Patch applications
Essential Eight mitigation strategy for finding and patching vulnerabilities in online services and applications, and removing unsupported applications, with scanning cadences and patch deadlines at each maturity level.
Essential Eight
The Australian Signals Directorate's Essential Eight: eight mitigation strategies, each defined at Maturity Levels One to Three. The pillar covers what each strategy requires at each level, how it is evidenced, and how it relates to ASD's new Essentials series.
Patch operating systems
Essential Eight mitigation strategy for scanning and patching operating systems, replacing unsupported ones, and at ML3 patching drivers and firmware and running a current operating system release.
Multi-factor authentication
Essential Eight mitigation strategy for multi-factor authentication of staff and customers to online services, then to systems and data repositories, moving to phishing-resistant methods at higher maturity levels.
Restrict administrative privileges
Essential Eight mitigation strategy for validating, limiting, separating and monitoring privileged access, from dedicated admin accounts at ML1 to just-in-time administration and credential protection at ML3.
Application control
Essential Eight mitigation strategy for restricting execution to an organisation-approved set, expanding from workstation user profiles at ML1 to servers, drivers and vendor blocklists at higher levels.
Restrict Microsoft Office macros
Essential Eight mitigation strategy for limiting Microsoft Office macros: disabled by default, blocked from the internet, scanned, and at ML3 only sandboxed, trusted-location or trusted-signed macros may run.
User application hardening
Essential Eight mitigation strategy for hardening web browsers, Microsoft Office, PDF software and PowerShell, from blocking Java and ads at ML1 to removing legacy frameworks and constraining PowerShell at ML3.
Regular backups
Essential Eight mitigation strategy for performing, synchronising, protecting and test-restoring backups, with access and deletion rights narrowing at each maturity level until backups are immutable during retention.
Essential Eight maturity uplift
Planning movement between Essential Eight maturity levels: choosing a target level, what changes from ML1 to ML2 and ML2 to ML3, the logging that ML2 makes central, and the recurring tasks that keep a level once it is reached.
Essential Eight on Microsoft 365 and Windows
Implementing the Essential Eight in Microsoft environments using Microsoft's own guidance: Intune and Microsoft 365 licensing, WDAC and AppLocker, phishing-resistant MFA in Entra ID, Windows Update for Business, Entra PIM and LAPS, and Microsoft 365 backups.
Essential Eight tools and automation
Tools that implement Essential Eight controls and produce assessment evidence, with a focus on open-source and self-hosted options: vulnerability scanning for patch cadences, central logging for ML2, immutable backups for ML3, and GRC tracking with ASD's OSCAL profiles.
Essential Eight consultants and services
Buying help with the Essential Eight: what drives implementation cost, what consultants and managed service providers do, and which work stays with the organization.
Essential Eight guides
Buyer questions about the Essential Eight: what each maturity level demands, how to sequence an implementation, and how the Essential Eight relates to ASD's new Essentials series.
