What it covers. The Essential Eight is a set of baseline mitigation strategies published by the Australian Signals Directorate's Australian Cyber Security Centre. The eight strategies are application control, patching applications, configuring Microsoft Office macro settings, user application hardening, restricting administrative privileges, patching operating systems, multi-factor authentication and regular backups. A maturity model defines levels from zero to three based on the attacker capability each level is meant to counter.
In practice. Organisations assess their maturity for each strategy, aim for a consistent target level across all eight and implement them together rather than selectively. For patching applications, that means timely updates for internet facing services and common applications, removal of unsupported software and vulnerability scanning to find what is missing. Evidence includes maturity assessments, patching metrics and configuration evidence.
Common gaps. Organisations often reach a high level on some strategies but not others, which leaves gaps. Unsupported applications are commonly left in place.