The Essential Eight explained, and what it means for a business using AI
The eight strategies, the four maturity levels, who has to comply, how an assessment works, what ASD Essentials changes, and the gaps that open once your team uses AI tools and agents.
The Essential Eight is a set of eight cyber security strategies from the Australian Signals Directorate: patch applications, patch operating systems, multi-factor authentication, restrict administrative privileges, application control, restrict Microsoft Office macros, user application hardening and regular backups. Each is measured against four maturity levels, from Level Zero to Level Three.
This guide describes the Essential Eight Maturity Model as last updated by ASD in November 2023. That is the version assessments, tenders and insurance forms still refer to. On 15 October 2026 ASD published its successor, a series called ASD Essentials, and we cover what that changes further down. If you came here because a buyer asked about the Essential Eight and your AI in the same breath, read does the Essential Eight cover AI? alongside this one.
What is the Essential Eight?
ASD runs the Australian Cyber Security Centre, the agency Australian organisations call when they are breached. Out of that work it publishes a long list called Strategies to Mitigate Cyber Security Incidents. The Essential Eight is the top of that list: the eight strategies ASD rates as the best value for stopping the attacks it is called in to clean up. It was first published in 2017, and the maturity model that measures it was last revised in November 2023.
It was written for internet-connected office networks, the Windows desktops, servers and Microsoft 365 setup most Australian businesses run. ASD says the principles can apply elsewhere, and also that other strategies may suit environments it was never designed for. That scoping matters later, when we get to AI.
The eight fall into three groups, by what each one does to an attack.
The three groups are the headings ASD uses in its Strategies to Mitigate Cyber Security Incidents. The order inside each group is ours.
What are the eight strategies, and where do you start with each?
The table below gives each strategy in one line, the attack it stops, and a first step a business of 20 to 200 people can take without a security team. The first steps are where we would start. Reaching a maturity level takes the full list of requirements for that level in ASD's maturity model.
| Strategy | What it is | What it stops | A practical first step |
|---|---|---|---|
| Patch applications | Install security updates for browsers, Office, PDF readers and anything facing the internet, such as a VPN or firewall | Attackers using a published hole in software you have not updated | List every internet-facing service you run and who patches it. Turn on automatic updates for browsers and Office through your device management |
| Patch operating systems | Keep Windows, macOS and server operating systems current, and retire versions the vendor no longer supports | Known operating system flaws used to take control of a machine | Pull a report of every device on an unsupported operating system and set a date to replace or isolate each one |
| Multi-factor authentication | A second proof of identity on top of the password | A stolen or guessed password being enough to get in | Enforce it on email, Microsoft 365 or Google Workspace, remote access, your CRM and your accounting system. Use passkeys or security keys for admin accounts |
| Restrict administrative privileges | Fewer people with admin rights, used only for admin work, from separate accounts | One compromised account handing over the whole network | List everyone with admin rights in each system. Remove the ones nobody can justify and give the rest a separate admin login |
| Application control | Only approved programs and scripts can run | Malware a user downloads or opens actually running | Block programs from running out of user profile and temporary folders, which is where downloaded malware lands |
| Restrict Microsoft Office macros | Macros are off unless someone has a business need, and macros from internet files are blocked | Malicious Word and Excel attachments, one of the oldest routes in | Block macros in files from the internet for everyone. Keep a named list of the few people who need macros at all |
| User application hardening | Switch off risky features in browsers, Office and PDF readers, and remove old software nobody uses | Malicious web content and documents exploiting features you never needed | Set browser and Office security settings centrally so users cannot change them, and uninstall legacy software |
| Regular backups | Back up important data, software and settings, keep a copy attackers cannot change, and test restoring it | Ransomware or deletion turning into permanent loss | Restore one real system from backup this month and time it. Check the cloud tools you rely on are backed up too |
None of the eight is new or exotic. What makes the Essential Eight useful is the ordering: ASD has done the work of telling you which eight things matter most, so a business with limited time can spend it there first.
What are the Essential Eight maturity levels?
The maturity model sets four levels. ASD describes Levels One to Three as mitigating increasing levels of adversary tradecraft and targeting. In plain terms, each level is designed to stop a more capable attacker.
| Level | Designed to stop | What that looks like |
|---|---|---|
| Maturity Level Zero | Nothing in particular | Weaknesses in your overall security that do not yet meet Level One |
| Maturity Level One | Opportunistic attackers using freely available tools | Someone scanning the internet for an unpatched service, or trying stolen passwords against your email |
| Maturity Level Two | Attackers with a modest step up in capability who pick targets more deliberately | Someone who spends time on your business specifically, with better tools, but will move on if it gets expensive |
| Maturity Level Three | Adaptive attackers less reliant on public tools | Someone who studies your setup and exploits whatever you have left weakest |
Two rules catch people out.
Your weakest strategy sets your level. The eight are implemented and assessed as a package. Seven strategies at Level Two and one at Level Zero is Maturity Level Zero overall. That is why self-reported levels so often turn out to be optimistic.
Each level builds on the one below. ASD's assessment guidance has a business demonstrate Level One before it is assessed at Level Two, and Level Two before Level Three. Aim for Level One across all eight first. Level Two is what non-corporate Commonwealth entities are held to, so it is the figure that turns up in tenders.
Who has to comply with the Essential Eight?
Three groups, with different reasons.
Non-corporate Commonwealth entities must. Federal departments and agencies are required to implement the Essential Eight to Maturity Level Two under the Protective Security Policy Framework. For them it is policy.
Suppliers usually meet it by contract. This is how most private businesses run into it. The requirement arrives in a tender, a supplier agreement or a security questionnaire. State government, financial services and larger enterprises use it as the local shorthand for whether a supplier takes security seriously. In October a client's chief of staff sent us ten questions about a small server we were proposing to run for them: what credential it would use, how access is controlled, the patching schedule, whether they could see the penetration test report. One of the ten was simply "Which E8 maturity level?"
Everyone else should, voluntarily. No law makes a private Australian business implement it. It is still the best value list of eight things to do, because it comes from real incidents. Cyber insurance proposal forms ask about several of the same controls, especially multi-factor authentication, backups, patching and admin accounts.
How does a business get assessed against the Essential Eight?
There is no Essential Eight certificate. ASD does not require organisations to have their implementation certified by an independent party, though a contract, a regulator or a government directive can require an independent assessment. So an assessment is either something you do yourself or something you pay a security firm to do, and both follow the same shape:
- Set the scope. Which systems are in: usually the desktops, laptops, servers and Microsoft 365 or Google Workspace tenant your staff use every day.
- Pick a target level. Usually Level One first, or whatever level the contract names.
- Gather evidence for each requirement. Configuration exports, policy settings, patch reports, the admin account list, a backup restore test. Evidence that a control works counts for more than a statement that it is turned on.
- Rate each strategy. Your overall level is the lowest of the eight.
- Write the gap list and a date for each gap. Then reassess, at least yearly and after any big change to your systems.
ASD's Essential Eight Assessment Process Guide sets out how assessors are expected to test and what evidence they should accept. A firm doing an independent assessment will follow it, and reading it before a self-assessment shows you how strict the bar is.
We do this ourselves. Neighbourhood self-assesses against the Essential Eight, and the self-assessment sits in our Information Security Policy, which security teams can request through our Trust Centre.
What is ASD Essentials, and does it replace the Essential Eight?
On 15 October 2026 ASD published ASD Essentials, which it describes as an evolution of the Essential Eight. The first release has three chapters: Essentials for enterprise IT, which is the direct successor to the Essential Eight, plus chapters for cloud and for operational technology. iTnews reported the release on the day.
The biggest change is how you are measured. The Essential Eight gives one overall maturity level. ASD Essentials asks organisations to report area by area, such as identity services or internet-facing systems, with effectiveness ratings backed by evidence such as independent testing. Identity and internet-facing systems come first in its priority order. It also asks for formally defined executive and board accountability for cyber security.
For a business working on the Essential Eight today, three things matter:
- Nothing you already owe has changed. The Essential Eight stays on cyber.gov.au during the transition and no mandatory changeover date has been set. A contract that names the Essential Eight still means the Essential Eight.
- The work carries across. Existing Essential Eight controls count toward ASD Essentials, though ASD advises checking them against the new framework before assuming they are equivalent. A maturity level does not convert into an effectiveness rating on its own.
- Government moves first. iTnews reports that government agencies will be assessed against both frameworks next year. Their suppliers' questionnaires will follow.
What does the Essential Eight not cover when your business uses AI?
The eight protect the accounts, devices and software around your AI tools. Multi-factor authentication covers the logins to ChatGPT, Claude or Copilot, admin restrictions limit who can connect them to your data, and backups cover what an AI tool might change. None of the eight deal with AI itself: what staff paste into a prompt, what an agent is allowed to do on its own, or instructions hidden in an email it reads.
Buyers have noticed. In June a buyer's IT security team reviewed us and asked for AI governance documentation, AI security and data flow documentation, data processing agreements with the AI providers, controls for prompt injection and data leakage, and AI monitoring. Not one of those is an Essential Eight question.
ASD Essentials covers part of it. A companion paper, AI considerations within the Essentials, brings AI models, prompts, outputs and the accounts AI agents use into scope. What the gap looks like for each way a business uses AI, and what to do about it, is in does the Essential Eight cover AI?
Frequently asked questions
Is the Essential Eight mandatory for private businesses? No law requires a private Australian business to implement it. Non-corporate Commonwealth entities must reach Maturity Level Two under the Protective Security Policy Framework. Most private businesses meet it through a contract, a tender or a buyer's security questionnaire, which can make it a condition of winning the work.
What Essential Eight maturity level should a small business aim for? Get to Maturity Level One across all eight strategies first, because your weakest strategy sets your overall level. Move to Level Two when a contract, a government buyer or your own risk calls for it. Level Two is the level government entities are held to, so it is the figure that turns up in tenders.
Can a business be certified against the Essential Eight? There is no Essential Eight certificate. ASD does not require independent certification, so most businesses self-assess. A contract, regulator or government directive can require an independent assessment, which is usually done by a security firm following ASD's Essential Eight Assessment Process Guide.
Is the Essential Eight being replaced? ASD published ASD Essentials on 15 October 2026 as the evolution of the Essential Eight, with chapters for enterprise IT, cloud and operational technology. The Essential Eight stays on cyber.gov.au during the transition, no mandatory changeover date has been set, and existing contractual and regulatory obligations still apply.
Does the Essential Eight cover AI? No. The eight strategies protect the devices, accounts and software around your AI tools, which still matters. None of them address prompt injection, what data reaches a model provider, or how much an AI agent is allowed to do. Australia's AI security guidance sits in separate ASD publications.
Read next
- Does the Essential Eight cover AI?
- How to secure AI: what the ACSC actually says
- The AI security questionnaire your buyer's CTO is about to send
- Who signs off on AI? A one-page AI policy
- AI governance in Australia: the 2026 guide
Sources
- Essential Eight maturity model, November 2023, Australian Signals Directorate, cyber.gov.au. The version this guide describes.
- Essential Eight explained, Australian Signals Directorate, cyber.gov.au, for the scope of the framework.
- Essential Eight Assessment Process Guide, Australian Signals Directorate, cyber.gov.au.
- Strategies to Mitigate Cyber Security Incidents, Australian Signals Directorate, cyber.gov.au, for the three groups in the diagram.
- ASD Essentials and AI considerations within the Essentials, Australian Signals Directorate, cyber.gov.au, published 15 October 2026.
- ASD's Essential Eight replacement moves away from maturity ladder, iTnews, 15 October 2026.
- Neighbourhood Trust Centre, for our own Essential Eight self-assessment status.
Neighbourhood builds AI agents on Claude for Australian businesses and runs them under a written security and governance policy. Our AI engineers can show you where your AI tools sit against the Essential Eight and the AI guidance that goes beyond it.
Essential Eight in place, AI on top?
Book 15 minutes and bring the list of AI tools your team uses. We will show you which of them the Essential Eight already protects and what is left to close.