Essential Eight Maturity Model: Australian Cyber Strategy

What Is the Essential Eight?

The Essential Eight is a set of prioritised mitigation strategies developed by the Australian Signals Directorate (ASD) to help organisations protect themselves against cyber threats. Originally derived from the broader Strategies to Mitigate Cyber Security Incidents, the Essential Eight focuses on the most effective measures to prevent malware delivery, limit the extent of incidents, and enable data recovery.

Since July 2022, all non-corporate Commonwealth entities in Australia are required to implement the Essential Eight at a minimum maturity level determined by their risk profile.

The Eight Strategies

The Essential Eight strategies are grouped into three objectives:

Preventing Malware Delivery and Execution:

• Application Control: Only approved applications are allowed to execute, blocking malware, scripts, and unauthorised software.
• Patch Applications: Security patches for applications are applied within defined timeframes to close known vulnerabilities.
• Configure Microsoft Office Macro Settings: Macros from the internet are blocked, and only vetted macros are permitted to execute.
• User Application Hardening: Web browsers and other applications are configured to block ads, Java, and Flash content, reducing the attack surface.

Limiting the Extent of Incidents:

• Restrict Administrative Privileges: Admin accounts are tightly controlled, used only for duties requiring elevated access, and regularly revalidated.
• Patch Operating Systems: OS security patches are applied within defined timeframes, and unsupported operating systems are replaced.
• Multi-Factor Authentication (MFA): MFA is implemented for all users accessing internet-facing services, privileged actions, and important data repositories.

Recovering Data and System Availability:

• Regular Backups: Backups of important data, software, and configuration settings are performed, stored securely, and tested regularly.

Understanding the Maturity Model

The Essential Eight Maturity Model defines four maturity levels:

• Maturity Level Zero: Weaknesses exist in the overall cyber security posture.
• Maturity Level One: Partly aligned with the intent of each mitigation strategy. Suitable as a baseline for smaller organisations.
• Maturity Level Two: Mostly aligned with the intent. Targeted by most organisations as a practical balance of security and usability.
• Maturity Level Three: Fully aligned with the intent. Appropriate for organisations facing sophisticated adversaries.

Each level builds on the previous one. Requirements become progressively stricter regarding timeframes, coverage, and automation.

Practical Implementation Steps

To begin implementing the Essential Eight:

1. Conduct a self-assessment against the maturity model using the ASD's assessment guide
2. Identify your target maturity level based on your threat environment and risk appetite
3. Prioritise gaps, focusing on strategies that address your most likely threat scenarios
4. Implement controls progressively, achieving consistency within each maturity level before advancing
5. Automate where possible; manual processes do not scale and introduce errors

Common Challenges

Organisations frequently encounter these challenges:

• Legacy applications that cannot support application control or patching timelines
• Resistance from users to MFA and restricted administrative privileges
• Insufficient tooling to verify compliance across all endpoints
• Patching timeframes that conflict with change management processes

Address these by engaging business stakeholders early, investing in modern endpoint management tools, and building exception processes that require compensating controls.

Measuring and Reporting

Track maturity using the ASD's Essential Eight Assessment Process Guide. Report progress to senior leadership regularly, highlighting both achievements and residual risks. The Essential Eight addresses the most common attack techniques observed by ASD, and consistent implementation at the right maturity level significantly reduces your organisation's cyber risk exposure.