Essential Eight
ASD's baseline of eight mitigation strategies. Maturity 0 to 3. The work is picking a level you can actually hold.
The Essential Eight is the Australian Signals Directorate's set of mitigation strategies that stop a large share of commodity intrusion. It is not a full information security program. It is the floor.
The eight: application control; patch applications; configure Microsoft Office macro settings; user application hardening; restrict administrative privileges; patch operating systems; multi-factor authentication; regular backups.
Maturity levels run from 0 (not aligned) to 3. Most organisations fail by claiming level 2 on paper and operating at 0 in the bits. Pick a level, evidence it, then move.
Use it with the ISM, not instead of it. Essential Eight is the short list; the ISM is the catalogue.
ASD has evolved the Essential Eight
On 15 October 2026 ASD published the ASD Essentials series and says it has evolved the Essential Eight into ASD Essentials for enterprise IT. ASD frames the Essential Eight as an important foundation for many of the controls the enterprise IT chapter requires, and existing investment carries forward, but it is assessed differently. Essential Eight maturity level ratings do not automatically convert into ratings under the new chapter. This page stays as a transition reference. See the CyberStack pages ASD Essentials, ASD Essentials for enterprise IT and Transitioning from the Essential Eight.
See also:
Fact source: ASD's ACSC — Essential Eight, ASD — What is the Essentials? (15 Oct 2026), ASD — Transitioning from the Essential Eight (15 Oct 2026).