# Essential Eight

> The Essential Eight is a set of eight baseline cybersecurity strategies published by the Australian Signals Directorate to help organizations protect internet-connected IT networks against common cyber threats.

Also called: ASD Essential Eight, ACSC Essential Eight, Essential 8, Essential Eight Maturity Model.

The eight strategies are: patch applications, patch operating systems, multi-factor authentication, restrict administrative privileges, application control, restrict Microsoft Office macros, user application hardening, and regular backups. An accompanying maturity model defines levels from zero to three, each with more demanding requirements. An organization picks a target level suited to its risk and works to reach that level across all eight strategies.

The Essential Eight gives a small business a concrete, prioritized list instead of a vague instruction to improve security. It is not a law for private companies, but Australian government bodies are expected to follow it, and customers, partners, and insurers may ask where a business stands. The guidance was written mainly with Microsoft Windows networks in mind.

The strategies are designed to work as a set, so reaching a high level in one while ignoring another leaves gaps. Application control and macro restrictions take planning to avoid disrupting staff. Cloud-only and Mac-based businesses need to adapt the guidance. We implement the technical measures behind the Essential Eight, such as patching, multi-factor authentication, and backups, but we do not certify or guarantee any maturity level.

## Where we do this work

- [IT services in Australia](https://techpitsolutions.systems/au)
- [Cybersecurity services](https://techpitsolutions.systems/services/cybersecurity)
- [Managed IT services](https://techpitsolutions.systems/msp)

## See also

- [Cyber Essentials](https://techpitsolutions.systems/glossary/cyber-essentials): Cyber Essentials is a UK government-backed certification scheme that sets out five basic technical controls, covering firewalls, secure configuration, security updates, user access control, and malware protection, to guard against common online attacks.
- [Patch management](https://techpitsolutions.systems/glossary/patch-management): Patch management is the process of finding, testing, and installing software updates on computers, servers, and network devices so that known security flaws and bugs are fixed before they cause harm.
- [Multi-factor authentication (MFA)](https://techpitsolutions.systems/glossary/multi-factor-authentication): Multi-factor authentication (MFA) is a sign-in method that requires two or more different kinds of proof, such as a password plus a code from a phone app or a physical security key, before it grants access to an account.
- [Backup vs. disaster recovery](https://techpitsolutions.systems/glossary/backup-vs-disaster-recovery): Backup vs. disaster recovery comes down to scope: a backup is a stored copy of data that can be restored, while disaster recovery is the plan and systems for getting the whole business running again after a major outage.

---

Source: https://techpitsolutions.systems/glossary/essential-eight

TechPit Solutions · Run by AI, backed by real people. A remote team working with businesses in the US, UK, Canada, Australia, New Zealand and Europe. Email info.techpit.co@gmail.com, WhatsApp +92 344 3360585. Book a 15-minute call: https://techpitsolutions.systems/contact