Reviewed by
Founder & CTO
Dale reviews strategy, cyber resilience and high-trust technology content for clarity and technical accuracy.
Essential Eight Assessment, Uplift and Management
The Essential Eight is a set of eight cyber security mitigation strategies published by the Australian Signals Directorate (ASD). It covers patching, multi-factor authentication, admin privileges, application control, Office macros, application hardening and backups. Each strategy is measured against a maturity model, from Maturity Level Zero to Three, based on how capable an attacker it is built to stop.
Microsolve assesses where you are today, sets a realistic target level, implements the controls without disrupting your people, and keeps them at that level as your systems and ASD's guidance change.
Is the Essential Eight still current?
Yes, and it is changing. The November 2023 maturity model is the version organisations are assessed against today. In June 2026 ASD opened consultation on a broader Essentials series, starting with Essentials for enterprise IT, and signalled a transition of around two years in which both will run side by side.
ASD has said the investment you make in the Essential Eight will remain relevant. The practical advice is to keep improving the controls now and avoid tying your whole program to a framework name. Read what ASD's Essentials series means for you.
87,400+
Cybercrime reports to ASD in 2025-25 (one every 6 minutes)
1,200+
Cyber security Incidents responded to
$56,600
Average cost per Cybercrime report (Small Business)
$97,200
Average Cost per Cybercrime report (Medium Business)
Source: ASD Annual Cyber Threat Report 2024-25. Self-reported costs, per cybercrime report.
The Eight Mitigation Strategies
ASD selected these eight from its wider Strategies to mitigate cyber security incidents because, together, they stop most common attacks, limit the damage when something gets through, and make recovery possible. They are designed to work as a set, which is why maturity is measured across all eight.
Patch Applications
Close known vulnerabilities in browsers, Office, PDF readers, email clients and online services before attackers use them.
Patch Operating Systems
Keep Windows, servers and network devices on supported versions with security updates applied on a defined timeframe.
Multi-factor Authentication
Stop stolen or guessed passwords from being enough. Phishing-resistant methods such as passkeys are required from Level Two.
Restrict Administrative Privileges
Keep admin rights separate, limited and reviewed, so a compromised user account cannot take over the environment.
Application control
Allow only approved software, scripts and installers to run, so malicious programs cannot execute even if delivered.
Restrict Microsoft Office macros
Block macros from the internet and from users without a business need, removing one of the oldest malware delivery routes.
User application hardening
Configure browsers, Office and PDF software so they cannot be used to launch or inject malicious code.
Regular backups
Back up data, applications and settings, protect the backups from deletion, and prove you can restore them.
Essential Eight maturity levels explained
| Maturity level | The attacker it is designed to stop | Typically appropriate for |
|---|---|---|
| Maturity Level Zero | Weaknesses in the overall security posture that an opportunistic attacker could exploit. | Starting point - the gap an assessment measures from. |
| Maturity Level One | Attackers using commodity, publicly available tools and stolen, reused or guessed credentials, looking for any victim with a common weakness. | The practical baseline for most Australian small and medium businesses, and the level insurers and clients most often ask about. |
| Maturity Level Two | Attackers willing to invest more time and effort: targeted phishing for credentials, techniques to bypass weak multi-factor authentication, and seeking out privileged accounts. | Required for non-corporate Commonwealth entities. Increasingly expected of government suppliers and organisations holding sensitive health, financial or personal data. |
| Maturity Level Three | Adaptive attackers targeting a specific organisation, exploiting older software and weak logging, stealing authentication tokens and moving laterally while covering their tracks. | Organisations that are likely, high-value targets, such as critical infrastructure and larger government suppliers. |
Essential Eight maturity level comparison
What changes for each strategy as you move from Maturity Level One to Three (each level includes everything in the level before it).
| Mitigation strategy | Maturity Level One | Maturity Level Two | Maturity Level Three |
|---|---|---|---|
| Patch applications | Online services patched within 48 hours if critical or exploited, two weeks otherwise. Office, browsers, email clients, PDF and security software patched within two weeks. Unsupported versions removed. | Adds scanning of all other applications at least fortnightly, with patches applied within one month. | Office, browsers, email, PDF and security software patched within 48 hours if critical or exploited. All unsupported applications removed. |
| Patch operating systems | Internet-facing servers and network devices patched within 48 hours if critical or exploited, two weeks otherwise. Workstations and internal servers within one month. Unsupported operating systems replaced. | Same timeframes and scanning as Maturity Level One. | Workstations and internal servers within 48 hours if critical or exploited. Drivers and firmware scanned and patched. Latest or previous operating system release only. |
| Multi-factor authentication | Required for online services, your own and third-party, that hold sensitive organisational or customer data. | Extended to all privileged and unprivileged users of systems. Must be phishing-resistant. MFA events centrally logged. | Extended to data repositories. Phishing-resistant MFA for customers of online customer services. |
| Restrict administrative privileges | Separate, dedicated privileged accounts and operating environments. Privileged accounts blocked from email and web browsing. | Privileged access revalidated every 12 months and disabled after 45 days of inactivity. Administration through jump servers. Break-glass and service account credentials managed. Privileged events logged. | Secure Admin Workstations and just-in-time administration. Credential Guard, Remote Credential Guard and LSA protection enabled. |
| Application control | On workstations, only approved programs, scripts and installers can run from user profiles and temporary folders. | Extended to internet-facing servers and all file locations. Microsoft's recommended blocklist applied. Rulesets validated at least annually. Events logged. | Extended to internal servers and drivers. Microsoft's vulnerable driver blocklist applied. |
| Restrict Microsoft Office macros | Macros disabled unless there is a business need. Macros from the internet blocked and scanned. Users cannot change macro settings. | Macros blocked from making Win32 API calls. | Only macros that are sandboxed, in a Trusted Location or signed by a trusted publisher can run. Trusted publishers validated annually. |
| User application hardening | Internet Explorer 11 disabled or removed. Browsers do not process Java or web ads. Users cannot change browser security settings. | Browsers, Office and PDF software hardened to ASD and vendor guidance. Office blocked from creating child processes and injecting code. PowerShell and command-line activity logged. | .NET Framework 3.5 and PowerShell 2.0 removed. PowerShell runs in Constrained Language Mode. |
| Regular backups | Data, applications and settings backed up to a common point in time, retained securely and resiliently, with restores tested in disaster recovery exercises. Standard users cannot modify or delete backups. | Privileged accounts, other than backup administrators, cannot access, modify or delete other users' backups. | Users cannot access their own backups. Backup administrators cannot modify or delete backups during the retention period. |
From Maturity Level Two, every strategy also requires security events to be centrally logged, protected from tampering and analysed promptly, with incidents reported to ASD and your incident response plan enacted. At Maturity Level Three that analysis extends to workstations and internal servers. For most organisations this logging requirement is the biggest single step between levels one and two.
Which maturity level do you need?
Maturity Level One is the right first target for most Australian small and medium businesses. It closes the gaps opportunistic attackers rely on, and it is the level cyber insurers, clients and supply chain questionnaires most often ask about.
Maturity Level Two is mandatory for non-corporate Commonwealth entities under the Protective Security Policy Framework, and is increasingly expected of government suppliers and of organisations holding sensitive health, financial or personal information.
Maturity Level Three suits organisations that expect to be specifically targeted. It needs mature logging, monitoring and administrative practices to sustain.
Choosing the level is a risk decision for leadership, not a technical one. If nobody in your organisation owns that decision, a vCISO can take it to the board with the cost and risk of each option.
How Microsolve delivers the Essential Eight
Assess
We assess each strategy against the current maturity model using ASD's Essential Eight assessment process guide, and give you a maturity rating per strategy, backed by evidence rather than a questionnaire.
Plan
We agree a target level with you and sequence the work by risk reduction and disruption. Exceptions and compensating controls are documented, so you can explain any gap to an insurer or auditor.
Uplift
We implement the controls in your Microsoft 365, Intune, Entra ID and server environment, scheduled around your operations, with staff communication and security awareness training where the change affects how people work.
Manage
We keep the controls at the target level through our managed services, with maturity reporting, audit and questionnaire support, and reviews as ASD's guidance changes.
Essential Eight built into our managed services
We don't treat the Essential Eight as a separate project that decays once it's finished. Its controls are built into the way our support services are delivered, so the maturity you reach is the maturity you keep.
| Service | Maturity Level One controls | Maturity Level Two controls |
|---|---|---|
| Desktop and laptop support | Foundation+ | Enterprise |
| Server support | All server support tiers | Enterprise |
| Network management | Foundation+ | Enterprise |
| Identity management | Foundation+ | Enterprise |
Essential Eight and SMB1001
The Essential Eight tells you which technical controls matter most and how far to take them. It does not give you a certificate. SMB1001 certification covers much of the same technical ground, adds the policy, training and incident response around it, and gives you something verifiable to show clients, insurers and tender panels.
| Essential Eight | SMB1001 | |
|---|---|---|
| What it is | A prioritised set of eight technical mitigation strategies with a maturity model | A certifiable cyber security standard for small and medium businesses |
| Published by | Australian Signals Directorate (ASD) | Dynamic Standards International (DSI) |
| Levels | Four: Maturity Level Zero to Three | Five cumulative levels: Bronze, Silver, Gold, Platinum and Diamond |
| Scope | Technical controls on internet-connected IT networks | Technical controls plus policy, staff training, incident response and governance |
| How it is checked | Assessment against the maturity model using ASD's assessment process guide. No certificate is issued. | Bronze to Gold self-assessed with director attestation. Platinum and Diamond independently verified. Certificate issued and renewed annually. |
| Best used for | Deciding which controls to implement and how far to take them | Proving to clients, insurers and tender panels that the controls are in place |
Most of our clients do both: they implement Essential Eight controls and certify through SecureStart, our 36-month program to SMB1001 Gold.
The Essential Eight looks different in each sector.
For healthcare providers, the question is usually how to apply the controls to clinical systems that cannot go offline. For aged care providers, it is how the controls evidence cyber risk management under the strengthened Quality Standards. See SMB1001 versus the Essential Eight for aged care and the scope question boards must ask. For strata management agencies, it is what an owners corporation or insurer will accept.
Microsolve Client Feedback
"Dale has an excellent way of cutting through the noise in IT and translating complex concepts into clear, practical insights. His “keep it simple” approach really stood out when he spoke to over 22 subcontractor partners at our Trusted Partner session on Cyber Security and AI for SMEs. Dale added strong value to the discussion and left attendees with knowledge they could genuinely apply to their businesses."
John Melvin
CEO @ North Building & Construction
“The cyber security session with Microsolve was informative and important for our staff, and a valuable reminder to stay vigilant. It prompted useful internal discussions and gave us practical next steps to work through with our IT provider.”
Leigh Spinks
Director @ PCW Commercial Windows
"Microsolve has been a game-changer for us and our clients in making cyber security and certification achievable ... Getting cyber security certification felt quite overwhelming at first but Dale and his team made it accessible, clear and manageable. They broke down the actions we needed to take into practical steps and explaining things in plain language. I have no reservations in recommending Microsolve."
Marion Di Benedetto
CEO @ Sierra Marketing
Frequently asked questions
What is the Essential Eight?
The Essential Eight is the eight most effective mitigation strategies from ASD's Strategies to mitigate cyber security incidents: patch applications, patch operating systems, multi-factor authentication, restrict administrative privileges, application control, restrict Microsoft Office macros, user application hardening and regular backups. It was designed to protect internet-connected IT networks, and is measured using the Essential Eight maturity model.
What are the Essential Eight maturity levels?
There are four.
-
Maturity Level Zero means weaknesses an opportunistic attacker could exploit.
-
Level One defends against attackers using widely available, commodity tradecraft.
-
Level Two defends against attackers who invest more time and effort, including phishing for credentials and bypassing weak multi-factor authentication.
-
Level Three defends against adaptive attackers who target specific organisations and work to evade detection.
ASD recommends reaching the same level across all eight strategies before moving to the next.
What does Essential Eight Maturity Level 1 require?
At Maturity Level One you:
-
Patch internet-facing services within 48 hours when a vulnerability is critical or exploited (two weeks otherwise), patch common user applications within two weeks, and replace unsupported software.
-
use multi-factor authentication on online services that hold sensitive data, give administrators separate privileged accounts with no email or web access, and restrict what can run from user profile and temporary folders.
-
block macros from the internet, stop browsers processing Java and web ads, and back up data, applications and settings with restores tested as part of disaster recovery exercises.
Is the Essential Eight mandatory in Australia?
Only for some organisations.
The Protective Security Policy Framework requires non-corporate Commonwealth entities to implement Essential Eight Maturity Level Two.
For private businesses it is not a general legal requirement, but it is commonly written into government supply contracts, tender questionnaires and cyber insurance applications.
Some sector regulators expect cyber risk to be managed without naming a framework.
The strengthened Aged Care Quality Standards, for example, require cyber security risk to be managed but do not prescribe the Essential Eight.
Is the Essential Eight being retired?
It is being evolved. In June 2026 ASD opened consultation on a broader Essentials series, starting with Essentials for enterprise IT, and indicated a transition of around two years in which both will run side by side. ASD has said investment in the Essential Eight will remain relevant. Until a replacement is published, the November 2023 maturity model is the current benchmark and assessments against it still stand.
How is the Essential Eight assessed? Can we get certified?
There is no Essential Eight certification. Assessments are run against the maturity model using ASD's Essential Eight assessment process guide, either internally or by an independent assessor, and the result is a maturity rating for each strategy backed by evidence. If you need a certificate you can show a client, insurer or tender panel, SMB1001 is the Australian certification that covers the same technical ground plus governance, policy and training.
Essential Eight or SMB1001: which do we need?
Often both, for different reasons. The Essential Eight tells you which technical controls to implement and how far to take them. SMB1001 certifies that your organisation has those controls and the surrounding policies, training and incident response in place, and gives you a certificate to prove it. Most of our clients implement Essential Eight controls and certify through SMB1001, because the first improves the security posture and the second communicates it.
Does Microsoft 365 Business Premium make us Essential Eight compliant?
No licence makes you compliant on its own.
Business Premium includes the tools for most Maturity Level One controls, including Intune for patching and macro and application settings, Entra ID for multi-factor authentication and conditional access, and Defender for Business.
Those controls still have to be configured, enforced and evidenced.
Backups are a common gap. Microsoft 365 retention is not a backup, so you need a separate backup of mailboxes, SharePoint and OneDrive that you can restore to a common point in time.
How long does Essential Eight uplift take?
It depends on your starting maturity, the number of systems and how much legacy software you run.
Multi-factor authentication, macro settings and backups usually come first because they are quick and reduce the most risk.
Application control and separating administrative accounts usually take longest, because they change how people work.
We set the target level and timeline with you after the assessment, so you know the sequence and cost before any change is made.
Does the Essential Eight apply to cloud, Mac or operational technology?
ASD designed the Essential Eight for internet-connected IT networks, and the controls are written largely around Microsoft Windows environments.
ASD notes the principles can be applied to mobility and operational technology networks, but it was not designed for them and other mitigations may be more appropriate.
The shift to cloud and SaaS is one of the reasons ASD is developing the Essentials series.
Can Microsolve manage the Essential Eight on an ongoing basis?
Yes.
Essential Eight controls are built into our managed services: Maturity Level One controls in the Foundation+ tier and Maturity Level Two controls in the Enterprise tier, across desktops, servers, networks and identity.
That includes monitoring the controls, reporting maturity, supporting audits and insurer questionnaires, and reviewing against ASD guidance as it changes.
Know where you stand on the Essential Eight
An assessment gives you a maturity rating for each strategy, the evidence behind it, and a sequenced plan to your target level. Call 1300 792 492 or book a time below.
