The Essential Eight explained for small and medium businesses

The Essential Eight is the Australian Signals Directorate's (ASD's) list of eight mitigation strategies for protecting internet-connected IT systems, backed by a maturity model that describes what good looks like at levels Zero to Three. With the Essential Eight explained in plain terms, most small and medium businesses can start with four things: multi-factor authentication, fast patching, separate admin accounts and backups that have been tested.

This article is general information, not legal advice. It fits the way we think about running production systems in our guide to DevOps as a service, and if you handle health information, read it alongside our guide to healthcare software development in Australia.

The Essential Eight explained, strategy by strategy#

ASD describes the Essential Eight as the most effective of its strategies to mitigate cyber security incidents. The eight strategies are patch applications, patch operating systems, multi-factor authentication, restrict administrative privileges, application control, restrict Microsoft Office macros, user application hardening and regular backups.

The strategies are designed to complement each other. MFA stops a stolen password from being enough; restricted admin rights limit what a compromised account can do; backups mean an attack that gets through is recoverable.

Essential Eight maturity levels in plain English#

The maturity model defines four levels. Apart from Level Zero, each is aimed at a more capable attacker.

• Maturity Level Zero means there are weaknesses in your overall cyber security posture.
• Maturity Level One targets attackers using widely available, commodity tools and techniques: for example, a public exploit for an unpatched online service, or logging in with stolen, reused or guessed credentials. These attackers look for any victim, not a specific one.
• Maturity Level Two targets attackers with a modest step up in capability, who invest more time, use well-known techniques to bypass controls and evade detection, and actively target credentials through phishing and weak MFA.
• Maturity Level Three targets more adaptive attackers who rely less on public tools, move quickly when exploits are published, and take advantage of old software or poor logging and monitoring.

ASD suggests choosing a target level based on how attractive you are to attackers and the consequences of an incident for your data and systems. Organisations should then implement each level progressively and reach the same level across all eight strategies before moving to a higher one, because the strategies work as a set. Exceptions should be minimised, documented, approved and reviewed, with compensating controls where possible.

Two cautions from ASD are worth repeating. Even Maturity Level Three will not stop an attacker willing to invest enough time, money and effort. And the Essential Eight is a minimum set, so your environment may warrant additional measures from ASD's wider guidance.

What Maturity Level One asks for#

Maturity Level One is where most SMEs should start. Some of its requirements, paraphrased from the maturity model:

• Patching online services. Scan online services for missing patches at least daily. Apply patches within 48 hours of release when a vulnerability is assessed as critical by the vendor or a working exploit exists, and within two weeks otherwise. Remove online services that vendors no longer support.
• Patching operating systems. Apply the same 48-hour and two-week timeframes to the operating systems of internet-facing servers and network devices. Workstations and internal servers have up to one month. Replace unsupported operating systems.
• MFA. Use MFA for your organisation's online services and third-party online services that handle your sensitive data, and for customers of online services that handle sensitive customer data.
• Admin privileges. Validate requests for privileged access when first requested, give privileged users a dedicated privileged account, and prevent most privileged accounts from accessing the internet, email and web services.
• Backups. Perform and keep backups according to business criticality, test restoration as part of disaster recovery exercises, and stop unprivileged accounts from modifying or deleting backups.

Level Two then tightens things, for example by requiring phishing-resistant MFA for users of online services, application control on internet-facing servers, and timely analysis of event logs from internet-facing servers.

How the Essential Eight applies to web apps and hosted servers#

ASD says the Essential Eight was designed to protect internet-connected information technology networks. Its principles can be applied to enterprise mobility and operational technology, but it was not designed for them. For a business that runs a web application on cloud or dedicated servers, the strategies map like this:

• Patch applications covers your application's frameworks, libraries, plugins and any other online services. A critical flaw in a web framework with a public exploit falls in the 48-hour window.
• Patch operating systems covers your internet-facing servers directly: scan daily, patch within the Level One timeframes, and replace end-of-life distributions.
• MFA belongs on cloud consoles, server access paths such as a VPN or bastion host, admin panels, source code hosting and deployment tools, and on customer accounts where your service holds sensitive customer data.
• Restrict administrative privileges means no shared root or admin logins, separate admin accounts, and at Level Two, privileged access disabled after 12 months unless revalidated. Level Three adds just-in-time administration.
• Application control applies to internet-facing servers from Level Two.
• Regular backups means backups of data, applications and settings that can be restored to a common point in time, tested, and protected from deletion by ordinary accounts.
• Restrict Microsoft Office macros and user application hardening mostly concern your staff's computers, not your servers, but those computers are often how attackers reach the servers.

Level Two also expects event logs from internet-facing servers to be protected and analysed in a timely manner, and a cyber security incident response plan to be enacted when an incident is identified. The Essential Eight does not test your application code itself; our web application security checklist covers that layer, and our Linux server hardening checklist covers the operating system.

A 90-day starter plan#

A small team can make real progress in a quarter.

1. Weeks 1 to 2: know what you have. List devices, servers, internet-facing services, cloud accounts and every account with admin rights.
2. Weeks 3 to 4: turn on MFA. Start with email, cloud consoles, admin panels, source code hosting and anything holding sensitive data.
3. Weeks 5 to 8: fix patching. Automate operating system and application updates, set up vulnerability scanning, and retire anything unsupported.
4. Weeks 9 to 10: separate admin rights. Create dedicated admin accounts and remove admin rights from everyday accounts.
5. Weeks 11 to 12: prove your backups. Automate backups, protect them from deletion, and restore a real system from them. Our guide to backups that actually restore covers the detail.
6. Week 13: harden and plan. Block internet macros and browser risks on staff computers, record your exceptions, and choose a target maturity level for the next year.

Do you need Essential Eight certification?#

According to the maturity model, there is no requirement for independent certification of an organisation's Essential Eight implementation. An assessment may be needed if a government directive or policy, a regulator or a contract requires it, and ASD says assessments should follow its Essential Eight assessment process guide.

Be cautious of any product that claims to deliver a maturity level on its own. Maturity describes how your whole environment is configured and run, not a single tool.

What is changing: the new Essentials series#

On 15 June 2026, ASD announced it was consulting on the evolution of the Essential Eight with its Cyber Security Network partners. The proposal introduces a new Essentials series grounded in the Information Security Manual, with the evolution of the current guidance forming its first chapter, Essentials for enterprise IT. The consultation ran until 12 July 2026.

Until ASD publishes something new, the November 2023 maturity model is the current version. Organisations already using the Essential Eight can expect strong alignment with their existing controls, according to ASD, so the basics above are worth doing now.

Where Inventure fits#

We do not claim any Essential Eight maturity level for Inventure, and we will not claim one for your systems. What we can do is run the server side well. Our managed hosting and DevOps work covers several of these controls for the servers we manage: hardening and firewalls, patching, monitoring, off-server backups with restore tests, and incident response, depending on the management level you choose. If a breach does happen, our data breach response plan guide covers the first hours, days and 30 days.

What to do next#

If you want help with the server side, such as patching, MFA on admin access and restore-tested backups, see our security and DevSecOps service or our backup and disaster recovery service.