What Is the Essential Eight? (Definition and Origin)
The Essential Eight is a cybersecurity framework developed by the Australian Signals Directorate (ASD) comprising eight prioritised mitigation strategies designed to help Australian organisations protect their IT systems against the most common and damaging cyber threats. First published in June 2017 and updated regularly, the framework is built on the ASD's direct experience in threat intelligence, incident response, and penetration testing across Australia's most critical systems.
In simple terms: the Essential Eight tells you the eight most important things you can do right now to significantly reduce your organisation's exposure to a cyber attack.
The Australian Signals Directorate (ASD) received more than 84,700 cybercrime reports in FY2024–25 — an average of one report every six minutes. The average self-reported cost per incident was $80,850 for small businesses and $97,200 for medium businesses. The Essential Eight is the primary framework Australia uses to close that gap.
Unlike broad international standards that cover hundreds of controls, the Essential Eight is deliberately focused and practical. It does not aim to eliminate all cyber risk — it aims to make your organisation a significantly harder target than the majority, which is where most attackers will move on to easier prey.
According to Dr. Kiran Kewalramani, PhD, CISSP, and Founder of Cyber Ethos: "The power of the Essential Eight is its specificity. Australian organisations don't need a 200-control framework to start — they need to do eight things well. That's the ASD's message, and in our experience working across Queensland and nationally, it's the right place to begin."
The 8 Controls Explained: What Each Mitigation Strategy Does
The Essential Eight comprises eight interconnected security strategies that collectively address the most exploited attack vectors in Australian cyber incidents. Each control is designed to be implemented in combination with the others — partial implementation still reduces risk, but the full set is where the protective effect compounds.
MFA alone is no longer sufficient against sophisticated adversaries. The CyberCX 2025 DFIR Threat Report found that 75% of Business Email Compromise (BEC) incidents involved session hijacking — a technique that bypasses MFA by stealing authenticated session tokens rather than credentials. At higher maturity levels, phishing-resistant MFA (hardware tokens, passkeys) is required. Cyber Ethos can assess whether your current MFA implementation is vulnerable to bypass techniques.
Summary: Essential Eight Controls at a Glance
| # | Control | Primary threat addressed | Complexity to implement |
|---|---|---|---|
| 1 | Application Control | Malware execution, ransomware | Medium–High |
| 2 | Patch Applications | Known vulnerability exploitation | Low–Medium |
| 3 | Office Macro Settings | Phishing payloads, malicious docs | Low |
| 4 | User Application Hardening | Browser-based attacks, drive-by downloads | Low–Medium |
| 5 | Restrict Admin Privileges | Privilege escalation, lateral movement | Medium |
| 6 | Patch Operating Systems | OS vulnerability exploitation | Low–Medium |
| 7 | Multi-Factor Authentication | Credential theft, phishing, BEC | Low–Medium |
| 8 | Regular Backups | Ransomware, data loss, extortion | Low–Medium |
Essential Eight Maturity Levels: ML0 to ML3 Explained
The Essential Eight Maturity Model has four levels — ML0 through ML3 — each representing an increasingly rigorous implementation of all eight controls. To achieve a specific maturity level, an organisation must effectively implement all the controls at that level and any lesser levels below it. Partial compliance at a higher level does not constitute that maturity level.
According to the ASD's 2025 Commonwealth Cyber Security Posture report, only 22% of Commonwealth entities achieved Maturity Level 2 or higher across all eight strategies. Additionally, 59% reported that legacy technology was a significant barrier to implementation. If government departments find ML2 challenging, most private sector organisations without a dedicated security function will find it equally demanding — which is why a guided assessment is the recommended starting point.
What maturity level should your organisation target?
The ASD is explicit that maturity selection should be a risk-based decision, not a compliance badge exercise. The correct target maturity level is the one that is proportionate to your organisation's threat profile, the sensitivity of your data, your regulatory obligations, and the resources available to you.
As a general guide:
- ML1 is the minimum acceptable baseline for any Australian organisation with an internet presence or customer data.
- ML2 is appropriate for most private sector businesses handling sensitive data, and is increasingly expected by cyber insurers and enterprise customers.
- ML3 is required for organisations handling classified information, critical infrastructure, or those subject to elevated threat targeting.
Not sure which maturity level applies to you?
Book a consultation with Dr. Kiran Kewalramani. We'll review your current environment and give you a clear, honest answer — no sales pitch, no obligation.
Book your consultation →Who Must Comply with the Essential Eight in Australia?
The Essential Eight was originally designed for Australian government agencies, but its application has expanded significantly. Understanding your specific compliance obligation — mandatory, strongly recommended, or commercially expected — is the first step in determining your implementation priority.
| Organisation type | Obligation | Relevant authority |
|---|---|---|
| Non-Corporate Commonwealth Entities (NCCEs) | Mandatory | Australian Government policy (PSPF) |
| Critical infrastructure operators (SOCI Act) | Strongly expected | Security of Critical Infrastructure Act 2018 |
| State and territory government agencies | Strongly recommended | ASD guidance + state-level cyber policy |
| Government contractors and suppliers | Increasingly required | Procurement conditions and security clauses |
| Private sector businesses | Strongly recommended | ASD, cyber insurers, enterprise procurement |
| Not-for-profit organisations | Recommended | ACSC, sector-specific funding requirements |
Critical infrastructure and the SOCI Act
Australia's Security of Critical Infrastructure (SOCI) Act 2018, as amended in 2022, requires operators of critical infrastructure assets — spanning 11 sectors including energy, water, communications, health, education, financial services, food, defence industry, space technology, transport, and data storage — to implement and maintain a Risk Management Program. While the SOCI Act does not mandate the Essential Eight by name, the ASD strongly recommends Essential Eight as the baseline control set for organisations with SOCI obligations, and assessors routinely use it as the reference framework.
If your organisation operates in any of these sectors, Cyber Ethos recommends treating Essential Eight compliance as a priority obligation — not merely a best-practice recommendation. We have delivered SOCI-aligned cybersecurity programs for critical infrastructure operators across Queensland and Australia.
How to Assess Your Essential Eight Maturity: Step-by-Step
An Essential Eight assessment is a structured evaluation of your current IT environment against all eight controls at each maturity level. The outcome is a maturity scorecard — showing your current level for each control — together with a gap report and a prioritised remediation roadmap.
Here is the standard assessment process that Cyber Ethos follows, aligned with ASD methodology:
-
Document your current stateInventory your systems, applications, and existing security controls. Document current patching processes, backup procedures, authentication methods, and administrative access policies. This establishes the baseline from which gaps are measured.
-
Determine your target maturity levelBased on your industry, regulatory obligations, threat profile, and risk appetite, determine which maturity level you are working toward. This is not one-size-fits-all — an NFP at ML1 may be entirely appropriate where a government contractor must achieve ML2.
-
Assess each control against maturity criteriaFor each of the eight controls, evaluate your current implementation against the specific ASD criteria for your target maturity level. Identify gaps — controls that are absent, partially implemented, or implemented inconsistently across your environment.
-
Produce the gap report and remediation roadmapConsolidate findings into a gap report that prioritises remediation actions by risk impact and implementation complexity. Quick wins (e.g., enabling MFA on Office 365, configuring macro settings) should be actioned first to achieve early risk reduction.
-
Implement, monitor, and re-assess quarterlyEssential Eight compliance is not a one-time project. The ASD recommends quarterly reviews of administrative privileges and MFA coverage, monthly backup restoration testing, and an annual comprehensive assessment including penetration testing focused on the Essential Eight controls.
Ongoing monitoring metrics to track
- Percentage of systems with application control enabled
- Average time to patch critical applications and OS updates
- Percentage of user accounts with MFA enrolled
- Number of admin accounts vs total user accounts (privilege ratio)
- Backup restoration success rate and recovery time objective (RTO)
- Number of macro execution attempts blocked per month
Essential Eight Implementation: Common Challenges and How to Solve Them
Despite its focused nature, implementing the Essential Eight is not without difficulty. In the ASD's 2025 Commonwealth Cyber Security Posture report, 59% of entities cited legacy technology as a barrier to implementation — and private sector organisations often face the same constraints with fewer dedicated security resources. Here are the most common challenges and practical solutions.
Essential Eight vs Other Frameworks: ISO 27001, NIST, and Cyber Essentials
The Essential Eight is one of several cybersecurity frameworks available to Australian organisations. Understanding how it relates to other standards helps you make informed decisions about which frameworks to prioritise — and how they can work together.
| Framework | Origin | Focus | Mandatory in AU? | Best for |
|---|---|---|---|---|
| Essential Eight | Australia (ASD) | Operational controls — specific, prioritised technical actions | Yes (NCCEs) | All Australian organisations as a starting baseline |
| ISO 27001 | International (ISO/IEC) | Information Security Management System (ISMS) — governance and risk | No | Governance framework, enterprise risk, international certification |
| NIST CSF | United States (NIST) | Risk management framework across 5 functions: Identify, Protect, Detect, Respond, Recover | No | Organisations with US regulatory obligations or multinational operations |
| Cyber Essentials | United Kingdom (NCSC) | 5 basic technical controls, similar scope to Essential Eight | No | Organisations with UK government contracts or UK-aligned clients |
| SOCI Risk Management Program | Australia (ASD/Home Affairs) | Risk-based program for critical infrastructure operators | Yes (SOCI entities) | Critical infrastructure operators across 11 sectors |
Essential Eight and ISO 27001: complementary, not competing
The most important point about the Essential Eight vs ISO 27001 comparison: they are complementary frameworks designed to work together, not competing alternatives. The Essential Eight provides specific operational controls — the "what to do technically." ISO 27001 provides the governance structure — the "how to manage it organisationally." Many Australian organisations use Essential Eight as the operational baseline and pursue ISO 27001 certification as the governance overlay. Cyber Ethos delivers both, and our Right Fit for Risk (RFFR) assessment framework evaluates organisations against both simultaneously.
Essential Eight for SMEs and Not-for-Profits in Australia
One of the most common misconceptions about the Essential Eight is that it is only relevant to large government agencies or enterprise-scale organisations. This is incorrect. The ASD explicitly recommends that all Australian organisations, regardless of size or sector, implement the Essential Eight proportional to their risk profile.
For small-to-medium businesses and not-for-profit organisations, the framework remains the right starting point — but the implementation approach needs to be calibrated to your resources and actual risk exposure. This is where the Right Fit for Risk (RFFR) methodology becomes particularly valuable.
What is Right Fit for Risk (RFFR)?
Right Fit for Risk (RFFR) is an assessment methodology that evaluates an organisation's cybersecurity posture against both Essential Eight and ISO 27001 frameworks, scaled to the organisation's size, industry, and realistic threat profile. Rather than applying a one-size-fits-all compliance framework, RFFR produces a gap report and remediation roadmap that prioritises the actions with the highest risk reduction impact for your specific context.
For an NFP with limited IT resources, an RFFR assessment might determine that achieving ML1 across all eight controls and ML2 specifically on MFA and backups is the appropriate target — rather than pursuing ML3 across the board, which would be disproportionate to the organisation's threat profile and budget.
If you are a small business or NFP and do not know where to start: MFA on all internet-facing accounts (especially email), current OS and application patching, and tested backups stored offline are the three controls that provide the highest risk reduction per dollar invested. Start there, then work toward full ML1 compliance with support from Cyber Ethos.
Cyber Ethos has delivered RFFR assessments for a range of Queensland-based NFPs, government-funded service organisations, and SMEs. Our approach is designed to be practical, affordable, and proportionate — not to sell you compliance overhead you don't need.
How Cyber Ethos Helps You Achieve Essential Eight Compliance
Cyber Ethos delivers end-to-end Essential Eight assessment and implementation support for Australian organisations across government, healthcare, critical infrastructure, NFP, and private sector. Our approach is led by Dr. Kiran Kewalramani, PhD, CISSP, CISA, GAICD, and two-time international cybersecurity award winner — one of Australia's most credentialled independent cybersecurity practitioners.
Our Essential Eight service includes:
- Baseline assessment — a structured evaluation of your current environment against all eight controls at your target maturity level, delivered remotely or on-site across Australia
- Gap report — a clear, plain-language report identifying which controls are implemented, partially implemented, or absent, with risk ratings for each gap
- Remediation roadmap — a prioritised action plan with timelines, resource requirements, and quick wins identified for early risk reduction
- Implementation support — hands-on guidance for your IT team during remediation, including configuration review, policy development, and staff awareness training
- Annual reassessment and ongoing monitoring — to ensure your maturity level is maintained as your environment evolves and threat landscapes change
Book your Essential Eight assessment
Contact Cyber Ethos today for a initial consultation. We'll assess your current environment, identify your compliance obligations, and give you a clear roadmap — no jargon, no inflated scope.
Book a Essential Eight consultation →📞 1800 CETHOS (1800-238-467) · cyberethos.com.au