Frameworks
The Essential Eight explained for small business
What is the Essential Eight? A plain-English explainer of ASD's eight strategies, how maturity levels work, and what its small business guide says.
Where to start: the Essential Eight for a small business
ASD's small business guide is the starting point it describes, with Maturity Level One of the Essential Eight as the next step. These are the steps in that order.
- Work through ASD's small business basics firstASD's small business guide starts with MFA, software updates and backups, then covers access, staff and an emergency plan.Ten small business basics
- Check where the business standsbusiness.gov.au points to the ACSC's free, anonymous Cyber Health Check Tool, which shows what a business is doing well and where it can improve.How the small business guide fits
- Learn what each of the eight strategies coversASD's eight include patching applications and operating systems, MFA, restricting admin rights and regular backups. The table below explains each in plain English.The eight strategies
- Choose a target maturity level, usually starting at Level OneASD's small business guide points businesses that have finished it towards Maturity Level One. ASD's model says to plan for a level suited to the environment.How the maturity levels work
- Bring all eight strategies to that level before going higherASD's maturity model says organisations should plan to reach the same maturity level across all eight strategies before moving to a higher level.What ASD says about levels
- Using Microsoft 365? Map the strategies to its settingsSeveral strategies, such as MFA and restricting admin rights, are settings in Microsoft 365. Our baseline guide explains the related Microsoft settings.Microsoft 365 security baseline
Based on ASD's Essential Eight maturity model (November 2023), ASD's Small business cyber security guide (January 2025) and business.gov.au's cyber security checklist, checked October 2026.
Key points
- The Essential Eight is a set of eight mitigation strategies published by the Australian Signals Directorate (ASD), which describes them as the most effective of its recommended mitigation strategies.
- ASD's maturity model has four levels, Zero to Three. Level One targets opportunistic attackers using widely available tools and techniques.
- ASD's model notes there's no requirement to have an Essential Eight implementation independently certified, though a regulator, government directive or contract may require an assessment.
- In June 2026 ASD consulted on a new 'Essentials series', with the current Essential Eight as its first chapter.
What is the Essential Eight? It’s a set of eight mitigation strategies published by the Australian Signals Directorate (ASD) through its Australian Cyber Security Centre (ACSC). ASD’s maturity model says “the most effective of these mitigation strategies are the Essential Eight”, and that the Essential Eight “has been designed to protect organisations’ internet-connected information technology networks”. The model was first published in June 2017.
This page explains the framework in plain English: the eight strategies, the maturity levels, and how it relates to ASD’s small business guide. For a small business, that guide covers the basics first and then points towards Maturity Level One. This page is an educational starting point, not a substitute for ASD’s documentation, and not an assessment or compliance advice.
The eight strategies
ASD names these eight strategies. The right-hand column is a plain-English summary; ASD’s maturity model sets out what each one actually requires.
| Strategy (ASD’s name) | In plain English |
|---|---|
| Patch applications | Keeping software such as browsers, office apps and PDF readers updated |
| Patch operating systems | Keeping operating systems such as Windows and macOS updated |
| Multi-factor authentication | Requiring more than a password to sign in |
| Restrict administrative privileges | Limiting who has admin rights |
| Application control | Allowing only approved programs to run |
| Restrict Microsoft Office macros | Limiting macros, small programs inside documents |
| User application hardening | Turning off risky features in browsers, office apps and PDF readers |
| Regular backups | Backing up important data, software and settings |
How the maturity levels work
ASD’s model has four maturity levels for each strategy:
- Maturity Level Zero indicates weaknesses in an organisation’s overall cyber security posture.
- Maturity Level One targets opportunistic attackers “content to simply leverage commodity tradecraft that is widely available”.
- Maturity Level Two targets attackers “operating with a modest step-up in capability from the previous maturity level”.
- Maturity Level Three targets attackers who are “more adaptive and much less reliant on public tools and techniques”.
ASD says “organisations should identify and plan for a target maturity level suitable for their environment”, and should plan “to achieve the same maturity level across all eight mitigation strategies” before moving to higher levels.
What ASD’s small business guide says
ASD’s small business cyber security guide covers many of the same foundations in simpler terms. Its introduction describes turning on multi-factor authentication, updating software and backing up information as starting measures, and points businesses that have worked through the guide towards Maturity Level One of the Essential Eight.
Topics the guide covers that overlap with the Essential Eight include:
- turning on automatic updates for devices and software, and replacing products that no longer receive updates
- turning on MFA “wherever possible, starting with your most important accounts” (for Microsoft 365, see Microsoft 365 MFA methods compared)
- creating and implementing a plan to back up information regularly (see Microsoft 365 backup options)
- protecting administrative accounts with a strong passphrase or MFA (see Microsoft 365 admin roles and least privilege).
business.gov.au’s cyber security checklist also points to the Cyber Health Check Tool, which it describes as “free, anonymous” and a way to see “what your business is doing well and where you can improve cyber security”.
If you use Microsoft 365, the Microsoft 365 security baseline explains Microsoft settings related to several of these strategies.
Changes ASD proposed in 2026
In June 2026 ASD opened consultation on what it calls “a new Essentials series”, “grounded in the Information Security Manual (ISM)”. ASD says the current Essential Eight guidance will form the first chapter, “Essentials for enterprise IT”, with more chapters to follow. Consultation ran until 12 July 2026. ASD says organisations already using the Essential Eight can expect “strong alignment with their existing controls and investments”. This page describes the November 2023 maturity model, the version ASD’s published PDF carries; it will be updated if ASD publishes a replacement.
Common misunderstandings
- “It’s a one-off project.” ASD frames the Essential Eight as maturity levels to plan towards, and the small business guide notes, for example, that training “isn’t a once-off requirement”.
- “It covers every risk.” The Essential Eight is designed to protect internet-connected IT networks. Scams that persuade staff to pay a fake invoice are a process risk too; see payment redirection controls.
- “Reading a guide means we’re compliant.” Reading about the strategies isn’t the same as implementing or assessing them. Whether an assessment is needed is covered under Common questions.
Common questions
What is the Essential Eight?
The Essential Eight is a set of eight mitigation strategies published by the Australian Signals Directorate (ASD) through its Australian Cyber Security Centre. ASD’s maturity model describes them as the most effective of its mitigation strategies, designed to protect organisations’ internet-connected information technology networks. The model was first published in June 2017 and measures each strategy by maturity level. See the eight strategies and how the maturity levels work.
What are the Essential Eight strategies?
ASD lists them as: patch applications, patch operating systems, multi-factor authentication, restrict administrative privileges, application control, restrict Microsoft Office macros, user application hardening and regular backups. ASD’s maturity model sets out what each one actually requires. The table above summarises each in plain English.
What are the Essential Eight maturity levels?
ASD’s model has four levels, Maturity Level Zero to Maturity Level Three. Level One targets opportunistic attackers using widely available tradecraft, and Levels Two and Three target progressively more capable attackers. ASD says organisations should plan to reach the same maturity level across all eight strategies before moving higher. See how the maturity levels work.
Do I need Essential Eight certification?
ASD’s maturity model notes there’s no requirement for organisations to have their Essential Eight implementation certified by an independent party. It adds that independent assessment may still be required by a government directive, a regulator or a contract. Reading about the strategies also isn’t the same as implementing or assessing them; see common misunderstandings.
How do I start with the Essential Eight as a small business?
ASD’s small business guide is the starting point it describes. It covers multi-factor authentication, software updates and backups as starting measures, and points businesses that have worked through it towards Maturity Level One. business.gov.au also points to the free, anonymous Cyber Health Check Tool. See what ASD’s small business guide says and ten small business cyber security basics.
Is the Essential Eight changing in 2026?
ASD has proposed changes. In June 2026 it consulted on “a new Essentials series”, with the current Essential Eight guidance forming the first chapter, “Essentials for enterprise IT”. Consultation ran until 12 July 2026, and ASD says organisations already using the Essential Eight can expect “strong alignment with their existing controls and investments”. This page describes the November 2023 model; see changes ASD proposed in 2026.
Where to get official help
- ASD’s Essential Eight maturity model, the authoritative description of each strategy and level.
- ASD’s small business cyber security guide, the plain-language starting point.
- business.gov.au’s cyber security checklist, which links the free Cyber Health Check Tool and lists the Australian Cyber Security Hotline, 1300 CYBER1 (1300 292 371).
Related reading: ten small business cyber security basics and ransomware explained.