Essential Eight Guide

An organisation can meet most Essential Eight requirements and still be at Maturity Level Zero, because ASD's model counts a level only when every requirement for every strategy is met. The Essential Eight is the Australian Signals Directorate's (ASD) baseline of eight mitigation strategies, assessed against a maturity model with four levels. This guide explains the strategies, what each maturity level is designed to stop, the per-level requirements as they map to Information Security Manual (ISM) controls, how assessments work, and how the model relates to IRAP and the ISM. It is written for security teams, assessors and IT leads in Australian organisations and for suppliers asked to evidence Essential Eight maturity in tenders. ASD's own publication is the authority: requirements below are taken from readable copies and mappings, checked on 16 October 2026, so confirm them against the current version on cyber.gov.au before relying on them in an assessment.

Key takeaways

• A level counts only when every strategy meets it. ASD's model "requires complete control compliance to be considered to have attained the targeted maturity level", so seven strategies at Maturity Level Two and one at One is Maturity Level One.
• Levels are defined by the adversary, not the technology. Level One targets commodity tradecraft, Level Two a modest step up in capability and targeting, Level Three adaptive adversaries less reliant on public tools.
• The November 2023 model is still the one assessed against. ASD consulted in June and July 2026 on evolving it into an "Essentials" series; as of 16 October 2026 we could not confirm a published replacement.
• Phishing-resistant MFA is a Level Two requirement. ISM-1682 and ISM-1872 apply at Levels Two and Three, so push and one-time codes no longer carry an organisation past Level One for user authentication to systems and online services.
• Every requirement is an ISM control. Mapping each requirement to its ISM ID turns the model into testable statements and connects Essential Eight work to IRAP assessments of the same systems.

What the Essential Eight is and where it stands

The Essential Eight comes from ASD's broader Strategies to Mitigate Cyber Security Incidents. In Microsoft's summary of the Australian Cyber Security Centre (ACSC) position, the ACSC "recommends all Australian organizations implement the Essential Eight mitigation strategies ... as a baseline". The eight strategies fall into three groups:

• Prevent malware delivery and execution: application control, patch applications, configure Microsoft Office macro settings, user application hardening.
• Limit the extent of incidents: restrict administrative privileges, patch operating systems, multi-factor authentication.
• Recover data and system availability: regular backups.

The maturity model was last revised in November 2023, and that version is the one organisations are assessed against today. In June 2026 ASD opened consultation on "a new Essentials series that expands the current framework", with a first chapter called "Essentials for enterprise IT", closing on 12 July 2026 (IDM, 19 June 2026). A 30 September 2026 iTWire summary reported that no draft or final replacement had been published and that ASD had not announced a retirement date. Treat any specific transition date you see in commentary with caution until ASD publishes one.

ASD's change summary for November 2023 is the complete list. Changes confirmed from the sources for this guide: phishing-resistant MFA is required from Level Two (ISM-1682, 1872); patches for internet-facing systems and online services are due within 48 hours when a vulnerability is critical or exploited, from Level One (ISM-1876, 1877); and, according to iTWire's summary, where ASD and a vendor both publish hardening guidance the stricter applies at Levels Two and Three.

The model is written for Microsoft Windows-based, internet-connected networks. It can be applied to other environments, but the requirements name Windows features (Credential Guard, Microsoft's blocklists, Office macros), so non-Windows estates need alternative controls justified to the assessor.

Maturity levels and the threats behind them

Each level is designed against an adversary profile. The quoted focus sentences below are ASD's wording as reproduced in the Queensland Government Essential Eight guideline (v2.0.0).

Targets are a risk decision per system or environment. The Queensland guideline notes that even Level Three will not stop well-resourced adversaries, which is why the wider Strategies to Mitigate Cyber Security Incidents and the ISM still apply above it.

• Small organisations: Level One is a realistic first target against commodity attacks. Some tenders and cyber insurers ask for Level Two, so plan the path to it.
• Australian Government entities: Microsoft's summary states that Maturity Level Two is mandatory for non-corporate Commonwealth entities subject to the PGPA Act under the Protective Security Policy Framework (PSPF). Check the current PSPF release for the exact requirement and reporting obligations.
• High-value targets: organisations holding sensitive data or providing critical services should target Level Three for crown-jewel systems even if the enterprise sits at Two.

Requirements by strategy and level

The table summarises what each level adds, with ISM control IDs from Microsoft Learn's Essential Eight mappings (ISM March 2025 release). Requirements are cumulative: Level Two includes Level One, unless a Level One control is replaced by a stricter one.

For the two remaining strategies, Microsoft's pages list the ISM controls but not the level each applies at, so check ASD's model for the split:

• Office macro settings: macros disabled for users without a demonstrated business requirement (ISM-1671); macros from the internet blocked (ISM-1488); antivirus scanning of macros (ISM-1672); Win32 API calls from macros blocked (ISM-1673); only sandboxed, Trusted Location or Trusted Publisher-signed macros run (ISM-1674); users cannot change macro security settings (ISM-1489); macros checked before signing (ISM-1890); trusted publisher list validated at least annually (ISM-1676).
• User application hardening: browsers do not process Java (ISM-1486) or web advertisements (ISM-1485); Internet Explorer 11 disabled or removed (ISM-1666); Office and PDF software blocked from creating child processes, executable content or injecting code (ISM-1667 to 1670); OLE package activation prevented (ISM-1542); ASD and vendor hardening guidance applied (ISM-1412, 1859, 1860); settings cannot be changed by users (ISM-1585); .NET Framework 3.5 (ISM-1655) and PowerShell 2.0 (ISM-1612) disabled or removed; command line process creation events logged (ISM-1899).

Essential Eight, the ISM and IRAP

The Essential Eight is a prioritised subset of the ISM. IRAP, the Information Security Registered Assessor Program, "provides a comprehensive process for the independent assessment of a system's security against Australian government policies and guidelines", carried out by endorsed assessors. The two are often confused in procurement questionnaires.

A cloud provider's IRAP report does not give its customers any Essential Eight maturity: the customer's own configuration is what gets assessed.

How assessments work

ASD publishes an Essential Eight Assessment Process Guide and per-level assessment templates. The Queensland guideline summarises the mechanics practitioners need:

• Outcomes: each control is rated Effective, Ineffective, Alternate control, Not assessed, Not applicable or No visibility.
• Evidence quality: Excellent (testing the control in practice, such as running an unapproved executable), Good (reviewing the live configuration), Fair (exports or screenshots) and Poor (policy documents or verbal statements).
• Alternate and compensating controls: must meet the intent of the original control and be accepted by an experienced assessor; controls that only reduce risk are mitigating controls and do not count.
• Risk acceptance: a control can be recorded as Not applicable only with evidence of the risk assessment; without it, assessors treat it as not implemented, which lowers the result.

Microsoft notes that an assessment is "a point in time activity". Configuration drifts after the report, so pair assessments with continuous checks, for example the Essential Eight templates in Microsoft Purview Compliance Manager or equivalent configuration monitoring.

Implementation roadmap

1. Scope and baseline. Define the systems in scope, inventory assets with automated discovery (ISM-1807) and self-assess every strategy against Level One. The lowest strategy is your current level.
2. Close Level One gaps on the cheapest controls first. Block internet macros, remove unsupported software, enforce MFA on internet-facing services, separate admin accounts and prove backups restore.
3. Run application control in audit mode. Deploy rules to a pilot ring in audit or report-only mode, review blocked events for two to four weeks, then enforce ring by ring. Keep the previous policy version ready to redeploy as the rollback.
4. Move MFA to phishing-resistant methods. Issue FIDO2 keys or platform authenticators to administrators first, then all users, and remove weaker fallbacks once coverage is high. Exclusions belong in a documented, monitored break-glass process.
5. Industrialise patching. Set the 48-hour, two-week and one-month windows as service levels in the patch tool with rings (pilot, broad, servers) and an emergency path for exploited vulnerabilities.
6. Add Level Two logging. Forward application control, MFA and privileged access events to a protected central log store and write detections before claiming Level Two.
7. Assess, remediate, reassess. Commission an assessment with Good or Excellent evidence, fix Ineffective controls, then repeat at least annually and after major changes.

Common implementation patterns

Patterns below use Microsoft tooling because the requirements are written in those terms; other tools are acceptable if they meet the control intent.

• Application control: Microsoft states that Level One can be met with AppLocker, while Levels Two and Three require App Control for Business (WDAC), which supports the recommended block rules and driver block rules. See the Application Allowlisting Guide.
• Macros and hardening: Office policies "Block macros from running in Office files from the internet" and "Disable all except digitally signed macros"; Attack Surface Reduction rules such as "Block all Office applications from creating child processes"; sign approved macros with the V3 VBA signature scheme after testing on an isolated device. See the Windows Endpoint Hardening Guide and the PowerShell Security Guide.
• Admin privileges: remove standing local admin, manage local administrator passwords with Windows LAPS, use privileged access workstations for administration and enable Credential Guard. See the Endpoint Privilege Management Guide.
• Patching: update rings with deadlines that match the windows, plus third-party application patching and a scanner whose database is current (ISM-1808). See the Patch Management Guide.
• MFA: conditional access policies requiring a phishing-resistant authentication strength for all users and all cloud apps. See the MFA Guide.
• Backups: separate backup administration accounts, immutable or locked retention for Level Three (ISM-1708) and documented restore tests to a common point in time. See the Ransomware Prevention Guide.

Where identity fits

Two of the eight strategies, restricting administrative privileges and MFA, are identity controls. Microsoft's Level Two guidance requires credentials for break glass accounts, local administrator accounts and service accounts to be long, unique, unpredictable and managed. Service accounts, shared admin accounts and automation credentials are where privileged access escapes the 45-day and 12-month rules, so inventory them, assign owners and include them in revalidation. See the Service Account Security Guide and the Break-Glass Account Guide.

Detection and measurement

From Level Two the model expects central logging of application control, MFA and privileged access events, logs protected from modification and deletion (ISM-1815), timely analysis (ISM-1228, 1906), an enacted incident response plan (ISM-1819) and incident reporting to the CISO and ASD (ISM-0123, 0140). Collect at minimum: application control allow and block events, MFA success and failure events, privileged access and group management events, Office ASR rule events and command line process creation. At Level Three, workstation and internal server logs must be analysed too (ISM-0109, 1907).

• Lowest strategy level: the single number that is your real maturity, reported per system in scope.
• Patch latency: percentage of critical or exploited vulnerabilities on internet-facing systems fixed within 48 hours.
• Phishing-resistant MFA coverage: share of users and administrators whose sign-ins require a phishing-resistant method, with excluded accounts listed.
• Application control enforcement: share of workstations and servers in enforced (not audit) mode, and blocked events per week by rule.
• Privileged account hygiene: count of privileged accounts inactive over 45 days or not revalidated in 12 months.
• Restore success: percentage of restore tests that meet recovery objectives in the last quarter.

Framework mapping

The NIST and CIS columns show where each strategy sits by topic; they are not formal equivalence mappings.

Common failure patterns

• Averaging the score. Reporting "mostly Level Two" when one strategy is at Level One. The model does not average, and the weakest strategy is usually the one attackers use.
• MFA on the front door only. A remote access portal or VPN account outside the MFA policy is a classic Level Zero gap: the Change Healthcare breach began with a Citrix login without MFA, and the Colonial Pipeline attack with an unused VPN account.
• Patching without session hygiene. Applying the 48-hour fix to an edge appliance but not revoking sessions already stolen, as the CitrixBleed 2023 cases showed.
• Application control stuck in audit mode. Policies deployed but never enforced, or enforced with broad path rules that allow user-writable folders.
• Backups the admin can delete. Backup consoles reachable with the same domain admin credentials an attacker obtains, so the Level Two and Three backup controls fail in practice.
• Policy-only evidence. Assessments relying on Poor evidence (documents and interviews) that overstate maturity until a real incident tests the controls.

Practitioner checklist

• Record the target maturity level per system with the risk rationale and owner.
• Map every requirement to its ISM ID and confirm against the current ASD publication and ISM release.
• Find your lowest strategy and fund that first.
• Move users and administrators to phishing-resistant MFA and document every exclusion.
• Enforce application control, including user profiles and temporary folders, with Microsoft's blocklists at Level Two.
• Set patch service levels at 48 hours, two weeks and one month, measured from vendor release.
• Apply 45-day inactivity and 12-month revalidation to privileged human and service accounts.
• Protect backups from privileged deletion and test restores to a common point in time.
• Centralise and protect logs before claiming Level Two.
• Reassess at least annually with Good or Excellent evidence, and monitor for drift between assessments.

Standards and references

• Queensland Government: Essential Eight guideline
• Microsoft Learn: Essential Eight overview
• Microsoft Learn: Essential Eight application control
• Microsoft Learn: Essential Eight patch operating systems
• Microsoft Learn: Essential Eight restrict administrative privileges
• Microsoft Learn: ISM controls and multifactor authentication maturity levels
• Microsoft Learn: Essential Eight regular backups
• Microsoft Learn: IRAP compliance offering

Related NHI Mgmt Group resources: Application Allowlisting Guide · Patch Management Guide · Endpoint Privilege Management Guide · MFA Guide · Public Sector Identity Security Guide. This guide summarises the Essential Eight and related Australian Government requirements as of 16 October 2026 and is not legal advice.