The Australian Government standard
What is the Essential Eight?
The Essential Eight is the Australian Government's baseline cyber security framework — eight practical mitigation strategies published by the Australian Signals Directorate (ASD) that, implemented together, stop the large majority of cyber attacks Australian businesses actually face. Progress is measured in three maturity levels.
The eight controls, explained
The framework is deliberately practical: each control blocks a real attack path. In the Australian Signals Directorate's own grouping:
1Application control
Only trusted, approved software is allowed to run on your computers. If ransomware or an unknown program tries to execute, it's blocked by default — the single most effective control against malware. Otaris implements this with tools like ThreatLocker.
2Patch applications
Programs like browsers, Office and PDF readers are updated promptly so known security holes get closed before attackers exploit them. Higher maturity levels shorten the deadline: critical vulnerabilities patched within 48 hours.
3Configure Microsoft Office macro settings
Macros — the hidden code inside Office documents that attackers use to deliver malware — are blocked for users who don't need them, and only allowed from trusted, vetted sources for those who do.
4User application hardening
Risky features nobody needs — like Internet Explorer 11, Java in the browser and web advertisements — are disabled or removed, shrinking the attack surface your team exposes every day.
5Restrict administrative privileges
Admin accounts are limited, separated from everyday accounts, and re-validated regularly — so one phished password can't hand an attacker the keys to your whole environment.
6Patch operating systems
Windows and other operating systems are kept current with the latest security fixes, and unsupported operating systems are replaced — old, unpatched systems are the easiest way in.
7Multi-factor authentication
A second check at sign-in (an app prompt or security key) so a stolen password alone isn't enough. MFA stops the overwhelming majority of account-takeover attacks and is required for remote access, email and important systems.
8Regular backups
Recent, tested copies of your important data, kept where ransomware can't reach them — with restores actually rehearsed, so recovery is a procedure rather than a hope.
The full framework is public — read the standard on cyber.gov.au.
The three maturity levels
The Essential Eight is measured against a maturity model: the same eight controls, implemented progressively more rigorously depending on who you need to keep out.
Maturity Level 1
The baseline for most Australian businesses.
Protects against opportunistic attackers using widely-available tools — the commodity phishing and malware campaigns that catch most businesses out. All eight controls implemented to the Level 1 specification.
Maturity Level 2
For businesses adversaries deliberately target.
Defends against attackers willing to invest real time and effort in you specifically — tighter patching deadlines, stronger MFA, more logging. The level commonly expected for government and defence-adjacent work.
Maturity Level 3
The highest level.
Built to withstand determined, well-resourced and adaptive attackers. The strictest implementation of all eight controls, for organisations that cannot afford 'almost'.
Every Otaris managed IT plan implements the Essential Eight — Fortress ($139/user/month) delivers full Maturity Level 1, Knox ($179) Level 2, and Titan ($199) Level 3. To see where your business stands today, start with the free Essential Eight Cyber Security Scorecard, or read our deeper dive on the maturity levels.
Frequently asked questions
Find out your Essential Eight maturity level.
Book your free Essential Eight Cyber Security Scorecard and we'll score your business against the Australian Government's framework — a clear maturity level and a prioritised fix list, in plain English. No jargon, no obligation.
- A plain-English Essential Eight Cyber Security Scorecard
- Your current maturity level across all eight controls
- A prioritised, costed path to the level you need