ASD Framework
The Essential Eight.
Australia's baseline cyber security mitigation strategies. 8 strategies, 3 maturity levels, 152 controls.
Reviewed 16 September 2026 · Current to the ASD Essential Eight Maturity Model, November 2023 · 152 controls across 8 mitigation strategies
On ASD launched the ASD Essentials and describes its enterprise IT chapter as an evolution of the Essential Eight. ASD says it will continue to maintain both frameworks on cyber.gov.au during the transition period.
What is the ASD Essentials?Transitioning from the Essential Eight
What is the ASD Essential Eight?
The ASD Essential Eight is a set of eight baseline cyber security mitigation strategies published by the Australian Signals Directorate (ASD) through the Australian Cyber Security Centre (ACSC). It is the practical starting point most Australian organisations use to reduce the risk of the cyber threats they are most likely to face.
Rather than a full risk-management standard, the ASD Essential Eight prescribes eight concrete technical controls, measured across three maturity levels. The eight strategies span preventing malicious code from running, keeping software patched, limiting administrative access, and being able to recover from an incident. Australian Government entities are mandated to implement them, and industry increasingly treats the Essential Eight as a minimum baseline.
The 8 strategies
Each targets a specific attack vector or reduces the impact of a security incident. Open any strategy for its full control list.
- Application ControlPrevent unapproved and malicious applications from executing. Only allow trusted, approved software to run.
- Patch ApplicationsApply security patches to applications within defined timeframes, focusing on internet-facing and untrusted content apps.
- Configure Office Macro SettingsBlock macros from the internet and only allow vetted, trusted macros to execute.
- User Application HardeningBlock ads, Java, Flash, and unnecessary features that attackers exploit in web browsers and productivity apps.
- Restrict Administrative PrivilegesLimit admin access to those who need it. Use separate accounts for administrative tasks.
- Patch Operating SystemsApply OS patches within defined timeframes. Replace end-of-life systems with supported versions.
- Multi-Factor AuthenticationRequire MFA for VPNs, remote access, privileged actions, and all internet-facing services.
- Regular BackupsPerform and test backups of important data. Store backups offline or where compromised accounts cannot reach them.
Three maturity levels
Each of the eight strategies is assessed against three maturity levels. Your organisation's overall maturity is the lowest level achieved across all eight strategies, so a single weak strategy caps the whole rating.
Maturity Level 1
Protects against commodity, opportunistic attacks that use widely available tradecraft.
In practice: Patch internet-facing services within two weeks, enforce MFA for internet-facing services, and take daily backups.
Maturity Level 2
Protects against adversaries willing to invest more time and use better tools to bypass basic controls.
In practice: Faster patching, phishing-resistant MFA for privileged users, centralised event logging and macro execution restrictions.
Maturity Level 3
Protects against adaptive, well-resourced adversaries including nation-state actors.
In practice: Application control on all workstations and servers, just-in-time administration, and tested offline backups.
Essential 8 Maturity Model
Three maturity levels from ML1 (basic, commodity threats) to ML3 (sophisticated adversaries including nation-state actors). Your overall maturity equals the lowest level across all 8 strategies.
View maturity modelISO 27001 to Essential Eight mapping
Already certified to ISO/IEC 27001? See exactly which ISO 27001 Annex A controls map to each Essential Eight strategy in our free crosswalk tool.
Open the mapping toolWho must comply?
- Australian Government agenciesMandatory under the PSPF since July 2022. Agencies must report maturity levels to the ACSC.
- Defence industryThe DISP references Essential 8 maturity as part of security requirements for contractors and suppliers.
- Critical infrastructure operatorsEncouraged under the SOCI Act 2018 to adopt ASD mitigation strategies.
- Private sectorVoluntary, but increasingly expected in government tenders, supply chain agreements, and cyber insurance.
- State and territory agenciesMany have adopted the Essential 8 as their baseline cyber security framework.
E8 vs ISO 27001 vs ASD ISM
| Attribute | Essential 8 | ISO 27001 | ASD ISM |
|---|---|---|---|
| Controls | 152 | 93 | 1,143 |
| Focus | 8 priority mitigations | Full ISMS | Comprehensive technical guidelines |
| Mandatory for | AU Government | Voluntary (contractual) | AU Government |
| Best for | Baseline hygiene | Certification | Detailed technical |
| Maturity model | Yes (ML1-ML3) | No (pass/fail) | No |
Control Stack maps controls across these frameworks plus ISO 42001 for AI governance.
What the Essential Eight is
The Essential Eight is a set of eight mitigation strategies published by the Australian Signals Directorate (ASD), the Commonwealth agency responsible for Australia's cyber security advice. They are drawn from ASD's longer list, Strategies to Mitigate Cyber Security Incidents, and represent the baseline ASD considers most effective for most organisations. ASD first published the Essential Eight in 2017.
The strategies themselves are only eight lines. The detail lives in a companion publication, the Essential Eight Maturity Model, which sets out precisely what each strategy requires at each maturity level. Control Stack breaks that model into 152 separate, testable controls: 48 at Maturity Level One, 59 at Maturity Level Two and 45 at Maturity Level Three. Each one is a single requirement you can check your own environment against.
ASD wrote the Essential Eight for internet-connected information technology networks running Microsoft Windows. It was not designed for operational technology, and it does not deal with mobile fleets, macOS or Linux estates in the same depth. Those systems still need protecting; the Essential Eight is simply not where that guidance lives.
The eight mitigation strategies
Each strategy is a category of work, not a single setting. Here is what each one actually asks an organisation to do, paraphrased from the maturity model. The verbatim requirement text sits on each control page.
- Application control: only software the organisation has approved is allowed to run. It covers executables, software libraries, scripts, installers, compiled HTML, HTML applications and control panel applets, starting with workstations and the user profile and temporary folders that operating systems, browsers and email clients write to.
- Patch applications: scan for missing patches, then apply them inside set timeframes. Internet-facing online services get 48 hours when a vulnerability is critical or an exploit exists and two weeks otherwise, office productivity suites and browsers are scanned at least weekly, and software the vendor no longer supports is removed.
- Patch operating systems: the same discipline for the operating systems on servers, workstations and network devices, with more frequent scanning and tighter deadlines for internet-facing systems. Unsupported operating systems are replaced rather than patched, because no patches exist.
- Multi-factor authentication: MFA for staff signing in to your own online services that handle the organisation's sensitive data, for staff using third-party services that hold that data, and for customers using services that handle sensitive customer data. The factors must be a genuine combination, so two passwords do not qualify, and from Maturity Level Two the MFA itself has to be phishing-resistant and extended to all privileged and unprivileged users of systems.
- Restrict administrative privileges: privileged users get a dedicated account used only for privileged work, privileged accounts are blocked from the internet, email and web services, privileged access is limited to what the role genuinely needs, and requests for it are validated before they are granted.
- Configure Microsoft Office macro settings: macros are disabled for anyone without a demonstrated business requirement, macros in files that came from the internet are blocked, macro antivirus scanning is enabled, and users cannot change the macro security settings themselves.
- User application hardening: strip out the features attackers keep using. At Maturity Level One that means browsers (Internet Explorer 11 disabled or removed, no Java or web advertisements from the internet, users cannot change browser security settings). Higher levels extend the same treatment to office productivity suites and PDF software, and to legacy runtimes such as .NET Framework 3.5 and Windows PowerShell 2.0.
- Regular backups: back up data, applications and settings in line with business criticality and continuity requirements, retain them securely, synchronise them so everything restores to a common point in time, keep unprivileged accounts from modifying or deleting them, and test restoration during disaster recovery exercises.
How the maturity levels work
Maturity is assessed one strategy at a time, against four levels. Each level describes the kind of attacker it is meant to stop, which is why the requirements get stricter rather than merely more numerous.
- Maturity Level Zero: there are weaknesses in the organisation's posture that an attacker could exploit. Many organisations sit here on one or more strategies before they start a structured program.
- Maturity Level One: defends against attackers using commodity tradecraft that is widely available, such as public exploits against unpatched internet-facing services and stolen or guessed credentials.
- Maturity Level Two: defends against attackers willing to spend more time and effort, including targeted phishing for credentials and techniques for getting around weaker multi-factor authentication.
- Maturity Level Three: defends against adaptive attackers who rely less on public tools, exploit gaps such as unsupported software or thin logging, and work to stay hidden once inside.
Who has to do it in Australia
"Mandatory" means different things depending on who you are. It is worth knowing which category you fall into before promising anyone a maturity level.
- Non-corporate Commonwealth entities: required. The Protective Security Policy Framework (PSPF) directs them to implement the Essential Eight, with Maturity Level Two as the baseline.
- Corporate Commonwealth entities: encouraged rather than directed. The PSPF is applied to them as good practice unless something else brings them in.
- State, territory and local government: each jurisdiction sets its own policy. Several point to the Essential Eight through their own cyber security frameworks, so the obligation comes from your jurisdiction's policy, not from the PSPF.
- Defence Industry Security Program (DISP) members: Defence sets cyber security requirements as part of membership and points members at ASD guidance including the Essential Eight. Check the membership level you hold or are applying for, because what you must evidence varies by level.
- Critical infrastructure responsible entities: where the critical infrastructure risk management program rules under the Security of Critical Infrastructure Act apply to your asset class, the rules let you address cyber and information security hazards by complying with one of several named frameworks, and the Essential Eight at Maturity Level One is one of the options. Check the current rules for the list and for whether your asset class is covered.
- Private sector generally: no Australian law requires the Essential Eight by name of businesses at large. The narrow exception is the critical infrastructure case above, where an entity that nominates the Essential Eight in its risk management program is then held to it. For everyone else it reaches the business through government and enterprise contracts, tender questionnaires, insurance applications and customer security reviews.
How the Essential Eight fits with the ISM
Both come from ASD, and they do different jobs. The Information Security Manual is the comprehensive catalogue: 1,143 active controls in Control Stack, covering governance, personnel, physical security, cryptography, networks, gateways, software development, data transfers and much more, applied through the organisation's own risk management process. The Essential Eight is a prioritised baseline concentrated on eight technical areas, which Control Stack renders as 152 testable requirements.
The Essential Eight Maturity Model is published separately from the ISM, so an Essential Eight assessment is not an ISM assessment, and neither result substitutes for the other. In practice the two stack: Non-corporate Commonwealth entities are expected to meet ISM controls appropriate to each system and implement the Essential Eight as a baseline on top of that.
For everyone else the sequence is usually the same. Get the Essential Eight right first, because it addresses how most incidents actually start, then use the ISM for the areas the Essential Eight barely covers, such as supplier assurance, cryptography, network segmentation and physical security. The Essential Eight does reach into logging, event analysis and incident reporting at Maturity Level Two and above, but only for the eight strategies themselves, so the ISM remains the reference for incident response as a whole. For classified or high-assurance systems the ISM is the operative reference and the Essential Eight alone is not enough.
Frequently asked questions
What is the Essential Eight?
The Essential Eight is a set of eight cyber security mitigation strategies published by the Australian Signals Directorate: application control, patch applications, configure Microsoft Office macro settings, user application hardening, restrict administrative privileges, patch operating systems, multi-factor authentication and regular backups. They are drawn from ASD's broader Strategies to Mitigate Cyber Security Incidents and are aimed at internet-connected Windows IT networks. The detailed requirements sit in a separate publication, the Essential Eight Maturity Model.
Is the Essential Eight mandatory?
It depends who you are. Non-corporate Commonwealth entities are directed to implement it under the Protective Security Policy Framework, with Maturity Level Two as the baseline. State, territory and local government obligations come from each jurisdiction's own policy instead. Defence Industry Security Program members align to it as part of membership. For private sector organisations no Australian law requires the Essential Eight; it usually arrives through contracts, tenders, insurance questions and customer security reviews.
Is the Essential Eight still current?
Yes, for now. On 15 October 2026 ASD launched the ASD Essentials and describes its enterprise IT chapter as an evolution of the Essential Eight. ASD says it will continue to maintain both frameworks during the transition period and has not set an end date, and the Protective Security Policy Framework still requires non-corporate Commonwealth entities to reach Maturity Level Two. Keep meeting any obligation that names the Essential Eight while you plan the move; Control Stack's transition guide sets out ASD's crosswalk.
What are the Essential Eight maturity levels?
There are four: Maturity Level Zero through Maturity Level Three. Zero means exploitable weaknesses remain. Level One counters commodity attacks using widely available tools and stolen or guessed credentials. Level Two counters attackers who invest more effort, including targeted phishing and getting around weaker multi-factor authentication. Level Three counters adaptive attackers who avoid public tools and work to evade detection. Maturity is assessed per strategy, and your overall level is the lowest of the eight.
Which maturity level should we target?
ASD's approach is to pick the level matching the attackers you realistically need to stop, then reach it across all eight strategies before going higher. Maturity Level One is a sensible target for most small and medium Australian organisations. Maturity Level Two is the Commonwealth baseline under the PSPF and is commonly expected of larger enterprises, regulated industries and service providers. Maturity Level Three is aimed at organisations facing adaptive, targeted adversaries. Note that sector alone does not set the target: the critical infrastructure risk management program rules, for example, name Maturity Level One.
How long does Essential Eight implementation take?
There is no official timeframe, and the honest answer depends on your starting point. Organisations already running well-managed Microsoft 365, modern endpoint management and reliable patching can close most Maturity Level One gaps quickly. The slow items are usually application control, separating privileged accounts from everyday accounts and email, and proving backups restore through tested disaster recovery exercises. Treat it as an ongoing program, because maturity drifts as systems change.
How does the Essential Eight relate to ISO 27001?
They are different kinds of thing. ISO/IEC 27001:2022 is a certifiable management system standard covering how an organisation governs information security risk, with 93 Annex A controls. The Essential Eight is a prescriptive technical baseline from ASD, with no certification scheme behind it. They overlap on patching, malware defences, authentication, privileged access and backups, so Essential Eight work can supply evidence for those Annex A controls, but neither replaces the other.
Start checking your compliance.
Use Control Stack to review your Essential 8 posture at every maturity level, with plain-English guidance and cross-framework mappings.
The Essential 8 aligns with ISO 27001 controls. Mindset Cyber offers PECB-accredited ISO 27001 training.