The ASD Essentials, currently known as the Essential Eight, are a baseline set of cyber security mitigation strategies from the Australian Signals Directorate (ASD) and the Australian Cyber Security Centre (ACSC). They describe the most effective, practical steps an organisation can take to become a harder target and to recover faster when something goes wrong.
Who they apply to
Australian government entities are expected to implement the strategies, and local councils are increasingly held to the same standard. Private organisations use them as a sensible security baseline. Reaching a target maturity level is often tied to funding conditions, tenders, cyber insurance and reporting obligations.
The mitigation strategies
The framework is a set of mitigation strategies. Each one has its own plain-English guide:
- Application control
- Patch applications
- Restrict Microsoft Office macros
- User application hardening
- Restrict administrative privileges
- Multi-factor authentication
- Patch operating systems
- Regular backups
The strategies run deeper than they first appear: at Maturity Level One alone they are assessed against 48 individual tests, and more are added at Maturity Levels Two and Three. That is the gap Conformance closes: turning dozens of technical checks into a validated, evidence-backed maturity level.
The maturity levels
Implementation is measured against four maturity levels, so you can see how far along you are and plan the next step:
- Maturity Level 0, not yet aligned, with clear weaknesses remaining
- Maturity Level 1, partly aligned, stopping common and untargeted attacks
- Maturity Level 2, mostly aligned, resisting more capable attackers
- Maturity Level 3, fully aligned, strong against targeted attacks
Your overall position is only as strong as your weakest strategy. Read more about the maturity levels →
The name is changing: Essential Eight becomes ASD Essentials
The framework is evolving, and the long-standing "Essential Eight" name is being phased out in favour of "ASD Essentials". The change is largely a rebrand: the mitigation-strategy and maturity-level approach continues, so the work your organisation does now still counts. We use "ASD Essentials" across this site and keep the familiar "Essential Eight" name alongside it while everyone transitions.
Conformance validates your organisation's maturity against every strategy from the evidence you already produce, shows your level, and tells you the next step to raise it. Book a demo →