ACSC Essential Eight: CyberSecurity Guide for Australian Businesses

In today’s cyber world, the question is not if your organisation will face a cyber threat, but when. With an overwhelming array of security advice available online (as well as offline), it is difficult to know where to focus your efforts for the greatest impact. Essential Eight provides you with practical guides for that. It is essentially a prioritised cybersecurity framework developed by the Australian Signals Directorate (ASD).

Essential Eight is like a cybersecurity toolkit designed for office networks. Think of it as a practical rule book built from real-world incidents. It provides effective steps to prevent the majority of cyber attacks.

This blog post breaks down the Essential Eight into simple concepts, explains how to measure your progress, and demystifies the verification process.

What Exactly Are the Essential Eight?
The Essential Eight is a set of eight mitigation strategies designed to protect the organisation’s core internet-connected IT network. It is important to remember that the Essential Eight is a prioritised starting point designed to stop the most common cyber attacks. It was specifically designed for standard office environments (e.g. workstations, servers, email). For specialised systems like industrial machinery (OT) or complex mobile device fleets, alternative strategies might be needed.

Get Jenny’s stories in your inbox

Join Medium for free to get updates from this writer.

Remember me for faster sign in

The framework is built on three key objectives, each containing specific controls:

Image created on MyScript Notes (Formerly known as Nebo)

The Maturity Model:
Implementing these controls is not as simple as ticking the yes or no checkbox. The Essential Eight uses a Maturity Model (Levels 1, 2, & 3) to reflect how robust, consistent, and resilient a company’s security practices are. Furthermore, the levels are cumulative. An organisation should solidly achieve level 1 across all eight controls before it can progress to level 2, and so on. This ensures the company has the ability to build a strong security foundation.

Image created on MyScript Notes (Formerly known as Nebo)

• Maturity Level 0: The controls are weak or non-existent, which is highly vulnerable to exploits.
• Maturity Level 1: There is basic protection against common and widespread cyber threats (e.g. phishing emails with well-known malware)
• Maturity Level 2: There is good protection against more sophisticated and targeted attacks.
• Maturity Level 3: There is an organisation-wide protection that is capable of mitigating complex and stealthy threats.

The Assessment Process:
The Australian Signals Directorate (ASD) provides a clear assessment process guide, which functions like a cybersecurity health check. An independent assessor examines an organisation’s defenses in four stages:

• Stage 1 — Planning: Agreeing on the scope, timeline, and rules of engagement
• Stage 2 — Scoping: Defining exactly which parts of the network are being evaluated and for which maturity level
• Stage 3 — The Core Assessment: This is the hands-on testing phase. The assessor does not just take a person’s word for it, but rather they gather evidence by reviewing and testing each of the eight security strategies. The quality of this evidence is key:
  - Excellent: Actively testing a control
  - Good: Reviewing live system’s security configurations
  - Fair: Reviewing reports or screenshots of the configurations
  - Poor: Relying only on policy documents or verbal statements (like interviews which is considered less reliable)
• After testing, each control gets one of these official ratings:
  - Effective: The control works well
  - Alternate Control: An equally strong different control is in place
  - Ineffective: The control is not working adequately
  - Not Implemented: The control is not in use

The assessor tests each control against the organisation’s target Maturity Level and gives a final rating. To pass a level, all eight controls must be rated “Effective” or have an approved and equivalent “Alternate Control”

• Stage 4 — Reporting: Receiving a detailed report outlining the organisation’s security posture (readiness to prevent, detect, and respond to cyber threats) and any gaps (weaknesses).
  One critical concept here is the “formal exception process”. If a control cannot be implemented (example: an old server that can no longer be patched), one can’t simply ignore it. The person responsible must document a formal exception, implement strong compensating controls (such as isolating that server in an expected timeline), and have the risk approved by management. By simply “accepting the risk” without this process will cause an assessment to fail.

Why Essential Eight Matters
Implementing the Essential Eight is about building confidence and resilience.

• Focus on Resources: It cuts through the noise, directing time and budget to the controls that matter the most.
• Measure Progress: The maturity model provides a clear roadmap for continuous improvement.
• Demonstrate Due Diligence: It shows stakeholders, clients, and regulators that the organisation is taking cybersecurity seriously.

Bottom line: The Essential Eight is a prioritised starting point designed to stop the most common cyber attacks. For comprehensive protection, organisations typically integrate it into broader frameworks like the Australian Cyber Security Centre’s (ACSC) Cybersecurity Framework (ASD CSF) or international standards like ISO 27001.

References:

• https://www.cyber.gov.au/business-government/asds-cyber-security-frameworks/essential-eight/essential-eight-explained
• https://www.cyber.gov.au/business-government/asds-cyber-security-frameworks/essential-eight/essential-eight-maturity-model
• https://www.cyber.gov.au/business-government/asds-cyber-security-frameworks/essential-eight/essential-eight-assessment-process-guide