Quick answer
The Essential Eight is a set of eight baseline cyber security strategies published by the Australian Signals Directorate's Australian Cyber Security Centre. It helps organisations reduce the risk of common attacks, and has maturity levels from zero to three to track progress.
Key takeaways
- It is an Australian Government baseline, widely used by business.
- Eight strategies cover prevention, limiting damage and recovery.
- Maturity levels show how far along you are.
- Multi-factor authentication and backups are good starting points.
What are the eight strategies?
| Strategy | In plain terms |
|---|---|
| Application control | Only approved software can run |
| Patch applications | Keep software updated |
| Configure Microsoft Office macro settings | Block risky macros |
| User application hardening | Turn off unsafe features in browsers and apps |
| Restrict administrative privileges | Limit who has powerful accounts |
| Patch operating systems | Keep Windows, macOS and others updated |
| Multi-factor authentication | Require a second step to log in |
| Regular backups | Keep tested copies of important data |
What are the maturity levels?
The model runs from Level Zero (weak or missing controls) to Level Three (strong controls that resist skilled attackers). Most small businesses aim for Level One first, then build up. Each level adds stronger controls and more evidence that they work, so you can show clients real progress.
Where should a small business start?
- Turn on multi-factor authentication for email and key systems.
- Set automatic updates and patch quickly.
- Back up important data and test a restore.
- Remove admin rights from everyday accounts.
- Train staff to spot phishing.
How do you check progress?
Do a simple self-assessment against each strategy, note the gaps and set a plan. Many businesses ask an outside specialist to confirm the result.
The Essential Eight is a baseline, not a guarantee, so keep reviewing as threats change.
Why it matters beyond security
Customers, insurers and government buyers increasingly ask about your security. A clear Essential Eight position builds trust and can support contract and tender requirements.
Bottom line
You do not need to do everything at once. Turn on multi-factor authentication, patch quickly, back up regularly and work your way up the maturity levels.
Sources and further reading
- Australian Cyber Security Centre: Essential Eight
- Australian Cyber Security Centre
- Cyber.gov.au: Small business
Checked against the sources above and our own project experience. Last reviewed 7 October 2026.
