What Is the ACSC Essential Eight, and How Do You Automate Tracking Your Maturity Level?

Detailed Explanation

The Essential Eight is a baseline set of cyber security mitigation strategies published by the Australian Signals Directorate (ASD). Unlike a certification such as ISO 27001 or SOC 2, there is no external auditor who awards an "Essential Eight certificate". A business assesses itself, or engages an assessor, against ASD's criteria and reports a maturity level for each strategy.

The status changed in October 2026. ASD launched the broader ASD Essentials series as an evolution of the Essential Eight. The first release includes separate chapters for enterprise IT, cloud and operational technology. The Essential Eight still works as a practical baseline, and ASD says prior controls and evidence can be reused, but new assessment and reporting work should account for the transition to Essentials for enterprise IT.

The eight strategies are: patch applications, patch operating systems, multi-factor authentication, restrict administrative privileges, application control (also known as application allow-listing), restrict Microsoft Office macros, user application hardening, and regular backups. Four of the eight are aimed at preventing an attack from succeeding in the first place (patching, MFA, application control, macro restrictions); the rest limit the damage and speed recovery if one does (restricted privileges, hardening, backups).

The Maturity Model scores implementation on a scale from Maturity Level Zero (not yet implemented, or implemented with known weaknesses) through Maturity Level Three (mitigating tradecraft associated with sophisticated, well-resourced adversaries). Each level is defined per-strategy, not as one combined score — a business might sit at Maturity Level Two for patching but Maturity Level One for application control, and the ASD's own guidance is that most organizations should target the level appropriate to the actual threats they realistically face, not automatically chase the highest level across the board.

This is a distinct compliance-automation problem from the site's other own-certification pages. See what does it take to get your own business ISO 27001 certified for a management-system certification that ends in an external auditor's certificate — the Essential Eight has no equivalent external certification step, which changes what "automating compliance" actually means here: there's no audit deadline forcing evidence collection, so the discipline has to come from the business's own tracking process instead.

Setting This Up

1. Record the current Essential Eight position. Assess each strategy separately and preserve the evidence behind the result. Do not reduce the assessment to one combined pass or fail score.
2. Map existing controls into Essentials for enterprise IT. ASD publishes transition guidance showing where Essential Eight work directly satisfies or contributes to the newer principles and actions, and where controls need to expand.
3. Pull live evidence from the tools already enforcing each control. Patch software, identity platforms and backup tools already hold the useful evidence. Feed those records into the assessment rather than recreating them by hand.
4. Alert when evidence falls outside the intended control state. Examples include missed patch windows, failed backups, falling MFA enrolment or an unreviewed exception list.
5. Track the framework and the operating evidence separately. Framework labels can change, as this transition shows. The underlying evidence should remain reusable rather than being locked to one questionnaire or spreadsheet layout.

Things to Consider

• This is a technical baseline, not a governance framework. See what is the NIST Cybersecurity Framework, and does a small business need to adopt it for the broader six-function structure many businesses use alongside the Essential Eight's more concrete, control-level detail.
• Transition timing is still developing. ASD says it will continue working with regulators and organisations on transition arrangements into 2027. Check the current ASD guidance before promising a customer that a particular Essential Eight maturity statement will satisfy a newer Essentials requirement.
• A growing number of contracts and questionnaires now ask for a maturity level directly, not just "do you follow the Essential Eight." Being able to state a specific level per strategy, backed by evidence, is more useful to a prospective enterprise customer or insurer than a general assurance that the framework is "in place."
• The eight strategies aren't equally difficult to automate. Patch compliance, MFA enrolment, and backup success are all naturally logged by the tools enforcing them; application control and macro restriction require more deliberate ongoing maintenance of allow-lists and exceptions, which tends to be where maturity quietly regresses if it isn't actively tracked.
• This is Australian-government-published guidance, which matters for an Australia-only business wanting a locally native reference point rather than adapting a US- or internationally-originated framework as the default.
• A business handling card payments has an overlapping but separate technical baseline to track. See how do you automate PCI-DSS compliance monitoring and self-assessment — several Essential Eight controls (patching, access restriction, backups) support PCI-DSS requirements too, but the two frameworks have different scopes and neither substitutes for the other.

Common Mistakes

• Treating the Essential Eight as one combined pass/fail score instead of eight separately assessed strategies. A business that reports "we're Essential Eight compliant" without naming a maturity level per strategy is making a claim the framework itself doesn't actually support.
• Chasing Maturity Level Three across every strategy by default, when the ASD's own guidance is to target the level that matches realistic threat exposure — over-investing in the highest level everywhere often isn't the best use of a small business's security budget.
• Letting application-control or macro-restriction exceptions accumulate without review. These two strategies degrade quietly and gradually as exceptions pile up, unlike a missed patch or a failed backup, which tend to be more visibly flagged by the tools enforcing them.
• Reassessing maturity only when a customer or contract asks for it. Treating the Essential Eight as a point-in-time exercise rather than an ongoing, evidence-fed tracking process means the reported maturity level is often stale by the time it's actually needed.
• Discarding existing work because the framework evolved. ASD explicitly says organisations can carry their Essential Eight controls and evidence into Essentials for enterprise IT. Map and strengthen that work instead of starting again.