Essential Eight quick reference
ASD baseline. Maturity 0 to 3. Claim only what you can evidence. Source: cyber.gov.au.
| # | Strategy |
|---|---|
| 01 | Application control Only approved software runs. Start on workstations, then servers. |
| 02 | Patch applications Internet-facing and KEV first. Hours and days, not quarters. |
| 03 | Microsoft Office macros Block from the internet. Signed macros only if you must. |
| 04 | User application hardening Turn off unused features in browsers and office suites. |
| 05 | Restrict admin privileges No standing admin. Separate accounts. Log use. |
| 06 | Patch operating systems Same as apps. Firmware and hypervisors count. |
| 07 | Multi-factor authentication Privileged, remote, and email. Prefer phishing-resistant. |
| 08 | Regular backups Disconnected or immutable. Restore tested on a calendar. |
How to use this without lying
Pick a target maturity for a defined scope (e.g. Windows workstations). Evidence each strategy. Exceptions expire. Do not average eight scores into a single vanity number.