Free guide
The Essential Eight checklist, in plain English
The Australian Signals Directorate recommends eight baseline controls that make it much harder for attackers to break into a business. Here they are in plain English, with one question to ask yourself about each. No email required.
Work through the eight below and note which ones you can answer confidently. If you’re unsure about three or more, you’re in good company. That’s a normal starting point for a small business, and a useful conversation to have.
Application control
Only approved software can run on your computers.
Ask yourself: Do you know every application installed across your machines, and can you stop staff installing new ones?
Patch applications
Keep everyday software updated, especially anything facing the internet.
Ask yourself: Are browsers, PDF readers and Office updated within two weeks, or within 48 hours when a critical flaw is being exploited?
Configure Microsoft Office macro settings
Block macros from the internet and allow only vetted ones.
Ask yourself: Are Office macros disabled for staff who don’t need them, and blocked in files downloaded from the internet?
User application hardening
Turn off risky browser and application features.
Ask yourself: Have you disabled features you don’t need, like Java and ads in browsers, and blocked risky features in Office and PDF readers?
Restrict administrative privileges
Limit who holds admin rights, and keep admin accounts separate from everyday ones.
Ask yourself: Does anyone do their everyday email and browsing from an account with admin rights? (They shouldn’t.)
Patch operating systems
Keep Windows, macOS and server operating systems current.
Ask yourself: Are your operating systems still supported by the vendor, and patched on a set schedule?
Multi-factor authentication
Require a second factor, especially for email, remote access and admin accounts.
Ask yourself: Is MFA enforced on Microsoft 365, remote access and every privileged account? Not just available, but required?
Regular backups
Back up important data, and test that you can actually restore it.
Ask yourself: When did you last do a test restore, rather than just checking the backup job said it worked?
Essential Eight checklist: what the maturity levels mean
The ASD grades implementation from Maturity Level Zero (not implemented) to Maturity Level Three. Each level is designed to resist progressively more capable attackers. The right level for you depends on your risk profile. It’s a risk-based decision, not a single pass mark every business has to hit.
What’s changing in 2026
ASD is consulting on a broader “Essentials” series that will eventually replace the Essential Eight, with a transition of around two years. Until the new guidance is final, the November 2023 maturity model still applies, and every control on this page carries forward. We explain what that means in practice in the Essential Eight in your IT services.
Important limitations
- The Essential Eight is a baseline, not a guarantee. The ASD is clear that extra controls may be needed depending on your environment and risk.
- There’s no universal “Essential Eight certified” status for businesses. Alignment is assessed against maturity levels, not a certificate you pass once.
- Implementing these controls doesn’t automatically reduce insurance premiums or satisfy any particular legal or contractual obligation. Check your own policy and contracts.
- This page is a simplified summary prepared by Austechnova for general guidance. For authoritative, current detail, refer to the ASD at cyber.gov.au.
Second opinion
Want an honest read on where you stand?
We’ll walk through all eight with you and tell you what it would take to close the gaps. Free, with no obligation.