ACSC Essential Eight

What is the ACSC Essential Eight?

The ACSC Essential Eight is a set of eight baseline mitigation strategies, with a four-level maturity model, that the Australian Signals Directorate publishes through the Australian Cyber Security Centre. It applies to any organisation protecting internet-connected IT networks, and is mandatory only for some Australian government bodies.

The current version is the Essential Eight maturity model, November 2023 update. ASD first published it in June 2017 and updates it regularly, and it encourages use of the latest version. The publisher's pages we checked announce no revision under way, so check cyber.gov.au for anything newer.

The eight strategies come from ASD's wider Strategies to mitigate cyber security incidents. The maturity model adds levels so an organisation can say how well each strategy is in place, not just whether it is.

Why it matters

An Australian customer's contract asks for your Essential Eight maturity level. Your assurance is built on ISO 27001, which describes a management system, not a level against eight named strategies.

The framework matters because it has become a common yardstick. Assessment can be required by a government directive or policy, by a regulator, or as part of a contract. A stated maturity level gives both sides a shared answer.

Eight strategies at eight different levels is not a maturity level. It is a to-do list.

A baseline is a floor, not a security programme.

Who it applies to

The Essential Eight is designed for internet-connected IT networks. It was not built for mobile devices or operational technology (OT) networks.

The obligation depends on who you are:

• Most organisations: voluntary, with no requirement for independent certification.
• Non-corporate Commonwealth entities: Maturity Level Two is a mandatory baseline under the Australian Protective Security Policy Framework.
• Anyone bound by a government directive or policy, a regulator or a contract: independent assessment may be required.

The Essential Eight is not a management system, and it offers no certificate. Beside ISO 27001, it works as a fixed technical baseline: ISO 27001 asks you to run an ISMS and choose controls on risk, while the Essential Eight names eight strategies and grades how well each is in place. It also maps to the Australian Information Security Manual (ISM), and ASD says to treat the two sets of requirements separately.

The UK position

No UK statute or UK regulator requires the Essential Eight. A UK firm meets it commercially: through Australian contracts, an Australian subsidiary or an Australian customer's supply chain, where assessment may be required. The mandatory Level Two baseline for Commonwealth entities is an Australian obligation, not a UK one.

The nearest UK analogue is Cyber Essentials, the government-backed baseline of five technical controls that many buyers ask suppliers to hold. It is a comparison, not an equivalence: holding one does not evidence the other.

Key requirements

The model has two parts: eight mitigation strategies, and maturity levels that grade how well each is in place. The maturity model FAQ lists the strategies:

1. Patch applications.
2. Patch operating systems.
3. Multi-factor authentication.
4. Restrict administrative privileges.
5. Application control.
6. Restrict Microsoft Office macros.
7. User application hardening.
8. Regular backups.

The ACSC Essential 8 maturity model

The ACSC Essential 8 maturity model defines four levels, Maturity Level Zero through Three. Levels One to Three each defend against more skilled and more targeted attackers.

• Choose a target level. Pick the level that suits your environment, then implement each level in turn until you reach it.
• Keep the strategies level. ASD advises reaching the same level across all eight strategies before moving to a higher one.
• Treat it as a minimum. The Essential Eight is a minimum set of preventive measures, so add further measures where your environment calls for them.
• Keep exceptions few. ASD asks for a risk-based approach: limit exceptions and their scope, use compensating controls, document and approve each one, and review them regularly.

ASD also publishes a mapping between the model and the ISM, and the ISM provides OSCAL baselines to track it in compliance tools.

What Maturity Level Two means

Maturity Level Two is the third of the four levels. ASD suggests Level One may suit small and medium firms, Level Two large firms, and Level Three critical infrastructure and other high-threat organisations.

Level Two is also the mandatory baseline for non-corporate Commonwealth entities under the Protective Security Policy Framework. ASD adds that ISM controls mapped to Level Three still apply to their systems, though they may manage those on risk, so Level Two is a starting line for them, not the finish.

Frequently asked questions