The Essential Eight in your IT services: what it should mean in 2026

Every IT provider in Australia says it follows the Essential Eight. It’s on the website, in the proposal and usually somewhere in the email signature. Ask what maturity level your business actually sits at, and the answer is often a long pause.

That gap matters. The Essential Eight is the closest thing Australian small businesses have to a shared definition of “secure enough”, and it’s now in the middle of its biggest change since it was introduced. Here’s what it is, what it should look like inside your managed IT services, and what the shift to ASD’s new “Essentials” series means for you.

What is the Essential Eight?

The Essential Eight is a set of eight mitigation strategies published by the Australian Signals Directorate (ASD) through its Australian Cyber Security Centre. They aren’t the only controls a business needs, but ASD’s view is that, done properly, they make it much harder for attackers to get in and much easier to recover when something goes wrong.

The eight strategies are:

1. Patch applications. Keep browsers, Office, PDF readers and other software up to date.
2. Patch operating systems. The same discipline for Windows, macOS, servers and network gear.
3. Multi-factor authentication. A second proof of identity beyond the password, especially for email and remote access.
4. Restrict administrative privileges. Admin rights only for the people and tasks that need them.
5. Application control. Only approved software is allowed to run.
6. Restrict Microsoft Office macros. Block macros from the internet, the classic route for malicious attachments.
7. User application hardening. Switch off risky browser and app features most people never use.
8. Regular backups. Back up what matters, keep it out of an attacker’s reach, and prove you can restore it.

Each strategy is measured against maturity levels, from Level Zero (gaps an attacker can walk through) to Level Three (built to resist skilled, persistent adversaries). For most small and mid-sized businesses, Maturity Level One is the sensible first target, with Level Two the goal where client data, money or regulation is involved.

Why it still matters for small businesses

It’s tempting to think attackers only chase big names. The numbers say otherwise. ASD’s latest annual threat report puts the average self-reported cost of cybercrime for an Australian small business at $56,600 in 2024–25, with email compromise and business email compromise fraud among the most common incidents.

Most of those incidents aren’t clever. A reused password with no MFA. A laptop three months behind on updates. A staff member with admin rights opening the wrong attachment. A backup that existed only in theory. The Essential Eight is unglamorous precisely because it targets the boring failures that cause most of the damage.

What the Essential Eight should look like in your IT services

“We follow the Essential Eight” isn’t a service. These are. If you pay for managed IT services, you should be able to point to each of them.

A baseline assessment, in writing

Before anything is fixed, your provider should measure where you stand on each of the eight strategies and give you the result as a maturity level, not an adjective. A one-page summary is fine. “Pretty good” is not.

Patching with deadlines, not good intentions

The maturity model sets timeframes. At Level One, for example, vulnerabilities in internet-facing services should be patched within 48 hours when the vendor rates them critical or a working exploit exists. Your provider should be patching automatically and reporting on what’s outstanding.

MFA everywhere it counts

Email, Microsoft 365, remote access, accounting software and any admin console. Text-message codes are better than nothing, but app-based or phishing-resistant methods are where things are heading.

Admin rights that are earned, not inherited

Day-to-day accounts shouldn’t be administrators. Admin access should be separate, logged and reviewed, so one bad click doesn’t hand over the whole network.

Application control and macro settings that are actually switched on

These are the two strategies most often skipped, because they take care to roll out without upsetting staff. A good provider plans them in stages rather than leaving them on the wish list.

Backups you’ve watched being restored

Backups should run automatically, be protected from deletion and be tested with a real restore at least a few times a year. If your provider has never shown you a test restore, ask for one.

Reporting you can understand

A quarterly review should show your maturity level for each strategy, what’s improved and what’s next. That’s also the evidence insurers, larger customers and auditors increasingly ask for.

The big change: from Essential Eight to “Essentials”

In June 2026 ASD opened consultation on the evolution of the Essential Eight. The plan is a broader “Essentials” series, starting with a first chapter called Essentials for enterprise IT, with further chapters expected for areas such as operational technology and cloud. Consultation closed on 12 July 2026.

ASD has also signalled a transition of around two years, with both documents kept live in the meantime. At the time of writing, the final Essentials guidance hasn’t been published, and the November 2023 Essential Eight maturity model remains the one businesses are assessed against.

So what should you do? Keep going. ASD has said organisations already using the Essential Eight can expect strong alignment with their existing controls. MFA, patching, restricted admin rights and tested backups aren’t going anywhere. They’re being reorganised, not retired. A business that pauses its uplift to “wait for the new framework” simply carries the same risks for longer.

Five questions to ask your IT provider this quarter

1. What maturity level are we at for each of the eight strategies, and can I have that in writing?
2. Which strategies are we weakest on, and what’s the plan and timeline to fix them?
3. When did you last test a full restore of our data, and what did it show?
4. Which of our accounts still don’t have MFA, and why?
5. How are you preparing us for the move to ASD’s Essentials series?

A good provider will answer all five without reaching for a sales deck. If you’d like a feel for what this costs, our guide to managed IT support costs in Australia sets out typical pricing, and our pricing page shows what’s included in each plan.

Where to start

If you don’t know your current position, start with our free Essential Eight checklist. It walks through each strategy with one question to ask yourself, and it takes about ten minutes. From there, the path is rarely dramatic: switch on what’s missing, tighten what’s loose, prove the backups work, and review it every quarter.

Security done this way isn’t a product you buy once. It’s a habit your IT partner keeps for you, quietly, month after month. That’s what the Essential Eight was always meant to be, and what it will remain under whatever name ASD gives it next.

Sources: ASD: Essential Eight · ASD: Consultation on evolution of Essential Eight (June 2026) · iTnews: ASD to retire Essential Eight within two years · ASD: Annual Cyber Threat Report 2024–25, factsheet for businesses