Control frameworks and standards
ASD Essential Eight
Eight baseline mitigation strategies with maturity levels.
Official source Published by Australian Signals Directorate. Summaries in our own words.
What it is
The Essential Eight is a set of eight mitigation strategies from the Australian Signals Directorate, with a maturity model that describes how well each is implemented. It focuses on making it harder for attackers to get in, limiting what they can do and making sure systems can be recovered.
Who it applies to
- Australian government entities, where non-corporate Commonwealth entities are expected to reach Maturity Level Two under the Protective Security Policy Framework
- Australian businesses and suppliers to Australian government
- Organisations anywhere, particularly Windows based networks, that want a short, practical baseline
- Cyber insurers and auditors in Australia, who often ask about Essential Eight maturity
- Status
- Guidance from the Australian Signals Directorate's Australian Cyber Security Centre. It is voluntary for most organisations, mandatory for some Australian government entities, and the maturity model is updated from time to time.
- Enforcement
- Voluntary outside Australian government. For government entities, implementation is reported and audited through the Protective Security Policy Framework and the Australian National Audit Office; for others it becomes required through contracts.
Key points
- The eight strategies are meant to be implemented together, not picked selectively
- Maturity levels are based on attacker capability, not on the size of the organisation
- Patch timelines are tight at higher levels, especially for vulnerabilities that are exploited or critical
- Application control and restricting administrative privileges stop a large share of commodity attacks
- Backups must be tested and protected from modification by the accounts that could be compromised
- It is a baseline, not a full programme: it does not cover governance, suppliers or incident response in depth
Where to start
- 1Read the current Essential Eight Maturity Model and the assessment process guide
- 2Assess each of the eight strategies against Maturity Level One
- 3Close gaps until all eight reach the same level, then decide on a target level based on risk
- 4Map the work to CIS Controls or ISO 27001 if you report to European regulators or customers
How it is structured
| Patching and hardening | Patch applications, patch operating systems, user application hardening, restrict Microsoft Office macros |
|---|---|
| Access and execution | Application control, restrict administrative privileges, multi-factor authentication |
| Recovery | Regular backups |
| Maturity Levels Zero to Three | Each level targets a more capable attacker; all eight strategies should reach the same level before moving up |
A plain-language overview to help you learn, written by ThreatNoir. The official source prevails; this is not legal advice.
Items explained (1)
Ordered by how often our lessons cite them.