By PC Madness ·
The short answer
The Essential Eight is a set of eight cyber security strategies published by the Australian Signals Directorate (ASD). They cover keeping software up to date, locking down logins and admin access, stopping untrusted programs and macros from running, and keeping backups you can actually restore from. The ASD calls them the most effective of its strategies for protecting internet-connected business networks.
It isn't a law for private businesses and it isn't a certificate. It's a practical baseline, and insurers, larger clients and government buyers often ask how a business measures up. This article explains the eight strategies and the four maturity levels in plain English, and how a small business can work out where it stands.
The eight strategies in plain English
In everyday terms, the eight strategies are:
- Patch applications. Keep browsers, Microsoft Office, PDF readers, email programs and other software up to date, and remove software the vendor no longer supports.
- Patch operating systems. Keep Windows, macOS, servers and network devices such as firewalls up to date, and replace systems that no longer get security updates.
- Multi-factor authentication. Require a second check, such as an authenticator app, on top of a password for email, cloud apps and remote access.
- Restrict administrative privileges. Give admin rights only to the people who need them, and have those people use a separate admin account rather than doing everyday work as an admin.
- Application control. Only allow approved programs to run on computers, so a malicious file someone downloads or opens can't simply run.
- Restrict Microsoft Office macros. Turn off macros for staff who don't need them and block macros in files that come from the internet, a common way malware gets in.
- User application hardening. Lock down web browsers and similar software so they don't run risky content such as web advertisements or Java from the internet, and so staff can't switch those settings back.
- Regular backups. Back up important data, applications and settings, keep the copies somewhere attackers can't easily reach or delete, and test that you can restore them.
None of these is exotic. Most small businesses already do some of them some of the time. The Essential Eight is about doing all of them consistently.
What the maturity levels mean
To help businesses implement the strategies, the ASD's Essential Eight maturity model defines four maturity levels, from Maturity Level Zero to Maturity Level Three. Apart from Level Zero, each level is designed to stop a more capable kind of attacker:
- Maturity Level Zero means there are weaknesses in the business's overall security. It's where you sit if a strategy isn't meaningfully in place.
- Maturity Level One is aimed at opportunistic attackers using widely available tools. They look for any victim rather than a particular one, for example by using a published exploit for software that hasn't been patched, or logging in with a password that was stolen, reused or guessed.
- Maturity Level Two is aimed at attackers willing to put more time and effort into a target. They actively go after passwords with phishing and try to get around weak forms of multi-factor authentication.
- Maturity Level Three is aimed at adaptive attackers who rely much less on public tools. They take advantage of weaknesses such as older software or poor logging and monitoring, and move quickly when a new exploit is published.
Each strategy is rated separately. The ASD's guidance is to bring all eight up to the same level before aiming higher, because the strategies are designed to work together. Being at Level Three on backups doesn't make up for having no multi-factor authentication.
What Maturity Level One looks like in practice
The level descriptions sound abstract, but the requirements behind them are specific. A few examples from Maturity Level One in the maturity model:
- Patches for internet-facing services are applied within 48 hours of release when the vendor rates the vulnerability as critical or a working exploit exists, and patches for browsers, Office, email programs, PDF software and security products within two weeks.
- Multi-factor authentication protects the online services that hold the business's sensitive data, including third-party cloud services.
- Staff who need admin access get a separate admin account, and that account isn't used for email or browsing the web.
- Office macros are off for anyone without a business need, and macros in files from the internet are blocked.
- Backups are kept in a secure and resilient way, restores are tested, and ordinary user accounts can't change or delete the backups.
That's a level most small businesses can reach with the right setup. The hard part usually isn't any one control, it's keeping all of them in place week after week as staff, devices and software change.
Which level should a small business aim for?
The ASD's Essential Eight maturity model FAQ says that, generally, Maturity Level One may be suitable for small to medium enterprises, Level Two for large enterprises, and Level Three for critical infrastructure providers and other organisations in high threat environments.
For most Perth small businesses, Level One across all eight strategies is a sensible first target. Aim higher if you hold particularly sensitive information, supply government or larger clients that set their own requirements, or have been told to by an insurer. If someone asks you for a specific level, check their wording carefully, because it often only applies to the systems involved in that contract.
When the Essential Eight isn't the whole answer
To be fair about its limits: the Essential Eight was designed for internet-connected IT networks, the kind with desktop computers, servers and office software. The ASD notes it wasn't designed for things like operational technology or mobile fleets. A business that runs entirely on phones and tablets, or entirely in web-based cloud apps, will find some strategies apply only partly, and the principles matter more than the exact wording.
The ASD also describes it as a minimum set of measures. It doesn't cover everything, such as email filtering or staff training, so it works best as a baseline rather than a complete security plan.
Finally, there is no requirement for a private business to have its Essential Eight implementation certified. An independent assessment may be needed if a contract, regulator or government policy asks for one. And in the ASD's guidance, choosing to rely on cyber insurance instead of implementing a whole strategy, such as multi-factor authentication, means being assessed at Level Zero for it, not a pass.
How to find out where you stand
Start with an honest inventory: which computers and servers you have, what software runs on them, who has admin rights, which accounts have multi-factor authentication, and when you last restored something from backup. Gaps usually show up quickly once you look.
Our Essential Eight assessment checks your devices, accounts and settings against all eight strategies and shows the maturity level you're at for each. Several of the strategies are covered directly by our managed services, including patch management for applications and operating systems, multi-factor authentication and backups. Admin privileges and Office macros are reviewed in the assessment, with recommended changes.
Want to know where your business sits? Send us a message to book a free, obligation-free IT security audit. We'll show you which of the eight are in place and which to fix first.
