Frameworks · Asia-Pacific
Essential Eight
The Essential Eight is the Australian Cyber Security Centre's set of eight baseline mitigation strategies, assessed on a maturity model from Level 0 to Level 3. The November 2023 update tightened patching windows for critical vulnerabilities and moved internet-facing services to weekly vulnerability scanning. It also made multi-factor authentication and secure administration mandatory for privileged access.
Who it applies to
It applies to Australian government entities and the organisations that supply them. It also suits any organisation that adopts the Essential Eight as its baseline or has an Australian customer that asks for a maturity level.
Main requirements
Prevent
The strategies are application control, patching applications, configuring Microsoft Office macro settings and user application hardening.
Limit
The strategies are restricting administrative privileges, patching operating systems and multi-factor authentication.
Recover
Regular backups are made and tested to confirm they can be restored.
Maturity
Each strategy is assessed from Level 0 to 3, and the organisation sets its target level based on risk.
How xmodo supports it
- 1
Each strategy is set up with the requirements for each maturity level. xmodo calculates the level achieved from the status of your controls.
- 2
Patching and scanning schedules are tested continuously through integrations, because these are where Essential Eight maturity is usually lost.
- 3
Requirements map to ISO/IEC 27001 and APRA CPS 234 for regulated Australian entities.
Related frameworks
Essential Eight shares requirements with the frameworks below. Controls you already run for any of them count towards Essential Eight as well.
Frequently asked questions
Which maturity level should we target?
The ACSC expects organisations to set a target level based on their risk profile, and Level 2 is the common target for most. xmodo reports the level achieved for each strategy and the gap to your target.