Essential 8 Compliance

The Essential Eight (often written as Essential 8 or the E8) is a set of eight cyber security mitigation strategies from the Australian Signals Directorate. No law requires it and nobody certifies it. Insurers, government buyers and enterprise customers still ask Australian businesses where they sit against it. In June 2026 ASD opened consultation on a new Essentials series to replace it, with a switchover ASD expects to take around two years. This page covers the eight controls and how each works on Microsoft 365, the maturity levels, what an assessment involves, what is changing, and how Elscomm prepares a business for it.

Essential Eight in numbers

• 8 mitigation strategies to prevent, limit and recover from attacks
• 4 maturity levels, from Level 0 to Level 3
• 0 official certifications. ASD publishes the model and certifies no one
• 2028 retirement target ASD has given, with the Essentials series taking over

At a glance

• The Essential Eight is ASD's baseline set of eight cyber security controls.
• Each control is graded on a maturity model from Level 0 to Level 3.
• There is no official certification. An assessment gives you documented evidence of where you sit.
• Federal government agencies must meet it at Maturity Level 2, and some state governments require it of their own agencies.
• ASD plans to retire it around mid 2028. Work done now carries across to the Essentials series.

What is the Essential 8? ASD, ACSC and the E8 explained

The Essential 8 is ASD's prioritised list of eight baseline mitigation strategies. It is guidance, with no certification, standard or legislation behind it. Put the eight controls in place and the most common attacks get much harder and more expensive to pull off.

You will see it written as the ASD Essential Eight, Essential 8 ACSC, Essential Eight ACSC and the E8. All of these name the same framework. ASD is the agency. The Australian Cyber Security Centre sits inside ASD and publishes the guidance on cyber.gov.au.

The Essential 8 controls, and how each one applies on Microsoft 365

ASD groups the Essential Eight controls into strategies to prevent attacks, limit the damage and help you recover. Protection depends on all eight working together.

1. Essential 8 application control

Stops unapproved programs, scripts and installers from running. Only software on an approved list runs. Microsoft 365 businesses usually manage this through Intune and Windows application control policies.

2. Patch applications

Office, web browsers, email clients, PDF software and security products get patched within two weeks of release. Internet-facing online services get patched within 48 hours when a vulnerability is rated critical or a working exploit exists, and within two weeks otherwise.

3. Essential 8 macros: Microsoft Office macro settings

Disables macros for staff without a business need, blocks macros in files from the internet and stops users changing macro security settings. On Microsoft 365 this is a policy setting, with nothing extra to buy.

4. User application hardening

Web browsers stop processing Java and web ads from the internet, Internet Explorer 11 is disabled or removed, and users lose the ability to change browser security settings. At Maturity Level 2 the hardening extends to Office and PDF software.

5. Restrict administrative privileges

Admins get a dedicated account for admin work only, and admin accounts are blocked from the internet, email and web. In Microsoft 365 this means separate admin accounts, with no global admin rights on anyone's everyday login.

6. Patch operating systems

Internet-facing servers get operating system patches within 48 hours when a vulnerability is rated critical or a working exploit exists, and within two weeks otherwise. Workstations get them within one month. Any operating system the vendor no longer supports gets replaced.

7. Multi-factor authentication

Enforces MFA on online services holding sensitive data, including third-party services. From Maturity Level 2, MFA must be phishing-resistant, which rules out SMS codes and one-time passcodes.

8. Regular backups

Backs up data, applications and settings, keeps the copies secure and resilient, and tests restores during disaster recovery exercises. Staff accounts cannot change or delete backups. Microsoft 365 retention settings and recycle bins do something different, so meeting this control needs a separate backup with a tested restore.

The Essential 8 maturity model, Levels 0 to 3

The Essential Eight maturity model grades each of the eight controls on four levels. Each level is defined by the attacker it is built to stop.

Essential 8 Maturity Level 0 (ML0)

The control has weaknesses the attacks described at Level 1 would exploit.

Essential 8 Maturity Level 1 (ML1)

Opportunistic attackers are the target here. They use widely available tools, such as a public exploit for an unpatched service, or passwords stolen, reused or guessed. Essential 8 Level 1 is the baseline, and the right starting point for most businesses of 15 to 70 staff.

Essential 8 Maturity Level 2 (ML2)

This level assumes an attacker willing to spend more time on you, phishing for credentials and working around weak multi-factor authentication. Government panels and larger customers most often name Essential 8 ML2.

Essential 8 Maturity Level 3 (ML3)

Adaptive attackers who pick a specific organisation. They exploit older software and weak logging, and steal authentication tokens to get past stronger MFA.

You will also see it called the ACSC Essential 8 maturity model or the E8 maturity model. Maturity is assessed per control, and your overall level is the lowest level reached across all eight. ASD also recommends lifting all eight controls to a level together before pushing any one higher.

Essential 8 Maturity Level 2 (ML2) requirements

Essential 8 Maturity Level 2 is the second of three maturity levels in ASD's Essential Eight model. It is built to stop attackers who spend more time and effort on a target: phishing for credentials, working around weak multi-factor authentication and using admin accounts to move through a network. Maturity Level 2 is also the level federal government agencies must meet, and the level government panels and larger customers most often name.

Who needs Essential 8 Maturity Level 2?

• Non-corporate Commonwealth entities, under the Protective Security Policy Framework
• Suppliers on government panels or contracts naming ML2
• Businesses whose enterprise customers or cyber insurer ask for ML2
• Businesses holding sensitive client data who want protection beyond the Level 1 baseline

What Maturity Level 2 adds to Level 1

The three biggest changes at ML2

• Phishing-resistant MFA for everyone. SMS codes and authenticator one-time codes no longer qualify. Staff move to passkeys, FIDO2 security keys or Windows Hello for Business.
• Central logging. MFA events, admin activity, and PowerShell and command-line activity are collected centrally, so suspicious activity can be found and investigated.
• Tighter admin access. Admin rights expire after 12 months unless revalidated, or after 45 days unused, and admin work runs through dedicated systems.

How to reach Essential 8 ML2 on Microsoft 365

1. Get to Level 1 across all eight controls first. ASD recommends lifting all eight together, and your overall level is the lowest level you reach.
2. Roll out phishing-resistant MFA. This is usually the longest step, because every staff member and device changes how they sign in.
3. Switch on central logging for sign-ins, admin activity and scripts.
4. Tighten admin access with access expiry and dedicated admin workstations or jump servers.
5. Extend patching and hardening to fortnightly scanning, Office and PDF hardening, and macro restrictions.
6. Assess and document where each control now sits, with dated evidence for your insurer or customer.

How long does Essential 8 ML2 take?

It depends on where you start. A business already at Level 1 across all eight controls has a shorter path than one starting from scratch. Phishing-resistant MFA and central logging usually take the longest, because they touch every user and device. An assessment gives you a realistic timeline before you commit.

Essential 8 compliance: do you have to comply?

No, not legally. No Australian law requires a private company to implement the Essential Eight. Essential Eight compliance is mandatory for non-corporate Commonwealth entities under the Protective Security Policy Framework, which sets it at Maturity Level 2.

For private businesses, Essential 8 cyber security comes down to commerce. Cyber insurers ask about the same controls at renewal. Some government panels write Essential 8 maturity levels into their conditions. Enterprise customers send supplier questionnaires built around the Essential 8 controls. Skip it and you break no law, but you risk losing cover or contracts.

Is there an Essential 8 certification?

No. There is no official Essential Eight certification and no accredited certification body. ASD neither certifies organisations nor licenses assessors. An assessment against the maturity model is the closest thing, and it produces documented evidence of where you sit on each control. Insurers and buyers want this evidence, dated. For something formally certifiable, look at SMB1001, which has tiered certification and often suits a business of 15 to 70 staff better as a first step.

Essential 8 audit: what an Essential Eight assessment involves

An Essential Eight audit measures where you sit against each of the eight controls and records the evidence behind each grade. The uplift is a separate project, the one moving you up. A typical Essential Eight assessment runs in this order:

• Scope: agree which systems, devices and accounts are in scope, and your target maturity level.
• Evidence: collect configuration evidence from Microsoft 365, devices, backups and admin accounts.
• Grade: assess each of the eight controls against the maturity model.
• Report: document where you sit on each control and what is missing.
• Roadmap: set the order for closing gaps, starting with the controls stopping the most attacks.

Essential Eight assessment for SMEs

A smaller business means a much smaller scope than an enterprise assessment. Expect one Microsoft 365 tenant, one fleet of laptops and often no on-premises servers.

Replacing the Essential Eight: what is changing

In June 2026 ASD opened consultation on replacing the Essential Eight with a broader body of guidance called the Essentials series. Essentials for enterprise IT is the first chapter. Until retirement, the Essential Eight stays current guidance, and insurers, government buyers and enterprise customers will keep asking about it.

• June 2026: ASD opens consultation on the Essentials series.
• 12 July 2026: consultation on Essentials for enterprise IT closes.
• Not yet confirmed: the final Essentials for enterprise IT is published.
• Around mid 2027 (target): the Essential Eight begins to be deprecated.
• Around mid 2028 (target): the Essential Eight is retired.

ASD gave these as approximate timeframes when it opened consultation, and calls them targets. The new series is built around security outcomes and threat-informed priorities, with no fixed compliance ladder. Enterprise IT (including identity and SaaS) is the first chapter, with cloud and operational technology chapters planned. ASD says the new guidance aligns with existing Essential Eight controls. Nobody knows yet whether Maturity Levels 1 to 3 survive in the final document. Multi-factor authentication, patching, backups, restricted admin access and application control all stay.

Partway through an Essential Eight uplift? What to do now

Keep going. ASD says the new guidance aligns with the current controls, so your work carries across. Pausing for the final document leaves the same gaps open for another year or more. Finish MFA, patching and tested backups first, since they stop the most attacks. Keep your evidence dated and current. Hold off on deep investment tied to a specific maturity setting until ASD confirms how levels will work, unless a contract demands it now.

Essential Eight support: how Elscomm prepares you

Elscomm does not apply the Essential Eight to every client by default. We run Essential Eight assessment and uplift for businesses who need it, usually after an insurer, a government panel or a customer has asked. The work runs in four steps:

• Assess where you sit against each of the eight controls on your Microsoft 365 setup, devices and backups.
• Prioritise the gaps, starting with MFA, patching and backups, because they stop the most attacks.
• Close the gaps, from admin accounts and macro settings to application control and phishing-resistant MFA.
• Keep the evidence current, so insurers and buyers get dated proof, and carry the work across to the Essentials series.

Talk to us about an Essential Eight assessment.

Essential Eight vs SMB1001

Both come up when an insurer or customer asks about your security, and the controls overlap heavily.

Multi-factor authentication, patching, backups and restricted admin access appear in both, so most of the work counts twice. Read more about SMB1001 certification.

ACSC Essential Eight to ISM mapping

The Information Security Manual is ASD's full control catalogue. The Essential Eight is a prioritised subset, and each control traces back to specific ISM controls. Government and regulated buyers use this mapping when they ask for both, and it lets your Essential Eight evidence carry over to ISM questions. ASD says the Essentials series will also be grounded in the ISM.

Essential Eight questions answered

What are the Essential 8?

Eight baseline cyber security controls from the Australian Signals Directorate: application control, patching applications, Microsoft Office macro settings, user application hardening, restricting admin privileges, patching operating systems, multi-factor authentication and regular backups.

Is the Essential Eight being replaced?

Yes. In June 2026 ASD opened consultation on a broader Essentials series, starting with Essentials for enterprise IT. ASD expects to begin deprecating the Essential Eight around mid 2027 and retire it around mid 2028, and calls both dates targets. Existing Essential Eight work carries across.

Does the Essential Eight still matter if it is being replaced?

Yes. It stays current guidance until retirement, insurers and buyers still ask about it, and ASD says the new guidance aligns with it. The controls themselves stay.

Does my business have to comply with the Essential Eight?

Not legally. Non-corporate Commonwealth entities must meet it under the Protective Security Policy Framework, and no law requires a private company to adopt it. Cyber insurers, government panels and enterprise customers still ask about it.

Is there an official Essential Eight certification?

No. ASD neither certifies organisations nor licenses assessors. An assessment against the maturity model gives you documented evidence of your maturity level for each control.

What is the difference between Maturity Level 1 and Level 2?

Level 1 stops opportunistic attackers using common tools. Level 2 assumes a more determined attacker who phishes for credentials and works around weak MFA. MFA shows the difference most clearly: Level 2 requires phishing-resistant methods, so SMS codes no longer qualify. Level 2 also adds logging and tighter control of admin access.

What is Essential 8 Maturity Level 2?

The second of three maturity levels in ASD's Essential Eight model, designed to stop attackers who phish for credentials and work around weak MFA. It adds phishing-resistant MFA, central logging and tighter admin access to the Level 1 baseline.

Is Essential 8 Maturity Level 2 mandatory?

Only for non-corporate Commonwealth entities, under the Protective Security Policy Framework. For private businesses it becomes a requirement when a contract, government panel or insurer names it.

Does SMS or authenticator app MFA meet Essential 8 ML2?

No. Maturity Level 2 requires phishing-resistant MFA, such as passkeys, FIDO2 security keys or Windows Hello for Business.

Do we need Maturity Level 1 before Level 2?

Yes, in practice. Each level builds on the one before, and your overall maturity is the lowest level reached across all eight controls.

Which maturity level should we aim for?

Start with whoever is asking. If an insurer, panel or customer names a level, aim for it. Otherwise start with Maturity Level 1 across all eight controls, then move to Level 2 where the risk or a contract calls for it.

Who publishes the Essential Eight?

The Australian Signals Directorate. Its Australian Cyber Security Centre publishes it on cyber.gov.au, which is why you see both ASD and ACSC used.

Do we need the Essential Eight to win government work?

Often, yes. Some federal and state procurement panels ask suppliers to show alignment with the Essential Eight, usually at Maturity Level 1 or 2. The requirement sits in the contract or panel conditions, so it varies by agency.

Does Microsoft 365 back up my data?

Not the way the Essential Eight means. Microsoft protects the platform, and retention policies and recycle bins do not count as backup. Meeting the backup control on Microsoft 365 needs a separate backup covering Exchange, SharePoint, OneDrive and Teams, with a tested restore.

Can Elscomm help us with the Essential Eight?

Yes, on request. We assess where you sit against the eight controls and work through the gaps with you.

Sources: ASD Essential Eight maturity model and ASD consultation on the evolution of the Essential Eight. Last reviewed October 2026.