ACSC Essential 8 Compliance

Overview

The Essential Eight covers eight mitigation strategies: application control, patching applications, configuring Microsoft Office macro settings, user application hardening, restricting administrative privileges, patching operating systems, multi-factor authentication, and regular backups. Each strategy targets a specific attack vector or limits the impact of a successful compromise.

Each strategy is assessed across four maturity levels. Maturity Level Zero indicates the strategy has not been effectively implemented. Maturity Level One provides partial coverage against commodity threats. Maturity Level Two provides substantial protection against more capable adversaries. Maturity Level Three provides comprehensive protection against sophisticated threats.

The framework is regularly updated by the ACSC to reflect the evolving threat landscape, with maturity level requirements adjusted based on observed adversary tradecraft. It is designed to be practical and achievable, focusing on controls that deliver the highest return on security investment.

While the Essential Eight does not constitute a complete cybersecurity program, it provides a strong foundation. Organisations typically complement it with broader frameworks such as the ASD ISM, ISO 27001, or NIST CSF for comprehensive coverage across governance, risk, and operational security domains.

Key Areas

• Application control - preventing execution of unapproved programs and scripts
• Patch applications - applying security patches to applications within defined timeframes
• Configure Microsoft Office macro settings - restricting or blocking macros from the internet
• User application hardening - disabling unnecessary features in web browsers and other applications
• Restrict administrative privileges - limiting admin access based on duties and revalidating regularly
• Patch operating systems - applying security patches to operating systems within defined timeframes
• Multi-factor authentication - requiring multiple authentication factors for privileged and remote access
• Regular backups - performing and testing backups of important data, configurations, and settings

Who It's For

• Australian Government agencies required to comply with federal cybersecurity policy
• Critical infrastructure operators subject to the SOCI Act
• Private sector organisations seeking a practical, prioritised cybersecurity baseline
• IT and security teams looking for a clear maturity-based improvement roadmap

Core Requirements

Policies and Governance

Organisations must define a target maturity level for each Essential Eight strategy based on their risk profile. Policies should mandate compliance with the target maturity level and assign accountability for implementation and monitoring.

Risk Management

Risk assessments should inform the selection of target maturity levels. Organisations must consider their threat environment, the criticality of their systems, and the potential impact of compromise when determining appropriate maturity targets.

Security Controls

Technical controls must be implemented for each of the eight strategies at the target maturity level. This includes configuring application whitelisting, patch management systems, macro policies, MFA solutions, privilege management, and backup processes.

Incident Response

While incident response is not one of the eight strategies, the Essential Eight supports incident readiness by reducing the attack surface and ensuring that backups are available for recovery. Organisations should integrate Essential Eight maturity into their broader incident response planning.

Evidence and Reporting

Organisations must assess and document their maturity level for each strategy. Regular assessments, ideally quarterly or semi-annually, track progress toward target maturity levels. Evidence includes system configurations, patch compliance reports, access reviews, and backup test results.

Implementation Steps

1. Scope and objectives - Identify the systems and environments that are in scope for Essential Eight implementation. Set target maturity levels for each of the eight strategies based on the organisation's risk profile and regulatory requirements.
2. Gap assessment - Assess current implementation of each strategy against the target maturity level using the ACSC Essential Eight Maturity Model. Identify gaps and dependencies between strategies. Prioritise remediation based on risk reduction potential.
3. Control implementation - Implement or uplift technical controls for each strategy to meet the target maturity level. This may include deploying application control solutions, configuring patch management, enabling MFA, hardening applications, and establishing backup procedures.
4. Evidence and documentation - Document the implementation of each strategy, including configuration evidence, testing results, and exception records. Maintain evidence that demonstrates ongoing compliance at the target maturity level.
5. Review and continuous improvement - Conduct regular maturity assessments to validate sustained compliance and identify opportunities for uplift. Review maturity targets as the threat environment evolves and adjust implementation plans accordingly.

Frequently Asked Questions

Is the Essential Eight mandatory?

It is mandatory for Australian Government non-corporate Commonwealth entities. It is strongly recommended for all other Australian organisations and is increasingly expected by regulators and customers.

What are the Essential Eight maturity levels?

Maturity Level Zero means the strategy is not effectively implemented. Levels One, Two, and Three represent increasing degrees of implementation aligned with the strategy's intent, with Level Three providing protection against sophisticated adversaries.

Which maturity level should we target?

The target depends on your threat environment and risk tolerance. ACSC recommends that organisations aim for at least Maturity Level One as a baseline, with higher levels for organisations facing more sophisticated threats.

How often should we assess our maturity?

Regular assessments are recommended, ideally quarterly or semi-annually. Australian Government agencies may have specific reporting requirements.

Does the Essential Eight cover operational technology?

The Essential Eight was primarily designed for corporate IT environments. Organisations with OT should consider the ASD ISM and sector-specific frameworks like the AESCSF for OT coverage.

Can we achieve different maturity levels for different strategies?

Yes. Organisations may be at different maturity levels across the eight strategies. However, the overall protection is limited by the lowest maturity level, so balanced uplift is recommended.

How does the Essential Eight relate to the ASD ISM?

The Essential Eight is a subset of the broader ASD ISM. Organisations seeking comprehensive coverage should use the ISM alongside the Essential Eight.

Why It Matters

• The Essential Eight addresses the most commonly exploited attack vectors including malware execution, privilege escalation, and data destruction. By focusing on these eight specific strategies, organisations can significantly reduce their exposure to the majority of cyber threats without the complexity of implementing hundreds of controls simultaneously.
• The maturity model provides a clear roadmap for improvement. Organisations can assess their current level, set a target maturity level appropriate to their threat environment, and systematically work toward it. This structured approach helps prioritise limited security budgets and resources where they will have the greatest impact.
• For Australian Government agencies, the Essential Eight is mandatory. For private sector organisations, it provides a widely recognised and respected benchmark that demonstrates cybersecurity commitment to customers, partners, regulators, and boards.

Common Challenges

• Achieving consistent application control across diverse operating environments and legacy applications
• Meeting aggressive patching timeframes, particularly for critical vulnerabilities and zero-days
• Managing the operational impact of restricting administrative privileges in established environments
• Implementing multi-factor authentication across all required access paths including legacy systems
• Ensuring backup processes cover all critical data and configurations and can be restored within required timeframes
• Maintaining maturity levels consistently over time rather than only during assessment periods