How to Implement the Essential Eight
The ASD Essential Eight is one of the most practical security baselines ever published: eight concrete mitigation strategies and a maturity model that tells you how well you need to do each. This guide walks you through all eight, the Level 1 to 3 model, how to set a realistic target, and how to prioritize and verify the work so the score reflects reality.
In plain words
Implementing the Essential Eight means raising all eight ASD mitigation strategies — application control, app and OS patching, Office macro settings, user application hardening, admin privilege restriction, MFA and backups — to a consistent maturity level, and PlayCISO has a free, browser-based Essential Eight assessment to score and plan it. The maturity model runs from Level 1 (opportunistic attackers) up to Level 3 (adaptive, well-resourced ones).
The core rule is to implement all eight to the same target level together, because attackers take the weakest path. Patching, MFA and admin restriction give the fastest wins; backups are your recovery safety net.
Step by step
- 1
Know the eight mitigation strategies
The Essential Eight, published by the Australian Signals Directorate (ASD), are: application control, patch applications, configure Microsoft Office macro settings, user application hardening, restrict administrative privileges, patch operating systems, multi-factor authentication, and regular backups. They cluster around three goals — prevent attacks, limit the extent of attacks, and recover data and system availability. Read them as a baseline set, not a pick-and-choose menu.
- 2
Understand the maturity model
ASD defines maturity levels (0 through 3). Level 0 means the strategy is not meaningfully in place; Level 1 defends against widely available, opportunistic tradecraft; Level 2 against adversaries willing to invest more effort and use targeted techniques; Level 3 against adaptive, highly capable attackers. The guidance is to implement all eight to the same target level together rather than maxing out one and ignoring others.
- 3
Set a target maturity level
Choose the maturity level that matches your risk and threat exposure — most organizations target Level 1 as a baseline and move toward Level 2 where the data or threat warrants it. Pushing one strategy to Level 3 while others sit at Level 0 provides little real protection because attackers simply use the weakest path. Pick one coherent target and raise all eight toward it.
- 4
Assess your current state honestly
Score each of the eight against the maturity level descriptors using evidence — configuration, logs, and tests — not intentions. A control that exists but is inconsistently applied does not meet the level. Record the specific requirement you miss for each strategy, because the maturity levels are prescriptive and partial credit is not how they are assessed.
- 5
Prioritize the fastest, highest-impact wins
Among the eight, patching applications and operating systems, multi-factor authentication, and restricting administrative privileges tend to deliver large risk reduction relatively quickly and should usually come first. Application control and user application hardening are often more disruptive and take longer to tune. Backups are your recovery safety net and should be in place and tested regardless of the rest.
- 6
Implement, then verify by testing
Roll out each strategy with a clear owner and configuration standard, then prove it works: attempt to run an unapproved executable against application control, test macro restrictions, confirm patch SLAs are met from real data, and restore from backup to validate recovery. The maturity model rewards demonstrable, consistent operation, so treat testing as part of implementation, not an afterthought.
- 7
Maintain and reassess regularly
The Essential Eight is a living baseline — patch windows slip, exceptions accumulate, and new applications appear. Reassess on a regular cadence, keep evidence current, and watch patch timeliness in particular, since ASD tightened the expected windows for the most critical vulnerabilities. Sustained Level 1 across all eight beats a one-time Level 2 that quietly decays.
Score all eight mitigation strategies against Maturity Levels 1 to 3 and get a prioritized plan to raise them together — free, in your browser.
Related
The interactive maturity-scoring and roadmap tool this guide walks through.
NIST CSF assessmentMap the Essential Eight into a broader outcome-based framework.
PCI DSS compliance guideAnother prescriptive control baseline, with a worked assessment approach.
PlayCISO labsHands-on scenarios to practice the trade-offs behind each mitigation strategy.
Frequently asked questions
What are the eight Essential Eight strategies?
They are application control, patch applications, configure Microsoft Office macro settings, user application hardening, restrict administrative privileges, patch operating systems, multi-factor authentication, and regular backups. They were defined by the Australian Signals Directorate and group into preventing attacks, limiting their extent, and recovering data and availability. Together they form a prioritized baseline of mitigations.
What maturity level should we aim for?
Most organizations should target Maturity Level 1 as a baseline and move toward Level 2 where their data sensitivity or threat exposure justifies it. The levels correspond to increasingly capable adversaries — Level 1 opportunistic, Level 2 more targeted, Level 3 adaptive and well-resourced. Choose a single target and raise all eight toward it together rather than maxing one strategy out.
Can we implement just a few of the eight?
You can, but it undermines the model’s logic. The Essential Eight is designed as a package where attackers exploit the weakest link, so a strong control alongside missing ones offers limited protection. ASD’s guidance is explicitly to implement all eight to the same maturity level rather than achieving a high level on some while neglecting others.
Is the Essential Eight mandatory?
It is mandated for Australian federal government entities and widely adopted as a baseline by other organizations, but for most private companies it is a strong recommendation rather than a legal requirement. Many use it voluntarily because it is concrete, prioritized and testable. Check your own sector and contractual obligations, as some require it or map to it.
Which strategies give the quickest wins?
Patching applications and operating systems, enabling multi-factor authentication, and restricting administrative privileges generally deliver large risk reduction relatively fast and are good early targets. Application control and user application hardening tend to be more disruptive and need careful tuning. Regular, tested backups should be in place regardless, since they are your recovery safety net if prevention fails.
How often should we reassess?
Treat it as an ongoing baseline and reassess regularly — at least annually, and after significant changes to your environment. Patch timeliness in particular needs continuous attention because ASD tightened the expected windows for critical vulnerabilities, and exceptions tend to pile up over time. Sustained maturity across all eight is more valuable than a one-time high score that decays.