The Essential Eight are the Australian Signals Directorate's eight prioritised technical mitigation strategies for protecting internet-connected networks. For most Australian organisations, Maturity Level 2 (ML2) is the practical baseline to target, with ML3 reserved for government agencies and high-risk entities. The ACSC's official guidance and maturity model documentation remain the authoritative source for scoping and assessing your organisation against it.
TL;DR:
- Achieving maturity level 2 requires implementing consistent patching of applications and operating systems within specified timeframes, with vulnerability scans showing compliance.
- Multi-factor authentication must be enforced across all internet-facing services, and legacy protocols allowing bypass should be blocked to reach ML2 standards.
- Backup processes need to include regular testing, encryption, and immutability, with evidence of restore tests from the last four quarters to meet ML2.
- Maintaining uniform maturity across all controls is essential, as organizations fail assessment if one control, like backups, lags behind while others meet the level.
- A phased, risk-based rollout focusing on quick wins such as MFA, patching, and macro restrictions improves compliance without overwhelming resources.
Table of Contents
- Essential Eight overview: the eight controls in plain language
- Understanding the Essential Eight maturity model: ML0 to ML3
- Control-by-control: what ML2 actually looks like in practice
- Getting assessed: the Essential Eight assessment process
- Rolling it out: prioritisation and resourcing
- Implementing and evidencing the Essential Eight: a practitioner's view
- How Myitbutler helps you reach and prove Essential Eight maturity
- Sources
- FAQ
Essential Eight overview: the eight controls in plain language
Forget the acronym soup for a second. The Essential Eight is really just eight habits that, done consistently, close off the paths attackers use most often to break into a business. The ASD built the list from real incident data, not theory, which is why it stays narrow instead of trying to cover every possible cyber risk.
Here's what each control actually stops in practice:
- Patch applications — closes known software holes in things like browsers, PDF readers, and office software before criminals exploit them.
- Patch operating systems — the same idea, but for Windows, macOS, and server operating systems.
- Multi-factor authentication (MFA) — stops stolen passwords from being enough on their own to get into your systems.
- Restrict administrative privileges — limits how much damage a compromised account can do by keeping "admin" access tightly held.
- Application control — blocks unapproved or unknown programs (including malware) from running at all.
- Restrict Microsoft Office macros — shuts down one of the oldest tricks in the book: a malicious macro hidden in a Word or Excel file.
- User application hardening — disables risky features in browsers and apps (like Flash or ads) that attackers love to abuse.
- Regular backups — makes sure that if everything else fails, you can still recover your data without paying a ransom.
Each strategy targets a specific stage of a typical cyberattack, from initial access through to data destruction. The framework was designed for internet-connected IT networks specifically, so it sits underneath broader standards like ISO 27001 or the Information Security Manual rather than replacing them. Think of the Essential Eight as the technical floor, not the whole building.
Understanding the Essential Eight maturity model: ML0 to ML3
Knowing the eight controls is only half the story. What actually gets assessed is how well you've implemented them, and that's where the maturity model comes in.
The four levels work like this:
- ML0 — significant gaps exist; controls are patchy or absent, leaving the organisation exposed to unsophisticated attacks.
- ML1 — controls address attackers who use commodity malware and phishing kits without much customisation.
- ML2 — controls address more capable adversaries who invest time evading basic defences and targeting specific organisations.
- ML3 — controls address adaptive, well-resourced adversaries who adjust tradecraft in real time to bypass individual security measures.
Many federal agencies are required to meet ML2 or higher, and that expectation has flowed down into state government, defence supply chains, and increasingly into private-sector contracts and cyber insurance conditions. ML2 has become the de facto benchmark for organisations that handle sensitive data, hold government contracts, or simply want a defensible level of protection without over-engineering it.
Here's the catch most businesses miss: maturity isn't picked control by control. The ACSC expects you to reach the same maturity level across all eight strategies before you're considered to have achieved that level overall. Sailing through patching at ML3 while backups sit at ML1 means your assessed maturity is ML1, not somewhere in between. That consistency requirement trips up more organisations than any individual technical control does, largely because backups and application control tend to lag behind the "easier" wins like MFA.
It's also worth remembering that even ML3 doesn't guarantee immunity from a determined, well-funded attacker. It raises the cost and effort required to breach you significantly, which is usually enough to make an opportunistic attacker move on to an easier target.
Control-by-control: what ML2 actually looks like in practice
This is where theory meets your actual IT environment. Below is what ML2 realistically demands for each control, common ways businesses get it wrong, and how it plays out for organisations running standard Australian business tools like Microsoft 365.
-
Patch applications and operating systems. ML2 requires patching internet-facing applications within 48 hours of a patch being released for critical vulnerabilities (generally anything rated critical by vendors or scoring high on the Common Vulnerability Scoring System), and within two weeks for other urgent patches. Operating systems follow a similar cadence, though slightly more relaxed for non-internet-facing servers. The common failure here isn't lack of patching tools. It's lack of a vulnerability scanning schedule that tells you a patch is even needed. A business running Windows Server 2016 that's fallen out of vendor support is an automatic ML2 fail regardless of how promptly other patches get applied.
-
Multi-factor authentication. MFA must be enforced across all internet-facing services, including email, VPNs, and remote access tools, and legacy authentication protocols that let attackers bypass MFA altogether need to be blocked outright. Acceptable methods at ML2 include authenticator apps, hardware security keys, and push notifications; SMS-based codes are weaker and increasingly discouraged. The most common gap is a business that's rolled out MFA for staff logins but left a legacy SMTP relay or an old VPN gateway still accepting single-factor logins. If you're unsure where your email setup stands, our guide to business email security walks through the legacy authentication risks in more detail.
-
Restrict administrative privileges. Admin accounts should be separate from everyday user accounts, reviewed regularly, and never used for browsing the web or checking email. ML2 expects a formal review process, typically every 12 months, confirming who still needs elevated access. The classic pitfall: an IT manager who left 18 months ago still has a live admin account nobody's disabled.
-
Application control. At ML2, the expected approach is allowlisting rather than blacklisting, meaning only explicitly approved software can run, and everything else is denied by default. Tools like Microsoft's AppLocker or Windows Defender Application Control (WDAC), often managed through Intune, are common implementations in Microsoft 365 environments. Exceptions to the allowlist need to be logged in a formal exception register with a business justification and a review date, and enforcement should be checked on a defined cadence, not set once and forgotten.
-
Restrict Microsoft Office macros. Macros should only run from trusted, centrally managed locations, and macro execution in files from the internet should be blocked entirely. This is a genuinely quick win for most small businesses because it's a configuration change, not a new tool purchase.
-
User application hardening. Browsers need configuration to block or limit risky content types, and unnecessary features like Flash (largely dead now, but its ghost lingers in old configs) should stay disabled. This one gets skipped simply because it feels low priority compared to patching, even though browser exploitation remains a common entry point.
-
Regular backups. ML2 backup requirements go well beyond "we have a backup." Backups need to be isolated from production systems (so ransomware that encrypts your live environment can't also reach the backup), encrypted, and stored immutably where possible so nothing, including an attacker with admin credentials, can alter or delete them. Restoration testing needs to happen at least quarterly, with evidence kept of what was tested and whether it succeeded. The failure that catches out the most businesses: backups that technically run every night but have never actually been test restored, so nobody discovers the backup's been silently failing until the day they need it.
Pro Tip: Run a full restore test on a non production server every quarter and keep a screenshot or log of the result. Assessors almost always ask for restore evidence, not just backup job logs, and "it's scheduled to run" is not the same as "it works."
If you're managing a distributed team across multiple locations, our endpoint security playbook covers how patching and application control scale when your staff aren't all on the same office network.
Getting assessed: the Essential Eight assessment process
Assessment isn't a single test you pass or fail. It's a structured comparison of what you claim against what you can actually prove, using the ACSC's Essential Eight assessment process guide and associated training material.
For ML2, assessors typically want to see:
- Vulnerability scan outputs showing patch status across your application and OS estate.
- Configuration baselines confirming MFA enforcement and legacy protocol blocking.
- An exception register documenting any application control exceptions and their justifications.
- Backup restore test logs covering at least the last four quarters.
Whether you need an independent assessor depends on context. Government contracts and regulated sectors often mandate third-party assessment. Smaller private businesses can often self-assess against ML2 using the same evidence categories, provided the evidence is genuinely current and consistent across every control.
The most common self-assessment mistake is confusing policy with evidence. Having a written patching policy proves nothing if there's no scan output showing patches were actually applied within the required window. The second most common mistake is inconsistent rollout, where one department or site is fully compliant and another was never brought up to the same standard, which drags the whole organisation's assessed maturity down.
Rolling it out: prioritisation and resourcing
Trying to implement all eight controls simultaneously is how projects stall. A phased, risk-based rollout works better in practice.
- Pick your target maturity based on actual risk, not ambition. A ten-person retail business doesn't need the same ML2 rigour as a government-adjacent contractor, though ML2 is still the sensible default for anyone holding customer data.
- Start with the quick wins: MFA enforcement, patch management, and Office macro restrictions typically require configuration changes rather than new infrastructure, and deliver the fastest risk reduction.
- Tackle backups and application control next, since they usually need process changes and testing cycles that take longer to mature.
- Choose your resourcing model: fully internal if you have dedicated IT staff, a managed service if you don't, or a blended approach where routine work is outsourced and strategic decisions stay in house.
- Set a review cadence, typically quarterly, to check patch compliance, refresh the exception register, and confirm backup tests actually happened.
Tools that help track this without enterprise budgets are covered in our piece on affordable cybersecurity tools for new businesses.
Implementing and evidencing the Essential Eight: a practitioner's view
Reading the ACSC's guidance is one thing. Turning it into scan outputs, exception registers, and restore logs that survive an actual assessment is another. Most of the businesses we work with know they need MFA and backups sorted; what trips them up is the evidence trail behind it.
Remote IT support can be mapped directly onto the eight workstreams: patch management scheduling, MFA rollout across email and remote access, immutable backup orchestration, and application control exception tracking. An approach drawing on certified practice can be applied remotely across time zones for distributed teams and Australian businesses alike.
An initial audit engagement typically maps your current state against ML2, flags the gaps that would fail an assessment, and hands you a prioritised remediation plan with an evidence checklist attached.
How Myitbutler helps you reach and prove Essential Eight maturity
There are alternatives to hiring a full-time security analyst for Essential Eight compliance in Australia that provide enterprise-standard remediation and evidence collection at fixed, transparent pricing, without long-term contract commitments.
If patching schedules, MFA rollouts, or backup testing have been sitting on someone's "to do eventually" list, that's exactly the gap an assessment will find. Remote IT support services can cover the practical side of Essential Eight work: patch management, MFA configuration across your internet-facing services, backup isolation and restore testing, and building the exception register an assessor will actually ask for.
You get a proper managed IT services arrangement built around continuous evidence collection, not a one-off report that goes stale in three months. Coordination happens over WhatsApp, email, or a quick video call, whatever suits your team's time zone.
If you want a straight answer on where your organisation sits against ML2 right now, book a free chat with Myitbutler and get a plain-English gap assessment before your next compliance deadline.
FAQ
Is the Essential Eight mandatory in Australia?
It's mandatory for non corporate Commonwealth entities, which must meet ML2 or higher under government policy. For private businesses it isn't legally required, though it's increasingly expected in government contracts, cyber insurance conditions, and supply chain agreements.
What does Essential Eight mean?
It refers to the eight prioritised mitigation strategies developed by the ASD and ACSC to protect internet-connected networks from common cyber threats, covering patching, MFA, access restriction, and backups.
What is the Essential Eight Assessment and what does it provide?
It's a structured process for checking implementation evidence, like scan outputs, configuration baselines, and backup logs, against a chosen maturity level. It gives organisations a defensible, documented maturity rating rather than a self-declared one.
Is the Essential Eight being retired?
No. The ACSC continues to update and maintain the framework, with the most recent detailed guidance published in the Essential Eight explained PDF from November 2023. It remains the primary technical baseline referenced across Australian government and industry guidance.