Essential Eight (Australia)

The Essential Eight is the list of eight mitigation strategies that the Australian Signals Directorate (ASD), through its Australian Cyber Security Centre (ACSC), recommends to organizations to counter common intrusions on a Windows estate. The eight: application control, patching applications, configuring Microsoft Office macro settings, user application hardening, restricting administrative privileges, patching operating systems, multi-factor authentication (MFA) and regular backups. The list is drawn from a broader document, the Strategies to Mitigate Cyber Security Incidents, and keeps the measures with the best ratio of cost to effect. The maturity model that goes with it grades each measure from zero to three. Level one targets the opportunistic attacker using public tools, level three a patient adversary willing to invest in the target. For an underwriter the decisive point is elsewhere: the grade is given measure by measure, and ASD asks organizations to reach a level across all eight before aiming for the next. A company that calls itself "level two" while leaving macros open to the whole internet sits at level zero on that measure, and that is the number that counts. Cyber underwriting questionnaires lift several measures almost word for word, well beyond Australia: macros blocked for files coming from outside, admin rights taken away from users. The model also sets patching deadlines by level, shorter for exploited flaws on internet-facing services, and underwriters hold the questionnaire answer against those deadlines. The practitioner's caveat: the framework says nothing about network segmentation, detection or email, and a perfect score leaves those gaps open. It was built for Windows workstations and servers; an estate that runs mostly on cloud or Linux reads poorly against it.