What Is the Essential Eight? A Practical Guide for Brisbane Businesses
The Essential Eight is a set of mitigation strategies from the Australian Cyber Security Centre that helps organisations reduce exposure to common cyber threats.
Reviewed by Connected Platforms | Updated September 2026
What this guide covers
- Eight practical mitigation strategies
- Maturity Levels Zero to Three
- A risk-reduction baseline, not a universal certification
Why the Essential Eight matters
The Australian Cyber Security Centre recommends the Essential Eight as a baseline set of mitigations. It focuses on controls that make common attacks harder, limit the damage of compromised accounts and improve recovery.
It is not a complete risk-management framework and it is not a general certification. Businesses still need to consider legal obligations, contracts, industry requirements, people, processes and risks outside these eight controls.
The eight mitigation strategies
Application control
Allow approved applications to run and prevent unauthorised code from executing.
Patch applications
Apply security updates using timeframes that reflect vulnerability risk and the target maturity level.
Configure Microsoft Office macros
Restrict macros from untrusted sources and tightly control who can create or run trusted macros.
User application hardening
Reduce risky browser, application and document features that attackers can abuse.
Restrict administrative privileges
Limit privileged access, separate administrative work and review access regularly.
Patch operating systems
Keep supported operating systems current and apply security updates according to risk and maturity requirements.
Multi-factor authentication
Require strong MFA for the systems and users covered by the target maturity level.
Regular backups
Protect important data, software and settings, then test restoration so recovery is proven.
Maturity Levels Zero to Three
Maturity Level Zero
The organisation has weaknesses in its overall cyber security posture and may not consistently implement the mitigation strategy.
Maturity Level One
Focuses on protection against common, opportunistic threats.
Maturity Level Two
Raises resistance against more capable and targeted attackers.
Maturity Level Three
Applies stronger controls for organisations facing more sophisticated threats.
Choose a target from risk, not marketing
A maturity target should reflect the sensitivity of your data, the threats you face, contractual requirements and the effect of an outage or breach. Not every organisation needs Maturity Level Three.
- Assess each mitigation separately. Organisations often sit at different levels across the eight.
- Record evidence, exceptions and ownership rather than relying on verbal confirmation.
- Plan changes around operations so controls do not create avoidable disruption.
- Reassess after major technology, staffing or business changes.
Use the current Australian Cyber Security Centre guidance when interpreting control and maturity requirements.
How it compares with other frameworks
Essential Eight
A focused set of technical mitigations with maturity levels. A practical Australian starting point.
SMB1001
A broader tiered standard designed for small and medium businesses, with certification pathways.
ISO 27001
An information security management system standard used where formal, organisation-wide assurance is required.
NIST Cybersecurity Framework
A broad risk-management framework that can suit organisations needing a flexible structure across governance, protection, detection, response and recovery.
Assess your Essential Eight maturity
We can help you map current controls, evidence the gaps and build a practical improvement plan around your business risk.
