Office macro settings — macros disabled or restricted to trusted locations
• User application hardening — web browsers and PDF readers configured to block common attack vectors
• Restrict administrative privileges — admin accounts used only for admin tasks, not email or browsing
• Patch operating systems — OS vulnerabilities patched within defined timeframes
• Multi-factor authentication — MFA required for remote access, privileged accounts, and cloud services
• Regular backups — critical data backed up, tested, and stored offline or immutably

The four maturity levels

Each control has four maturity levels: 0 (not implemented), 1 (partially implemented), 2 (mostly implemented), and 3 (fully implemented). The ASD recommends all organisations target at least Maturity Level 2 across all eight controls.

Maturity Level 3 is required for organisations handling sensitive government data or operating under the Protective Security Policy Framework (PSPF). Many Canberra businesses working with ACT or federal government agencies are expected to demonstrate Level 2 or higher.

Where most Canberra businesses sit

In our experience, most small and mid-sized Canberra businesses are at Maturity Level 0 or 1 across most controls when they first engage with the framework. MFA is often partially implemented — applied to some accounts but not all. Patching is usually reactive rather than systematic. Admin privileges are frequently over-provisioned.

The good news is that Microsoft 365 Business Premium, properly configured, addresses a significant portion of the Essential Eight at Maturity Level 2 — particularly MFA, patching, macro settings, and user application hardening.

The controls that trip businesses up most

Application control is consistently the hardest control to implement. It requires a comprehensive inventory of approved software and a mechanism to block everything else — which is technically complex and operationally disruptive if not planned carefully.

Restricting administrative privileges is the second most commonly under-implemented control. Many businesses have staff with local admin rights on their own machines, or IT staff using admin accounts for day-to-day tasks like email. Separating admin and standard accounts is a foundational change that requires process discipline as much as technical implementation.

Getting started

The first step is a gap assessment — mapping your current environment against each control and maturity level. This gives you a prioritised remediation roadmap rather than a list of everything that's wrong at once.

I.T.S Canberra conducts Essential Eight gap assessments for Canberra businesses and can implement the technical controls as part of a managed IT or cyber security engagement. Most businesses can reach Maturity Level 2 across the majority of controls within three to six months.