The Essential Eight, Explained for Executives: What Essential Eight Compliance Actually Requires
The Essential Eight used to be a federal government checklist. It isn’t anymore. Insurers now ask about it during cyber policy renewal, prime contractors push it down through supply chain security clauses, and state agencies and large enterprises across Australia increasingly treat it as the baseline for “reasonable” security practice. If your board hasn’t been asked about Essential Eight compliance yet, it will be soon — and the answer needs to be more specific than “we’re working on it.”
This is a plain-English guide for executives who need to understand what the Essential Eight actually covers, how the maturity model works, and where real-world programs tend to stall before they reach a defensible level of compliance.
What the Essential Eight Is — and Isn’t
The Essential Eight is a set of eight mitigation strategies published by the Australian Signals Directorate (ASD), designed to address the most common ways enterprises are compromised: unpatched software, uncontrolled applications, weak access control, and absent recovery capability. It is not a certification like ISO 27001, and it is not a single control you can “turn on.” It is a maturity model — a description of how well each of eight areas of your environment resists and recovers from a cyber incident, scored from Maturity Level Zero (not aligned) through to Maturity Level Three (resilient against sophisticated, state-level tradecraft).
For most commercial enterprises, Maturity Level Two is the practical target: it addresses the techniques used by the vast majority of criminal and opportunistic attackers, without the operational overhead that Level Three demands. Boards asking “are we Essential Eight compliant?” are really asking a maturity-level question, and the honest answer is almost always “we’re at different levels across different controls” — which is exactly why a plain assessment matters before any remediation spend is committed.
The Eight Strategies, in Plain Terms
1. Patch Applications
Internet-facing software and office productivity suites patched within 48 hours for critical vulnerabilities. The gap here is rarely awareness — it’s change-control cadence not matching the threat timeline.
2. Patch Operating Systems
Same discipline, applied to servers, workstations and network devices. Legacy and end-of-life systems that can’t be patched need documented compensating controls, not an exception and silence.
3. Multi-Factor Authentication
MFA on all remote access, privileged accounts, and systems holding sensitive data. The common failure mode isn’t “no MFA” — it’s partial coverage: the VPN is protected, but a dozen SaaS admin consoles and a legacy remote access tool are not.
4. Restrict Administrative Privileges
Admin rights granted on a validated, time-limited, task-specific basis, with privileged accounts unable to read email or browse the web. This is usually the hardest control to retrofit, because years of ad-hoc access grants have to be unwound without breaking operations.
5. Application Control
Only approved applications, scripts and installers can execute. Done well, this quietly blocks most ransomware and malicious macro payloads before they run. Done poorly — as a blunt allow-list nobody maintains — it either breaks the business or gets disabled.
6. Restrict Microsoft Office Macros
Macros disabled by default, enabled only from trusted, vetted locations for users who genuinely need them. A narrow control, but one of the highest-value fixes per hour of effort.
7. User Application Hardening
Browsers and productivity software configured to block the behaviours attackers rely on — untrusted Java, outdated Flash remnants, risky ActiveX content. Low glamour, consistently underfunded, and still effective.
8. Regular Backups
Backups performed, tested, and — critically — isolated from the credentials that would let an attacker encrypt or delete them too. An untested backup is a belief, not a control, and it’s the single most common gap we find during Essential Eight assessments: the backups exist, but nobody has proven they restore cleanly within the business’s recovery time objective.
Where Essential Eight Programs Actually Stall
In our delivery work across Australian enterprises, the technical controls are rarely the hard part. The strategies stall for three recurring reasons:
Scope creep in application control. A pilot on 50 workstations works cleanly. Rolling it to 5,000 devices across business units with different software needs is where projects quietly die, because nobody owns the ongoing exception-approval process.
Privileged access sprawl. Years of “just this once” admin grants accumulate into an access model nobody can fully describe, let alone certify. Fixing Strategy 4 properly usually means fixing identity governance first — which is its own program, not a configuration change.
Treating it as an IT project instead of a risk program. Essential Eight maturity decays the moment remediation is declared “done” and ownership moves back to business-as-usual without a maintenance cadence. The enterprises that hold Maturity Level Two don’t treat it as a project with an end date — they treat it as a standing control they report against quarterly.
Essential Eight and Your Broader Compliance Obligations
For APRA-regulated entities, Essential Eight maturity sits alongside, not instead of, CPS 234 obligations around identity security and information asset classification — the two frameworks reinforce each other, and a mature privileged access and MFA posture does double duty under both. For state and federal suppliers, Essential Eight maturity targets are increasingly written directly into procurement contracts, which means the assessment that used to be a security-team exercise is now a commercial risk exposed to the whole business.
Getting a Defensible Baseline
The starting point for any serious Essential Eight program is an honest, evidence-based maturity assessment against each of the eight strategies — not a self-assessment survey, but a technical review of patching telemetry, privileged account inventories, MFA enrolment rates, and actual backup restore tests. From there, remediation should be sequenced by risk reduction per dollar, not by which control is easiest to demonstrate to an auditor.
Delivery Centric’s Cyber Security practice runs these assessments and the remediation programs that follow, with particular depth in the privileged access and identity controls (Privilege Access Management) that most often hold enterprises back from Maturity Level Two. If you’re building out a security or identity delivery career in this space, our careers page lists current openings across our Australian and APAC teams.
The Bottom Line for Executives
Essential Eight compliance is not a yes/no answer, and any vendor who gives you one hasn’t actually assessed you. It’s eight maturity scores, a target level set by your risk appetite and your contractual obligations, and a remediation plan sequenced by where the real exposure sits. Boards that ask for the maturity scorecard, rather than a compliance badge, get a far more useful answer — and a program that actually holds up under audit, insurance review, or a genuine incident.