ASD Essential Eight for Australian organisations
Essential Eight: eight mitigations, four maturity levels, and the evidence behind each
What the eight strategies are, how the maturity levels work, what the November 2023 update changed, who has to reach Maturity Level Two, and how an assessment checks it.
In short
The Essential Eight is a set of eight technical mitigation strategies published by the Australian Signals Directorate's Australian Cyber Security Centre. Each strategy is defined at four maturity levels, Zero to Three, and each level is built to resist more capable adversaries. It is voluntary for most organisations. Commonwealth entities must reach Maturity Level Two under the Protective Security Policy Framework. The model was last updated in November 2023.
The eight mitigation strategies
The Essential Eight is deliberately narrow. It leaves out governance, risk management and supplier assurance. It picks eight technical controls that ASD treats as the baseline for making systems harder to compromise, and defines each one precisely enough to test.
| Strategy | What it stops |
|---|---|
| Application control | Unapproved programs, scripts and installers running on workstations and servers |
| Patch applications | Exploitation of known vulnerabilities in applications such as browsers, office suites and PDF viewers |
| Configure Microsoft Office macro settings | Malicious macros delivered in documents |
| User application hardening | Abuse of browser and application features that attackers rely on |
| Restrict administrative privileges | An attacker using privileged accounts to spread and take control |
| Patch operating systems | Exploitation of known vulnerabilities in operating systems |
| Multi-factor authentication | Stolen or guessed credentials giving access on their own |
| Regular backups | Permanent loss of data after ransomware, error or destruction |
The strategies are meant to be used together. Good backups do not stop malicious code running if application control is missing, and application control does not close known vulnerabilities that have not been patched.
How the maturity levels work
Each strategy is defined at four maturity levels, Zero to Three. Each level is designed to hold up against adversaries using more capable tradecraft than the level below.
A strategy reaches a level only when all its requirements at that level are met. Because the eight are used together, organisations usually bring all eight to the same level before pushing any one strategy higher.
- Maturity Level Zero
- The requirements of Maturity Level One are not met.
- Maturity Level One
- The first level of protection, against the least capable adversary tradecraft.
- Maturity Level Two
- Protection against more capable tradecraft. The level Commonwealth entities must reach under the PSPF.
- Maturity Level Three
- The highest level, against the most capable tradecraft the model addresses.
What the November 2023 update changed
ASD updated the maturity model in November 2023, its most recent revision. ASD reported no further updates to the model in the 2024 to 2025 financial year. If your last assessment predates the update, some requirements will have moved.
- 48-hour patching. Vulnerabilities that are critical or known to be exploited must be patched within 48 hours.
- Phishing-resistant MFA at Level Two. Maturity Level Two now requires multi-factor authentication methods that resist phishing.
- Break-glass accounts. New requirements cover emergency access accounts.
- Macro logging removed. The requirement to log Microsoft Office macro execution was taken out.
Patching evidence is usually the hardest to keep current. In Certifyi, the vulnerability register matches known vulnerabilities from the NVD to the assets they affect. See patch and configuration management for how patch records fit alongside it.
Who has to meet the Essential Eight
For most Australian organisations the Essential Eight is voluntary. It is widely used as a baseline because it is specific, testable and published by the national cyber security agency.
Commonwealth entities are different. Under the Protective Security Policy Framework (PSPF) they must reach Maturity Level Two. ASD's 2025 report on the Commonwealth's cyber security posture found that 22% of entities reached overall Maturity Level Two, up from 15% in 2024.
Suppliers to government and to larger organisations are increasingly asked to state their Essential Eight maturity in tenders and security questionnaires, even where no law requires it.
How an Essential Eight assessment works
There is no Essential Eight certificate. Maturity is assessed against ASD's Essential Eight Assessment Process Guide, most recently updated in 2024. Assessments can be run internally or by an external assessor, and the guide sets out how evidence is gathered and how strong it needs to be.
Assessors want proof that a control works as well as proof that it is configured. A policy saying macros are blocked is weaker evidence than a test showing a macro was blocked. Keep evidence that shows each requirement operating over time. A single screenshot taken the week before the review is weak.
How the Essential Eight relates to ISO 27001
The Essential Eight and ISO 27001 answer different questions. ISO 27001 is a management system: it asks how you identify risks, choose controls, assign responsibility and improve. The Essential Eight is a set of technical mitigations with exact requirements per level.
The two work well together. Many organisations run an ISO 27001 programme and use the Essential Eight to set the standard for patching, MFA, privileged access and backups inside it. For a broader, outcome-based view above both, see NIST CSF 2.0.
Reaching your target maturity level
Start with an honest assessment. Most organisations find one or two strategies well behind the rest, and those set the overall level.
-
01
Choose a target level
Decide which maturity level fits your threat profile and obligations. Commonwealth entities start from Level Two.
Security lead and leadership
-
02
Assess each strategy
Test every requirement at the target level across all eight strategies and record the evidence.
Your team, in Certifyi
-
03
Fix the weakest strategies
Prioritise the strategies furthest from target. They determine your overall maturity.
IT and security operations
-
04
Keep it operating
Patching, access reviews and backup tests are recurring work. Track them so the evidence stays current.
Control owners
Who does what
ASD publishes the Essential Eight. Your organisation implements it, and an internal or external assessor checks it against ASD's process guide. Certifyi is a tool: it records the work and does not assess or certify you.
| Task | Your team | Certifyi | Assessor (internal or external) |
|---|---|---|---|
| Patching | Patch applications and operating systems in time | Matches known vulnerabilities to your assets | Tests that patches were applied within the required windows |
| Privileged access | Restrict and review administrative privileges | Holds review records as evidence against the control | Checks who holds privileges and why |
| Backups | Run backups and test restoring them | Records backup tests as evidence against the control | Checks that restores were tested as well as backups taken |
| Evidence | Keep proof that each requirement operates | Links evidence to the control it supports | Judges whether the evidence is strong enough |
| Assessment access | Give the assessor what they need | Scoped, read-only access to the evidence in scope | Reviews evidence and reports the maturity reached |
How Certifyi helps
Keep Essential Eight evidence next to the controls it supports
Assessors judge the Essential Eight on evidence. Certifyi keeps each control next to the records that show it operating.
-
Vulnerabilities matched to assets
Known vulnerabilities from the NVD are matched to the assets in your inventory, so you can see which systems are exposed.
-
Mapped to ISO 27001 and NIST CSF
Map a control once and reuse the mapping across ISO 27001, NIST CSF and your other frameworks.
-
Assessor access
Give an assessor scoped, read-only access to the evidence for their engagement.
Questions
Essential Eight, answered
Is the Essential Eight mandatory?
For most organisations, no. It is mandatory for Commonwealth entities, which must reach Maturity Level Two under the Protective Security Policy Framework. Others often adopt it as a baseline or are asked about it by customers.
How many Essential Eight maturity levels are there?
Four: Maturity Levels Zero, One, Two and Three. Each level is designed to resist a more capable adversary than the one below it.
When was the Essential Eight last updated?
November 2023. Among other changes, the update introduced 48-hour patching for critical or exploited vulnerabilities and phishing-resistant MFA at Maturity Level Two. ASD reported no updates to the model in the 2024 to 2025 financial year.
Is there an Essential Eight certification?
No. Maturity is assessed against ASD's Essential Eight Assessment Process Guide, by an internal team or an external assessor. No official certificate is issued.
What are the eight strategies?
Application control, patch applications, configure Microsoft Office macro settings, user application hardening, restrict administrative privileges, patch operating systems, multi-factor authentication and regular backups.
How does the Essential Eight relate to ISO 27001?
ISO 27001 is a management system for choosing and running controls. The Essential Eight is a specific set of technical mitigations. Many organisations use the Essential Eight to set technical expectations inside an ISO 27001 programme.
Does Certifyi make us Essential Eight compliant?
No. Certifyi holds your controls and the evidence behind them, and matches known vulnerabilities to your assets. The maturity you reach depends on how the controls are implemented, and an assessor decides it.
Talk through your Essential Eight evidence in a 30-minute call.
Bring your target maturity level. We will show how your controls, vulnerability records and evidence line up against each strategy.
- Each customer workspace has its own database
- Every change written to a tamper-evident activity log
- Auditors get scoped, read-only access
- AI suggestions wait for a person to accept them