[Cyber Security Terms](/glossary) Essential Eight [Blog](/blog)[Breaches](/breaches)[Resources](/resources)[News](/news) [Cyber Security Terms](/glossary) # Essential Eight ##### [Edward Kost](/team/edward-kost) updated Sep 11, 2022 ###### Contents ## The Essential Eight The Essential Eight is a cyber security posture maturity model by the Australian Signals Directorate. The framework aims to help Australian businesses achieve the minimum baseline of cyber security recommended by the Australian government to defend against cyber threats. The Essenital Eight is comprised of eight strategies * Application control; * Patch applications; * Configure Microsoft Office macro settings; * User application hardening; * Restrict administrative privileges; * Patch operating systems; * Multi-factor authentication; and * Regular backups. ## Key takeaways * Though originally published by the Australian Signals Directorate (ASD) in 2010, the Essential Eight was revised by the Australian Cyber Security Centre (ACSC) in July, 2021. * The Essential Eight tracks implementation maturity through four levels of progression, starting from level zero and ending at level three. * Compliance across all eight controls of the Essential EIght is mandatory for all 98 non-corporate Commonwealth entities (NCCEs). * * ###### Reviewed by No items found. ###### Author ##### [Edward Kost](/team/edward-kost) ###### Reviewed by ##### [Kaushik Sen](/team/kaushik-sen) ###### Join 27,000+ cybersecurity newsletter subscribers ## Read more about the Essential Eight Learn more about Essential Eight and the latest issues in cybersecurity. [UpGuard](/blog/how-australian-businesses-can-prepare-for-a-russian-cyberattack) [Australia and the Risk of a Russian Cyber Attack: Are You Ready?](/blog/how-australian-businesses-can-prepare-for-a-russian-cyberattack) #### [Australia and the Risk of a Russian Cyber Attack: Are You Ready?](/blog/how-australian-businesses-can-prepare-for-a-russian-cyberattack) Developing tensions between Russia and Ukraine is increasing Australia's risk of a nation-state cyberattack. Learn how to protect your business. [](/team/edward-kost) [Edward Kost](#) June 25, 2025 [UpGuard](/blog/essential-eight) [Essential Eight Compliance Guide (Updated 2026)](/blog/essential-eight) #### [Essential Eight Compliance Guide (Updated 2026)](/blog/essential-eight) The Australian government is mandating compliance with the Essential Eight framework. Learn about each of the controls and how to achieve compliance. [](/team/edward-kost) [Edward Kost](#) December 28, 2025 [View all blog posts](/blog) ## See UpGuard In Action Book a free, personalized onboarding call with one of our cybersecurity experts. [Contact sales](/demo) [Free demo](/demo) ## More from our blog Learn more about the latest issues in cybersecurity. [UpGuard](/blog/find-out-if-youre-exposed-on-the-dark-web) [Find Out if You're Exposed on the Dark Web](/blog/find-out-if-youre-exposed-on-the-dark-web) #### [Find Out if You're Exposed on the Dark Web](/blog/find-out-if-youre-exposed-on-the-dark-web) Answer 5 quick questions to predict what a dark web scan will find about your company. Then run the free scan to see your real exposure. [](/team/lance-turner) [Lance Turner](#) October 14, 2026 [UpGuard](/blog/upguard-named-leader-in-idc-marketscape) [The Evidence Is In: UpGuard Named a Leader in the IDC MarketScape for Worldwide Third-Party Risk Management](/blog/upguard-named-leader-in-idc-marketscape) #### [The Evidence Is In: UpGuard Named a Leader in the IDC MarketScape for Worldwide Third-Party Risk Management](/blog/upguard-named-leader-in-idc-marketscape) UpGuard has been named a Leader in the IDC MarketScape: Worldwide Third-Party Risk Management Services 2026 Vendor Assessment. Find out why. [](/team/cassy-van-eeden) [Cassy van Eeden](#) October 18, 2026 [UpGuard](/blog/your-first-dark-web-scan-report-explained) [Your First Dark Web Scan Report, Explained](/blog/your-first-dark-web-scan-report-explained) #### [Your First Dark Web Scan Report, Explained](/blog/your-first-dark-web-scan-report-explained) You scanned your domain. What do the results mean? [](/team/lance-turner) [Lance Turner](#) October 11, 2026 [UpGuard](/blog/ai-evidence-analysis-tools-for-tprm) [We Researched Four AI Evidence Analysis Tools for TPRM. Here’s What We Found.](/blog/ai-evidence-analysis-tools-for-tprm) #### [We Researched Four AI Evidence Analysis Tools for TPRM. Here’s What We Found.](/blog/ai-evidence-analysis-tools-for-tprm) We researched four AI evidence-parsing tools against four criteria that security teams often overlook. None nailed all four. [](/team/cassy-van-eeden) [Cassy van Eeden](#) September 29, 2026 [UpGuard](/blog/cybersecurity-horror-stories-2026) [12 Cybersecurity Horror Stories of 2026 (No Costume Required)](/blog/cybersecurity-horror-stories-2026) #### [12 Cybersecurity Horror Stories of 2026 (No Costume Required)](/blog/cybersecurity-horror-stories-2026) A warning ignored once becomes a headline. Read more about these 12 real 2026 cybersecurity incidents, and the sign each one gave before it made the news. [](/team/revashni-moodley) [Revashni Moodley](#) October 14, 2026 [UpGuard](/blog/good-security-rating-your-dark-web-exposure-says-otherwise) [Good Security Rating? Your Dark Web Exposure Says Otherwise](/blog/good-security-rating-your-dark-web-exposure-says-otherwise) #### [Good Security Rating? Your Dark Web Exposure Says Otherwise](/blog/good-security-rating-your-dark-web-exposure-says-otherwise) Scan your domain to see just how exposed you are on the Dark Web. [](/team/lance-turner) [Lance Turner](#) October 11, 2026 [View all blog posts](/blog) ### Sign up for our newsletter UpGuard's monthly newsletter cuts through the noise and brings you what matters most: our breaking research, in-depth analysis of emerging threats, and actionable strategic insights. ##### Free instant security score ## How secure is your organization? Request a free cybersecurity report to discover key risks on your website, email, network, and brand. * Instant insights you can act on immediately * Hundreds of risk factors including email security, SSL, DNS health, open ports and common vulnerabilities [Free score](/instant-security-score)