CyberStack

Playbooks / Essential Eight

Essential Eight quick reference

ASD baseline. Maturity 0 to 3. Claim only what you can evidence. Source: cyber.gov.au.

ASD has evolved the Essential Eight into ASD Essentials for enterprise IT (15 October 2026). ASD calls the Essential Eight an important foundation, and existing investment carries forward, but maturity levels do not automatically convert. Keep this page as a transition reference. Read ASD Essentials, ASD Essentials for enterprise IT and Transitioning from the Essential Eight, or ASD's transition guide.

ASD Essential Eight controlsThe Australian Signals Directorate Essential Eight: application control, patch applications, Microsoft Office macros, user application hardening, restrict administrative privileges, patch operating systems, multi-factor authentication, and regular backups. Maturity is 0 to 3 per control.01App control02Patch apps03Office macros04App hardening05Restrict admin06Patch OS07MFA08BackupsStrategyPriority focusESSENTIAL EIGHT / ASDMaturity 0 to 3. Legacy and transition reference: ASD has evolved E8 into ASD Essentials.Eight strategies. One maturity per control, not a blended score.
#Strategy
01Application control
Only approved software runs. Start on workstations, then servers.
02Patch applications
Internet-facing and KEV first. Hours and days, not quarters.
03Microsoft Office macros
Block from the internet. Signed macros only if you must.
04User application hardening
Turn off unused features in browsers and office suites.
05Restrict admin privileges
No standing admin. Separate accounts. Log use.
06Patch operating systems
Same as apps. Firmware and hypervisors count.
07Multi-factor authentication
Privileged, remote, and email. Prefer phishing-resistant.
08Regular backups
Disconnected or immutable. Restore tested on a calendar.

How to use this without lying

Pick a target maturity for a defined scope (e.g. Windows workstations). Evidence each strategy. Exceptions expire. Do not average eight scores into a single vanity number.

Official Essential Eight (ACSC) · What is the Essentials? (ASD) · ASD Essentials for enterprise IT