The Essential Eight is a set of mitigation strategies published by the Australian Signals Directorate (ASD) to help organisations protect themselves against cyber threats. It is widely used as a practical baseline, not just by government.
The eight strategies
- Application control: only approved software can run.
- Patch applications: keep apps like browsers and Office up to date.
- Configure Microsoft Office macro settings: block risky macros.
- User application hardening: turn off features attackers abuse.
- Restrict administrative privileges: fewer people with admin access.
- Patch operating systems: keep Windows and servers current.
- Multi-factor authentication: a second check when signing in.
- Regular backups: backups you have actually tested restoring.
Maturity levels
Each strategy can be implemented at increasing maturity levels. Most small businesses should aim to reach the first level across all eight, then improve from there based on risk.
Where to start
- Turn on multi-factor authentication for every account.
- Make sure backups run daily and test a restore.
- Remove admin rights from everyday user accounts.
- Automate Windows and app updates.
These four steps remove a large share of common risk. See how our cybersecurity service works.