What Is the Essential Eight?

The Essential Eight is a set of prioritized mitigation strategies from the Australian Signals Directorate intended to make compromise of internet-connected IT networks much harder.

It is not a complete framework for every cyber risk. ASD also points organizations to broader Strategies to Mitigate Cyber Security Incidents and the Information Security Manual (ISM). It was not designed specifically for OT networks.

The Eight Strategies

Maturity Levels 0–3

ASD’s FAQ notes Level One may often suit smaller/medium organizations, Level Two larger enterprises and Level Three critical infrastructure/high-threat environments, but threat context should drive the final target.

Choosing a Target Level

Choose based on threat actors, business criticality, data sensitivity, regulatory/contract obligations and operating environment. ASD recommends progressively implementing levels rather than skipping lower foundations.

Individual higher-level controls can be implemented early when efficient—for example adopting a stronger authentication method instead of building a weaker one that will soon be replaced.

Implementation Approach

1. Define systems/environments in scope.
2. Assess current maturity for each strategy.
3. Select target maturity.
4. Implement Level One consistently.
5. Test technical enforcement.
6. Address legacy systems/compensating controls.
7. Progress through Level Two/Three.
8. Reassess after major platform/identity changes.

Assessment Process

ASD’s assessment guidance expects assessors to evaluate implementation using the maturity model and professional judgement. Compensating controls should provide an equivalent level of protection.

There is no general ASD requirement for independent certification; separate government, regulator or contract obligations can still require independent assessment.

Evidence Examples

Scope and Limitations

Essential Eight was designed for internet-connected IT. ASD notes alternative controls may be more appropriate for unique OT threats. The model also does not replace secure software development, API authorization, cloud governance or third-party risk management.

APIs and Essential Eight

APIs benefit indirectly from patched platforms, MFA and restricted administration, but BOLA, excessive data exposure and business-logic abuse require application/API controls beyond Essential Eight.

Related Ammune reading: API security checklist for 2026 and API authorization vs authentication.

Phishing-Resistant MFA and the Maturity Journey

Authentication is one of the Essential Eight strategies, but implementation quality matters. Higher maturity requirements increasingly focus on stronger authentication coverage and resistance to common credential attacks. When modernizing identity, consider whether investing directly in phishing-resistant methods such as FIDO2/WebAuthn is more efficient than deploying an intermediate method that will soon need replacement.

The same principle applies to privileged access. Administrative accounts should be distinct from normal user accounts, protected with appropriate MFA and restricted to systems/tasks that require privilege. A strong MFA method does not compensate for shared administrator accounts or standing privilege across unrelated systems.

Assessment should test enforcement rather than enrollment statistics alone. Verify which applications actually require MFA, whether legacy protocols bypass it, how recovery/new-device enrollment works and whether privileged/admin access follows the intended policy.

Related Ammune reading: 2FA vs MFA authentication and API authorization vs authentication.

Why Maturity Is Constrained by the Weakest Requirement

The Essential Eight should not be scored like a maturity average. If a required element is missing, an organization should not claim the higher level merely because other strategies exceed it. This prevents strong backups, for example, from masking a material weakness in MFA, patching or administrative privilege.

For program management, keep two views: the formally achieved maturity and a heat map showing which individual requirements are ahead or behind. That supports uplift planning without overstating the assessed level.

Compensating controls should be evaluated against assessment guidance and the protection they actually provide, not used as generic exceptions for systems that are difficult to modernize.

Essential Eight Uplift Roadmap by Dependency

The eight strategies should be coordinated instead of treated as eight unrelated projects. Patch governance depends on knowing the device/application population; privileged-access restrictions depend on identity/account ownership; backups must be protected from the same administrator compromise that affects production.

Build a roadmap that removes shared blockers first. That makes maturity gains more sustainable than trying to raise each strategy independently through separate short-term exceptions.

Essential Eight Checklist

• Define assessment scope.
• Set target maturity.
• Assess all eight strategies.
• Progress through lower levels first.
• Use current ASD guidance.
• Test technical enforcement/evidence.
• Address legacy systems with uplift/compensation.
• Do not claim ASD certification unless an applicable scheme actually provides it.
• Combine with broader ISM/security controls.
• Reassess after environment/threat changes.

Frequently Asked Questions

Primary References