To implement the Australian Essential Eight yourself, pick a target maturity level, baseline all eight strategies against the maturity model, close gaps in a sensible order, manage exceptions formally, and raise every strategy to the same level before aiming higher. Certification by a third party is not required by ASD.
What are the eight strategies?
ASD's maturity model covers patching applications, patching operating systems, multi-factor authentication, restricting administrative privileges, application control, restricting Microsoft Office macros, user application hardening, and regular backups. The model was designed to protect internet connected information technology networks. ASD says its ideas may help for mobile and operational technology environments, but it was not designed for them.
There are four maturity levels, zero to three. Levels one to three match increasing attacker skill and targeting. ASD advises choosing a target level that fits your environment, then implementing each level in turn.
The plan
Step 1: choose the target. Think about how attractive you are as a target and what a breach would cost you. A modest target you can evidence beats an ambitious one you cannot. Owner: security lead with the executive sponsor.
Step 2: get the current model. Download the maturity model from ASD. The copy I read was an archived one because the live site blocked automated access, so confirm the wording before you build on it.
Step 3: inventory. You cannot patch what you do not know about. Build an asset list of workstations, servers, network devices, online services and the SaaS tools holding sensitive data.
Step 4: baseline. For every statement at your target level, mark yes, partly or no, and note the evidence. Owner: IT operations.
Step 5: fix in a practical order. MFA and administrative privileges are a common place to start because the changes are well bounded. Patch cadence and backups come next. Application control takes longest because it needs an approved software list, so start the discovery early and run it in audit mode before enforcing.
Step 6: document exceptions. ASD wants exceptions minimised in number and scope, backed by compensating controls, approved through a proper process and reviewed regularly. Use a register.
Step 7: raise all eight together. ASD says to reach the same level across all eight strategies before moving to a higher one, because they complement each other.
Step 8: test. Do a restore from backup. Try to log on to an admin account from a normal workstation. Try opening a macro document from the internet. Keep the results.
Step 9: assess. Run a self assessment, then use an independent assessor if a customer, regulator or government policy requires it.
What evidence should you keep?
Asset inventory exports, scanner schedules and reports, patch timing reports, MFA enforcement screenshots or policy exports, admin account lists with approvals, application control policy exports and event logs, macro policy exports, browser hardening settings, backup job logs and restore test records, the exceptions register.
Who does what in a small team?
In a team of a handful of people, one person often wears several hats, so write the ownership down. A reasonable split is that IT operations owns patching, backups and hardening settings, the security lead owns the baseline, exceptions register and evidence folder, the identity administrator owns MFA and privileged accounts, and a manager from the business side approves exceptions. Approval by someone other than the requester matters, because ASD expects exceptions to go through a proper approval process.
Give each strategy a one line standing report, such as percent of assets patched inside the window, admin accounts reviewed this month, and date of the last restore test. Five minutes of review in a weekly meeting keeps the numbers honest and gives you a trail of minutes to show an assessor.
What to do
- Set the target level and name an owner for each strategy.
- Build the asset inventory.
- Baseline each statement, with evidence.
- Fix MFA and admin privileges first.
- Establish patch scanning and timing reports.
- Start application control in audit mode, then enforce.
- Test backups by restoring them.
- Keep the exceptions register current.
- Self assess, then decide whether to commission an assessor.
Quick check
Which maturity level should I aim for?
ASD says to pick a level that suits your environment, based on how likely you are to be targeted and how much a breach would hurt. Then implement each level in turn.
Does the Essential Eight guarantee I will not be breached?
No. ASD says even level three will not stop a determined, well resourced attacker, and that more controls from its wider guidance may be needed.
How Safeguard helps automate this
Two of the eight strategies, patching and backups, depend on steady evidence rather than a one off project. Safeguard's compliance suite covers frameworks, controls, evidence, continuous monitoring, automated tests and questionnaires, so evidence is collected from connected systems and code instead of by screenshot, and monitoring keeps running after the baseline. Technical evidence comes from your real code and dependencies, using scans, SBOMs and reachability, so patch work focuses on what is actually exposed. Safeguard's agent can open tested fix pull requests for vulnerable dependencies. It is off by default, every category starts on Manual, and you choose which categories run automatically. Safeguard helps prepare and keep evidence ready, while any assessment is done by an independent party. Book a call to discuss it.
Sources
Last reviewed: 18 October 2026.
