Essential Eight
What is Essential Eight?
Eight mitigation strategies recommended by the Australian Signals Directorate to protect organisations against cyber threats. The Essential Eight covers application control, patching, macro settings, user application hardening, admin privileges, MFA, backups, and patching operating systems.
Terms that appear alongside essential eight
Each of these is named in at least one of the same controls as essential eight. The number is how many controls name both.
- baseline 4 shared controls
- information security 4 shared controls
- encryption 3 shared controls
- access control 3 shared controls
- security baseline 3 shared controls
- security testing 2 shared controls
- maturity model 2 shared controls
- cybersecurity 2 shared controls
Frameworks that govern essential eight
What the standards actually require on essential eight
Requirements naming essential eight across 6 standards, quoted from the control text.
Requirement 0103 (Part Four: Technology, section 14.2.5 Cyber Security Strategies; applies to All entities; dated 31 October 2024; retained from Release 2025): Application control mitigation strategy is implemented to Maturity Level Two under ASD's Essential E...
protective-security-policy-framework-pspf-release-2026::0103 · 0103 Essential Eight: application control to Maturity Level Two →A responsible entity for an enhanced-class asset must establish and maintain a process or system in its CIRMP to comply with a framework in one of the listed documents as in force from time to time and meet its condition: AS ISO/IEC 27001:2023;
critical-infrastructure-risk-management-program-cirmp-rules-2023::8A(3) · s 8A(3) Enhanced cyber framework: 27001:2023, Essential Eight level two, CSF 2.0, C2M2 v2.1 MIL2 or AESCSF 2023 SP2, or an equivalent →Implement the Australian Signals Directorate's Essential Eight strategies to mitigate targeted cyber incidents, and self-assess maturity using the Essential Eight Maturity Model.
ASIC-CR-PR-1 · Implement the ASD Essential Eight →The entity must demonstrate that it meets or exceeds the ACSC Essential Eight mitigation strategies at Maturity Level 2 across the corporate ICT systems used to correspond with Defence.
DISP-ICT-E8 · Essential Eight Maturity Level 2 on corporate ICT →Windows PowerShell 2.0 is disabled or removed. Required at Maturity Level Three of the User application hardening mitigation strategy (Appendix C); ISM control ISM-1621 in ASD's Essential Eight to ISM mapping (December 2023).
acsc-essential-eight::E8-UAH-ISM-1621 · User application hardening (ISM-1621): Windows PowerShell 2.0 is disabled or removed →For a critical telecommunications asset owned or operated by a carrier, the program must also include a process or system to comply with one of: the Essential Eight Maturity Model at maturity level two;
telecommunications-sector-security-reforms-tssr::TSRMP-11(4) · TSRMP Rules s 11(4) and (5): uplifted cyber framework for carrier assets →Questions people ask about essential eight
What is Essential Eight?
Why is Essential Eight important for compliance?
Which compliance frameworks address Essential Eight?
Where can I learn more about Essential Eight?
See how Essential Eight applies across compliance frameworks
Our platform maps 1,016 frameworks with 316K cross-framework control mappings. Explore how this concept is addressed across standards.