The eight strategies are: patch applications, patch operating systems, multi-factor authentication, restrict administrative privileges, application control, restrict Microsoft Office macros, user application hardening, and regular backups. An accompanying maturity model defines levels from zero to three, each with more demanding requirements. An organization picks a target level suited to its risk and works to reach that level across all eight strategies.
The Essential Eight gives a small business a concrete, prioritized list instead of a vague instruction to improve security. It is not a law for private companies, but Australian government bodies are expected to follow it, and customers, partners, and insurers may ask where a business stands. The guidance was written mainly with Microsoft Windows networks in mind.
The strategies are designed to work as a set, so reaching a high level in one while ignoring another leaves gaps. Application control and macro restrictions take planning to avoid disrupting staff. Cloud-only and Mac-based businesses need to adapt the guidance. We implement the technical measures behind the Essential Eight, such as patching, multi-factor authentication, and backups, but we do not certify or guarantee any maturity level.