Glossary | Australian Compliance
Essential Eight
The Australian Cyber Security Centre's eight mitigation strategies for protecting business systems against cyber threats, a framework ASD is replacing with the ASD Essentials published in October 2026.
Browse all definitionsIn detail
The Australian Signals Directorate's Australian Cyber Security Centre (ACSC) publishes the Essential Eight. The eight mitigations are application control, patch applications, configure Microsoft Office macro settings, user application hardening, restrict administrative privileges, patch operating systems, multi factor authentication and regular backups. The maturity model has levels zero to three and is intended to help organisations choose and work towards a target that fits their threat exposure. On 15 October 2026 ASD published the ASD Essentials, which it calls an evolution of the Essential Eight. ASD has set no end date or transition deadline, the maturity model is still published, and maturity level ratings do not automatically convert into Essentials ratings.
Sources and further reading
Check the source, not just the summary
- ACSC Essential Eightcyber.gov.au
- Essential Eight maturity model FAQcyber.gov.au
- ASD Essentialscyber.gov.au
- Protective Security Policy Framework applicationprotectivesecurity.gov.au
Apply the definition
Want to talk through how this applies to your business?
Start with the decision in front of you. We will help map the fit.