The Essential Eight is the Australian Cyber Security Centre's (ACSC) list of eight mitigation strategies that make it much harder to attack a business. Each strategy is measured against a maturity level. Understanding the levels is the key to setting a sensible goal.
The eight strategies
- Application control
- Patch applications
- Configure Microsoft Office macro settings
- User application hardening
- Restrict administrative privileges
- Patch operating systems
- Multi-factor authentication
- Regular backups
The four maturity levels
The ACSC defines four maturity levels, numbered from zero to three. Each one is designed to stop a more capable attacker than the last.
Maturity Level Zero. There are weaknesses in the business's security that an attacker could readily use. This is where most businesses start.
Maturity Level One. Protection against opportunistic attackers using commonly available tools and techniques. They're looking for any easy target, not your business in particular.
Maturity Level Two. Protection against attackers who are willing to spend more time and effort on a business and to target it more deliberately.
Maturity Level Three. Protection against skilled, adaptable attackers who are prepared to invest real effort in a specific target.
Which level should you aim for?
The ACSC suggests working towards the same maturity level across all eight strategies before moving on to the next level. A business at Level Two for seven strategies and Level Zero for the eighth is only as strong as that eighth.
For most small and medium businesses, Maturity Level One across all eight is a realistic first goal and a big step up from where they start. Businesses holding sensitive data, or answering to government or larger customers, often need Level Two.
How to find out where you stand
An Essential Eight assessment checks each strategy against the maturity model and tells you your current level, with the evidence behind it. More usefully, it gives you a prioritised list of what to fix to reach the next level.
The ACSC updates the maturity model from time to time, so any assessment should be done against the current version.
If you'd like to know where your business stands, our Essential Eight assessment is the place to start.