The Essential Eight Explained: A Practical Compliance Roadmap for Enterprise and Government

The Essential Eight is a set of eight baseline cyber security mitigation strategies published by the Australian Signals Directorate, designed to make it significantly harder and more expensive for an adversary to compromise an organisation. For enterprises and government agencies, it has become the common language of cyber maturity in Australia, and increasingly a baseline expectation written into contracts and supply chain requirements. This guide explains what the Essential Eight actually asks for, how the maturity levels work, and what a realistic path to compliance looks like across a large, complex estate.

What the Essential Eight actually covers

The framework groups eight specific controls around three goals: preventing attacks from succeeding, limiting the damage when one does, and being able to recover. The eight strategies are application control, patching applications, configuring Microsoft Office macro settings, user application hardening, restricting administrative privileges, patching operating systems, multi-factor authentication, and regular backups (Australian Signals Directorate, Essential Eight Maturity Model).

None of these are novel on their own. What makes the Essential Eight useful is that it is a defined, assessable set. An organisation is not free to implement seven of the eight well and ignore the eighth, because maturity is assessed across all of them together. That is deliberate, because the controls reinforce each other. Multi-factor authentication matters far less if administrative privileges are handed out freely, and patching applications quickly is undermined if the operating system underneath is years out of date.

How the maturity levels work

The Essential Eight is measured across four maturity levels, from Level 0 to Level 3. Level 0 indicates weaknesses in an organisation’s overall posture. The three levels above it are aligned to increasing adversary capability:

• Maturity Level One is aimed at adversaries using widely available, opportunistic techniques against any target that presents an opening.
• Maturity Level Two steps up to adversaries willing to invest more time and effort, and to bypass weaker controls such as one time passwords.
• Maturity Level Three is aimed at adaptive, well resourced adversaries, including state sponsored actors, who target a specific organisation deliberately.

Most non-corporate Commonwealth entities are directed to achieve Maturity Level Two. For enterprises and other organisations, the right target is a risk decision rather than a fixed rule. An organisation that holds sensitive data, operates critical infrastructure, or is a plausible target for a capable adversary should be looking at Level Two or Three, chosen on the basis of the threat it actually faces rather than the level that is easiest to reach.

Reaching a maturity level is not a certificate you earn once. It is a state you have to keep proving, month after month, across every system in scope.

Why the hard part is sustaining it, not achieving it

Most large organisations can stand up the eight controls in some form. The genuine difficulty, and the reason so many stall at Level One, is operating them continuously and consistently across a big, messy estate. A single unpatched legacy application, a service account with standing administrative rights, or a backup that has never actually been tested against a real restore can pull an entire assessment down a level.

This is fundamentally an operational discipline problem, not a technology purchase. Consider what each control demands over time. Patching applications and operating systems within the required windows means knowing, at any moment, every asset you run and its current patch state. Restricting administrative privileges means continuously reviewing who holds what access and removing it when it is no longer needed. Regular backups only count if they are tested, and if at least some are kept in a way that ransomware cannot reach. Each of these is a process that has to run reliably forever, not a project that finishes.

This is also why point in time compliance is misleading. An organisation can pass an assessment in one quarter and quietly drift below the line in the next as new systems are added, staff change, and exceptions accumulate. Sustained compliance requires monitoring and governance built into normal operations.

A practical roadmap to compliance

For a large organisation starting seriously, the sequence matters more than speed.

1. Assess honestly against every control. Establish your true current maturity for all eight strategies, including the uncomfortable gaps. An assessment that overstates your position simply moves the reckoning to the next incident.
2. Set the target level from risk, then confirm any mandate. Decide the maturity level your threat profile justifies, and check it against any obligations that already apply to you as a government entity or regulated supplier.
3. Close gaps in priority order. Fix the controls that most reduce real risk first, rather than trying to lift all eight simultaneously. Multi-factor authentication, restricting administrative privileges and tested backups usually deliver the fastest reduction in exposure.
4. Instrument the controls so maturity is visible continuously. Put monitoring and reporting in place so you can see drift the week it happens, not at the next annual review.
5. Govern it as business as usual. Assign clear ownership for each control and fold Essential Eight maturity into normal operational and board reporting.

Done this way, the Essential Eight stops being a compliance exercise and becomes what it was intended to be: a measurable, defensible baseline that genuinely raises the cost of attacking your organisation.

Where Jaykan fits

Jaykan helps enterprises and government agencies assess their current Essential Eight maturity, close the gaps in the right order, and then sustain compliance through 24/7 monitoring and managed security operations. Because we run the controls day to day, not just stand them up, we keep organisations at their target maturity level rather than letting it drift between audits.

If you want a clear, honest picture of where you sit today, a complimentary, senior led assessment will benchmark your posture against the Essential Eight and ISO 27001 and give you a prioritised roadmap to close the gaps.

Frequently asked questions

What are the eight strategies in the Essential Eight?

Application control, patching applications, configuring Microsoft Office macro settings, user application hardening, restricting administrative privileges, patching operating systems, multi-factor authentication, and regular backups. They are grouped around preventing attacks, limiting their impact, and recovering data.

What maturity level does my organisation need?

The Australian Signals Directorate defines four levels, from Level 0 to Level 3. Most non-corporate Commonwealth entities are directed to achieve Maturity Level Two. Regulated enterprises and organisations facing more capable adversaries often target Level Two or Three based on a risk assessment rather than a mandate.

Is the Essential Eight mandatory for private companies?

It is mandated for many Australian government entities, but for most private enterprises it is strongly recommended rather than legally required. Many large organisations adopt it voluntarily because it is a clear, recognised baseline and is increasingly expected in contracts and supply chain assurance.

How long does it take to reach Maturity Level Two?

It varies with the size and state of the estate, but for a large organisation it is typically a programme measured in quarters, not weeks. The controls interact, and reaching a level means every one of the eight meets that level and keeps meeting it.