ASD Essential Eight

The Essential Eight is a set of eight prioritised mitigation strategies published by the Australian Signals Directorate through the Australian Cyber Security Centre, designed to help organisations prevent, limit and recover from cyber incidents. It is the most widely referenced cyber baseline in Australia and appears by name in a great many government contracts, tenders and funding agreements.

The eight strategies are application control, patching applications, configuring Microsoft Office macro settings, user application hardening, restricting administrative privileges, patching operating systems, multi-factor authentication, and regular backups. Implementation is measured in maturity levels, currently Maturity Level One through Three.

For a broader prioritised control programme beyond the eight strategies, see the CIS Controls. Use the named Essential Eight maturity level where a contract or policy requires it, and use CIS Controls to structure the wider uplift.

It is being retired — and that does not mean stop

On 24 June 2026 ASD confirmed the Essential Eight will be retired and replaced by a new Essentials series: domain-specific guidance rather than a single universal checklist. Three domains have been confirmed — enterprise IT, cloud, and operational technology — with agentic AI mentioned as a possibility rather than a commitment. Public consultation on the first chapter, Essentials for Enterprise IT, closed on 12 July 2026.

ASD's indicative timeline is deprecation at around twelve months and full retirement at around twenty-four — roughly mid-2027 and mid-2028. Those are approximate figures given by ASD, not published calendar dates, and consultation remains open so the timeline can move. Both frameworks are expected to run in parallel through the transition.

The Essential Eight is live today. It remains what contracts and assessors reference, and ASD's stated position is that investment made under it carries forward.

Commonwealth entities

The PSPF sets Essential Eight Maturity Level Two as the mandatory baseline for applicable Commonwealth entities.

DISP members and applicants

Since the conclusion of assessments against the older top-four model in November 2025, all DISP members are required to achieve and maintain the full Essential Eight at Maturity Level Two across the corporate ICT environment used to deal with Defence. This applies from Entry Level upward and is where most DISP applicants encounter friction.

Government suppliers generally

A named maturity level is a common contract condition well beyond Defence, across federal, state and local government engagements.

Organisations under insurer or board pressure

The Essential Eight has become a common shorthand for baseline cyber hygiene in Australia, well outside its original government audience.

• It is contractually binding for many organisations. Where a contract names a maturity level, this is not optional and not a matter of judgement.
• The controls address real attack paths. MFA, patching internet-facing systems, application control and tested offline backups are not compliance theatre. They are the controls that decide incident outcomes.
• The work carries forward. ASD has confirmed that investment under the Essential Eight remains relevant under the Essentials series. Nothing done well now is wasted.
• It is the technical layer beneath other obligations — ISM alignment, DISP membership and several state frameworks all lean on it.
• Deferring is the expensive option. Organisations that pause on the basis of the retirement announcement will be the ones scrambling when deprecation begins.

Essential Eight uplift is measured in maturity levels, currently Maturity Level One through Three, assessed per strategy.

1. Establish the target maturity level

Driven by your contract, your regulator or your risk. Commonwealth entities are required at Maturity Level Two; DISP members must hold full Essential Eight at Maturity Level Two across the corporate ICT environment used to deal with Defence.

2. Assess current maturity per strategy

Maturity is assessed strategy by strategy, and the overall rating is limited by the weakest. Seven strategies at Maturity Level Two with one at Level One yields an overall Level One, which is where most organisations discover the gap between what they believed and what they can evidence.

3. Prioritise remediation

Sequenced by effort against maturity gain. Patching cadence and application control are typically the two hardest, and the ones most often deferred.

4. Implement and evidence

The controls have to produce records. An assessor tests evidence, not intent, and "we do patch regularly" without a patch register does not survive.

5. Sustain

Maturity decays. Patch windows slip, exceptions accumulate, new systems arrive outside the standard build. Sustaining a maturity level is a continuous obligation rather than a project.

6. Prepare for the Essentials transition

Frame evidence around control outcomes and risk reduction rather than maturity level attainment alone. Evidence written that way carries into the Essentials series without rework.

Soveriq assesses maturity against evidence rather than self-assertion, builds the remediation roadmap sequenced by effort against maturity gain, and puts in place the evidence routines that make a maturity claim defensible at assessment.

On the transition, our position is the same as ASD's: keep going. We frame evidence around control outcomes so it carries into the Essentials series, and we help you find and triage the contract clauses that name a maturity level.

On internal review. Where Soveriq has performed the uplift, we do not then assess it and present that as independent assurance. What we provide is readiness validation, labelled as such, and where genuine independence is required it is performed by someone independent of that work and disclosed to you in writing.

What we will not do. Soveriq does not issue maturity certifications and does not promise an assessment outcome.

• Module 01 — Gap analysis. Maturity assessment across all eight strategies, with evidence review rather than self-assessment.
• Module 02 — Build. Remediation, control implementation and the evidence routines that make maturity demonstrable.
• Module 03 — Internal review ahead of formal assessment, subject to the impartiality position above.
• Module 04 — Representation during assessment or agency review.
• Module 05 — Continuous compliance, including tracking the Essentials series as chapters publish.

Engagements in this area are scoped and priced in writing after a scoping call, usually within one business day.