Frameworks
The Essential Eight, explained
The ASD's eight strategies to mitigate cyber security incidents.
The Essential Eight is the Australian Signals Directorate's baseline set of eight mitigation strategies. It is the most widely referenced cyber security framework in Australia, and it is written up to a maturity model with four levels.
This page covers the eight strategies, what the maturity levels mean, who has to meet them, and where ORCA Opti helps you see and evidence your posture in Microsoft 365.
What the Essential Eight is
The Essential Eight, sometimes written Essential 8, is drawn from the ASD's Strategies to Mitigate Cyber Security Incidents. It distils a much longer list down to eight controls that, together, prevent or limit the impact of the most common attacks.
The eight are: application control, patch applications, configure Microsoft Office macro settings, user application hardening, restrict administrative privileges, patch operating systems, multi-factor authentication, and regular backups.
Each is assessed against a maturity model with four levels, Maturity Level Zero through Three. The level you should target is based on the threat you face, not on ambition, and ASD's guidance is to implement all eight together at a consistent level rather than one to a high level and the rest not at all.
Who needs the Essential Eight
You are most likely to be asked for it if:
- You are a non-corporate Commonwealth entity, where the Essential Eight is mandated under the Protective Security Policy Framework.
- You bid for government work or defence contracts, where a maturity level is increasingly written into requirements, including through the Defence Industry Security Programme.
- You are a business that wants a recognised, practical baseline to measure your cyber posture against, without adopting a full management-system standard.
- Your insurer or a larger customer asks where you sit against it.
Need to know your Essential Eight maturity? See where your Microsoft 365 stands on a walkthrough, or start monitoring it free from today.
The eight strategies
Grouped by what they defend against, in ASD's own framing:
Prevent malware running
Application control, patch applications, configure Microsoft Office macro settings, and user application hardening. Together these shut down the most common ways malicious code executes.
Limit the extent of incidents
Restrict administrative privileges, patch operating systems, and multi-factor authentication. If something does get in, these contain how far it can reach.
Recover data and availability
Regular backups, tested, so an incident is a recovery exercise rather than a loss. ASD is specific that backups must be restorable, not merely taken.
A maturity level, evidenced
Maturity is assessed per strategy against defined criteria. The useful question is not whether you do these things but whether you can show the level you are at, with evidence rather than assertion.
Where ORCA Opti helps
Several of the Essential Eight are configuration and process controls in the Microsoft environment you already run. ORCA does not deploy them for you, but it does tell you where you stand and keep a dated record of it.
Automated checks against your Microsoft 365 environment for the strategies that live there, multi-factor authentication coverage, administrator privilege ratios, patch status signals and hardening settings, each on a schedule and each written back as dated evidence. Your posture stops being something you believe and becomes something you can show, with the trend over time visible.
Holds the maturity assessment as a record, tracks the gaps you have accepted or scheduled, and raises the review task so your assessed level does not quietly drift out of date between reports.
What stays yours. Application control and backups are largely deployed and run in your endpoint and backup tooling. ORCA records their status and your maturity against the model rather than performing those controls itself.
Common questions
See where you stand
Book a walkthrough and we will show you ORCA Opti against the framework you are working to, or start free with the Microsoft 365 or Google Workspace account you already have.
Join our mailing list
News and updates from ORCA Opti.