The Essential Eight is the Australian Signals Directorate's baseline of eight mitigation strategies, measured on a maturity scale from 0 to 3. For engineers, the checklist is application control, patching applications, restricting Microsoft Office macros, user application hardening, restricting administrative privileges, patching operating systems, multi factor authentication and regular backups.
A note on sources
The Australian Cyber Security Centre's maturity model page timed out or refused automated access every time we tried on 18 October 2026. The strategy names below are well established, but the exact requirements per maturity level change between releases of the model. Treat the specifics as prompts and verify each against the current ACSC publication before you rely on it.
What are the eight, in engineer terms?
1. Application control. Only approved executables, scripts, installers and libraries run on workstations and servers. Start with a list of what runs today, build an allow list by publisher or path rules, run in audit mode first and then enforce. Keep the rule set in version control and log blocks.
2. Patch applications. Internet facing services and common user applications are updated within defined timeframes, faster when a vulnerability is being exploited. You need an inventory of installed applications and versions, a scanner that finds missing patches and a record of when each fix landed. Retire unsupported software.
3. Configure Microsoft Office macro settings. Block macros from the internet, allow only vetted ones where a business need exists, and control who can enable them. Enforce through group policy or device management, and export the settings as evidence.
4. User application hardening. Browsers and document readers have risky features turned off, such as Flash style plugins, Java in browsers and unneeded content features. Block ads and unneeded web content where the model asks for it. Apply as managed baselines.
5. Restrict administrative privileges. Admin rights are granted on need, validated on a schedule, and used from separate accounts that cannot browse the web or read email. Privileged accounts are inventoried, reviewed and logged. For engineers, this includes cloud console roles and production database access.
6. Patch operating systems. The same discipline as applications, applied to servers, workstations and network devices. Maintain a list of supported versions and a retirement plan.
7. Multi factor authentication. Required for remote access, privileged users and users of important data repositories, with the model setting expectations on the strength of the method at higher levels. Prefer phishing resistant methods where possible and inventory the exceptions.
8. Regular backups. Important data, software and configuration are backed up on a schedule, stored so that a compromised account cannot delete them, and restores are tested. Record each test.
How do maturity levels fit in?
The model defines levels 0 to 3, with each level aligned to a rough class of adversary tradecraft and a stronger set of requirements. Pick a target per your risk and obligations, not the highest number. An assessment is made per strategy, so your overall level is only as high as your weakest strategy. Sort that out early: it is the number that gets repeated.
What evidence do engineers keep?
- Application control policy exports and block logs.
- Patch scanner reports with dates, plus exception records.
- Group policy or device management exports.
- Admin account lists, review sign offs and break glass logs.
- MFA enforcement settings and exception lists.
- Backup job reports and restore test records.
Dated exports beat screenshots, because anyone can re-check them.
What mistakes should you avoid?
- Counting a strategy as done at 90 percent coverage when the model measures it differently.
- Exceptions with no owner or expiry.
- Servers and network devices left out of patch scope.
- Admin accounts that double as daily accounts.
- Backups the same admin can delete.
- Chasing level 3 on one strategy while another stays at 0.
What to do
- Pull the current ACSC maturity model and choose a target level with leadership.
- Inventory endpoints, servers, applications, admin accounts and backup stores.
- Score each of the eight against the model, honestly, and find the weakest.
- Fix the weakest first, then work upward.
- Put configuration in code or managed policy so it can be exported.
- Create an exceptions register with owners and expiry dates.
- Re-score every quarter and after major changes.
Quick check
Is the Essential Eight a certification?
No. It is a set of mitigation strategies and a maturity model. Assessments are used by organisations, customers and sometimes regulators, and the process depends on who requires it. Check the current ACSC guidance.
Which maturity level should we target?
The one your risk and obligations justify. Many organisations aim for a level that matches the threats they expect and raise it later, and all eight strategies must reach that level for the overall result to count.
Sources
- Australian Cyber Security Centre, Essential Eight maturity model: could not be fetched on 18 October 2026. Specifics need checking against the current version.
How Safeguard helps automate this
Several of the eight come down to evidence from systems you already run. Safeguard's compliance suite covers frameworks, controls, evidence, continuous monitoring, automated tests and questionnaires, so evidence is collected from connected systems and code instead of screenshots, and monitoring continues between assessments. For the software side, technical evidence comes from your real code and dependencies: scans, SBOMs and reachability, which show what is out of date and what is actually exploitable. The remediation agent can open tested fix pull requests for vulnerable dependencies. It is off by default, every category starts on Manual, and you choose which categories run automatically and at what approval level. Safeguard helps you prepare and keep evidence ready; it does not assess you. Book a call.
Last reviewed: 18 October 2026.
