The Australian Government’s baseline cybersecurity framework: eight practical controls that stop the attacks Australian businesses actually face. Epic IT implements, evidences and manages the Essential Eight for organisations across Australia, from offices in Perth, Brisbane and Sydney.
Book a Free Security Assessment
The ASD published the Essential Eight’s replacement, ASD Essentials, on 15 October 2026. The controls on this page still apply wherever a contract, insurer or DISP requires the Essential Eight, and they carry into the new framework as evidence. See our Essential Eight to ASD Essentials mapping.
Mitigation strategies targeting the most common attack paths into Australian businesses
ML0 to ML3, assessed as a package across all eight strategies
Mandatory for federal entities under the PSPF and for every DISP member
Epic IT delivering cybersecurity for Australian businesses from Perth, Brisbane and Sydney
The Essential Eight is a cybersecurity framework developed by the Australian Cyber Security Centre (ACSC), part of the Australian Signals Directorate. It defines eight mitigation strategies that address the most common methods attackers use to compromise systems, steal data and disrupt operations: phishing, unpatched software, stolen credentials, malicious macros and ransomware.
Unlike broad security standards that take months of consulting to interpret, the Essential Eight gives you a clear, structured set of controls. The maturity model defines four levels, Maturity Level Zero to Three, so you can measure progress. The ACSC expects the eight strategies to be implemented as a package: reach the same level across all eight before moving up, rather than running a few controls hard and neglecting the rest.
For businesses managing sensitive client data, regulatory obligations or government contracts, Essential Eight implementation is increasingly expected by insurers, auditors and clients. We assess your current maturity, build a practical roadmap, implement each control properly and keep the evidence current.
If your business is earlier in its cybersecurity journey, our SMB1001 certification service is a simpler starting point that feeds into Essential Eight compliance.
Each control targets a specific attack path. Together they form a strong defence against the cyber incidents that most often hit Australian businesses.
Unpatched applications are one of the most common ways attackers get in. For online services and internet-facing applications, the ACSC requires critical vulnerabilities, and any with a known exploit, to be patched within 48 hours, and everything else within two weeks. Browsers, Office, email clients, PDF software and security products are patched within two weeks, and from ML2 every other application within a month. We manage patching across your whole application estate with automated deployment and compliance reporting.
Unpatched workstations and servers are easy targets for both automated attacks and targeted intrusions. Internet-facing systems follow the same 48-hour rule for critical vulnerabilities, and unsupported operating systems have to be replaced. We manage OS patching across Windows, macOS and server environments with scheduled deployments, testing and rollback capability.
Stolen passwords are involved in the majority of data breaches. Multi-factor authentication adds a second verification step that stops attackers using compromised credentials. We implement MFA across Microsoft 365, VPN, remote access and business applications using phishing-resistant methods, which the ACSC requires for workstation logon from Maturity Level Two.
Admin accounts are the keys to your business. If an attacker compromises one, they have access to everything. We implement least-privilege access, separate admin and user accounts, governance over privileged access to data repositories, and just-in-time access through our access management service.
Application control stops unauthorised software running on your systems, blocking malware, ransomware and unapproved tools even if they get past other defences. We configure application control policies, apply Microsoft’s recommended blocklist and run the annual ruleset reviews the ACSC expects, balancing security with usability for your team.
Malicious macros in Office documents remain a common way to deliver malware. We configure macro policies that block untrusted and internet-sourced macros while keeping legitimate business processes running. Staff who need macros get controlled access; everyone else is protected.
Web browsers, PDF readers and Office applications can be hardened to shrink their attack surface. We disable features attackers exploit, such as Internet Explorer 11, Java from the internet and web advertisements, and from ML2 we harden Office, browsers and PowerShell to ASD guidance with logging switched on.
When everything else fails, backups are your last line of defence. We implement backup for Microsoft 365, on-premises servers and hybrid environments with regular restore testing, and restrict who can change or delete backups so ransomware cannot take them out with everything else.
What Essential Eight compliance looks like in practice for a WA organisation with government contracts on the line.
ABS Institute is a Western Australian training organisation and state government partner. When tighter cybersecurity requirements arrived, it needed DESAE Right Fit for Risk accreditation to keep its government contracts, and it turned to Epic IT, its managed IT provider of seven years.
We designed a programme covering all eight strategies: application control on every endpoint, automated patching within Essential Eight timeframes, macro and application hardening, phishing-resistant MFA for all users and admin access, just-in-time privileged access, Microsoft Defender for Endpoint with 24/7 monitoring, and verified daily backups. ABS Institute achieved its accreditation and kept its government partnership status.
“Our organisation could not meet the contractual and legislative requirements of our clients without engaging a specialist in this field like Epic IT.”
Mark Van Lith, Managing Director, Business Services, ABS Institute
The Essential Eight matters most where sensitive data, government work or regulators are involved.
Many government contracts reference Essential Eight Maturity Level 2, and every DISP member must meet it. We help suppliers meet the bar and keep proving it between reviews.
Patient data protection, Privacy Act obligations and clinical system security. The Essential Eight provides the technical controls behind them.
Client privilege, document security and regulatory compliance. Law firms handling sensitive matters need provable security maturity.
APRA CPS 234 alignment, client data protection and audit readiness. The Essential Eight is the technical foundation for financial compliance.
Student records, staff data and government funding agreements that increasingly name cyber controls. Training providers with state contracts often need provable Essential Eight maturity to keep them.
Corporate networks connected to remote sites, contractors and operational technology. The Essential Eight secures the office side, and ASD Essentials adds a dedicated chapter for site control systems.
Tender requirements, shared project files and site laptops that roam between offices and job sites. Head contractors and government clients increasingly ask for Essential Eight maturity before they award work.
Donor and client records, government grant conditions and lean IT budgets. The Essential Eight gives you a prioritised, affordable baseline that funders recognise.
Trust account payments, tenant identity documents and constant email with buyers and sellers make agencies a favourite target for invoice fraud. MFA, hardening and tested backups close the most common gaps.
The model defines Maturity Level Zero to Three. ML0 simply records that ML1 requirements are not yet met. The ACSC expects a consistent level across all eight strategies before you target the next, and assessments work the same way: ML1 must be demonstrated before an ML2 assessment can begin.
Basic implementation of all eight strategies, protecting against opportunistic, commodity-level attacks. The ACSC’s suggested fit for small to medium enterprises and the right first target for most Australian SMBs, as a stepping stone to ML2. Focuses on fast patching of internet-facing systems, MFA, basic application control and tested backups. See our ML1 requirements guide.
Timeline: 3–6 months | Investment: Typically $10,000–$25,000 for initial assessment and implementation, then ongoing as part of your managed agreement.
Stronger implementation against adversaries with moderate capability. Requires tighter patching timelines, phishing-resistant MFA for workstation logon, centralised logging and more granular access controls. The mandatory baseline for federal entities under the PSPF and for DISP members, and the level most enterprise clients and insurers ask for. See our ML2 implementation guide.
Timeline: 6–12 months from ML1 | Investment: Incremental. Most controls build on ML1 infrastructure.
Advanced implementation designed to resist sophisticated, targeted attacks. Requires active monitoring, automated response and a security operations capability. The ACSC’s suggested fit for critical infrastructure operators and organisations in high threat environments. See our ML3 guide.
Timeline: 12+ months from ML2 | Investment: Significant. Requires dedicated security operations capability.
Published 15 October 2026, ASD Essentials drops maturity levels altogether. Priority phases set the order of work, starting with internet-facing and identity systems, and each action is rated not effective, partially effective or fully effective in each part of your environment. Your maturity rating does not convert, but the controls behind it carry across as evidence. See our Essential Eight to ASD Essentials mapping, or our cloud chapter guide if your business runs entirely on SaaS.
Timeline: No mandatory date set yet | Starting point: Your current maturity rating and the evidence behind it.
Once your Essential Eight maturity is solid, the Further Five add backup validation, security event monitoring, vulnerability scanning, incident response planning and network segmentation. All five are now core actions in ASD Essentials, so the work counts twice.
Our Essential 8 compliance guide covers the full framework and implementation. The maturity guides cover every requirement at ML1, ML2 and ML3. Weighing your options? Read Essential Eight vs SMB1001, and follow the framework change on our Essential Eight to ASD Essentials tracker.
The Essential Eight is a cybersecurity framework developed by the Australian Cyber Security Centre. It defines eight mitigation strategies that defend against the most common cyber threats, including ransomware, phishing and credential theft, with a maturity model from Level Zero to Three. Epic IT implements the Essential Eight in a structured way aligned to your risk profile and obligations.
Yes. The ASD published its replacement, ASD Essentials, on 15 October 2026. Both frameworks stay available during the transition and no mandatory changeover date has been set, so existing Essential Eight obligations still apply. Controls and evidence carry forward, but maturity ratings do not convert, and the ASD advises mapping new uplift to ASD Essentials before starting it. Our transition tracker follows every development.
It is mandatory for federal government entities, with Maturity Level Two as the baseline under the Protective Security Policy Framework, and DISP members must also meet ML2. For other private businesses it is voluntary but increasingly expected by cyber insurers, auditors, enterprise clients and government contracts.
Most Australian SMBs should reach Maturity Level One first and treat it as a stepping stone to Maturity Level Two, which is what government contracts, DISP and most enterprise clients and insurers ask for. Maturity Level Three is for critical infrastructure and high threat environments. If nothing requires the Essential Eight of you, map further uplift to ASD Essentials before committing to it.
For most Australian SMBs, reaching Maturity Level One costs around $10,000 to $25,000 in assessment and implementation work, then becomes part of an ongoing managed agreement. Moving from ML1 to ML2 is incremental because most controls build on ML1. The real figure depends on your environment, which a free gap assessment will show.
A typical Maturity Level One implementation for an Australian SMB takes three to six months, and ML2 usually takes another six to twelve. We start with quick wins that reduce risk immediately while working through the longer-term controls in parallel. Managed services clients get Essential Eight controls maintained as part of their ongoing agreement.
No. The ACSC does not certify Essential Eight implementations at any maturity level. An independent assessment may be required by a government directive, regulator or contract, and assessors follow the ASD’s assessment process guide. If you need certified proof of cyber maturity for clients or insurers, SMB1001 provides formal certification and maps to the Essential Eight.
SMB1001 was built for small and medium businesses and includes controls that align with the Essential Eight, wrapped in a tiered certification. Many businesses start with SMB1001 and progress to the Essential Eight as their maturity grows, or run both: the Essential Eight for technical compliance and SMB1001 for a certificate they can show clients.
Managed Security Services (MSSP)
Transformations
ABS Institute
ABS Institute is a leading Western Australian training organisation and trusted state government partner, delivering professional development and mentoring programmes across the state.
Blackburne
Blackburne is one of Perth’s most recognised property groups, with a portfolio spanning residential development, property management, and commercial real estate across Western Australia.
