Essential Eight compliance in Perth

Eight controls, and the order to put them in.

The Essential Eight is the Australian Signals Directorate’s baseline set of cyber security controls. What each one does, what the maturity levels mean, and where to start.

Book a free Essential Eight review Check your maturity level

An IT engineer at a bench setting up a row of business laptops, each showing a progress bar.

What is the Essential Eight?

Three jobs. Eight controls.

Eight mitigation strategies from ASD, designed for internet-connected business networks. Each control does one of three jobs.

Prevent attacks

Stop malicious code getting in and running.

Limit the impact

Stop an attacker spreading or taking control.

Recover

Get data and systems back.

08 Regular backups Recover when everything else fails. Read the guide

Essential 8 maturity levels explained

Four levels, matched to the attacker.

Maturity Level 0 means the basics are missing. Each level after it adds to the one before. Most businesses aim for Level 1 on all eight controls first.

At each level ML1 Start here ML2 ML3

Defends against Opportunistic attackers using public tools and stolen passwordsAttackers who invest time, phish for credentials and get around weak MFAAdaptive attackers who pick a target and move fast on new flaws

Usually the target for Most small and mid-sized businessesSensitive client data, or a contract asks for it. Required for non-corporate Commonwealth entitiesGovernment, defence and critical infrastructure

Example: MFA On online services with sensitive dataPhishing-resistant, and on staff sign-insAdds data repositories

Example: patching Office and browsers Within 2 weeks No change 48 hours if critical or exploited

Example: backups Staff can’t delete themAdmins can’t either, except backup adminsNot even backup admins, until retention ends

Based on the ASD Essential Eight Maturity Model (November 2023)

How to implement the Essential Eight

A practical order for busy businesses.

The order we usually follow: the biggest risk reduction first, the most disruptive changes last.

First · weeks
MFA and backups
Stops most account takeovers and makes ransomware survivable, with little disruption.
- MFA
- Backups
Next · ongoing
Patching and macros
Automated, reported patching, and macros off for staff who don’t need them.
Then · planned
Admin, hardening and application control
The controls that need testing and staff notice. Done in stages, audit mode first.

Essential Eight questions for small business

What businesses ask before they start.

Or call (08) 9467 2269 and ask an engineer.

Is the Essential 8 mandatory in Australia?

For non-corporate Commonwealth entities, yes. For private businesses it’s voluntary, but cyber insurers, larger clients, government contracts and regulators increasingly ask for it.

How long does it take to reach Maturity Level 1?

For a typical 20 to 50 person business on Microsoft 365, usually two to four months. MFA and backups can often be done in weeks. Application control takes the longest.

Can we go to Level 2 on some controls first?

ASD recommends reaching the same level on all eight before moving any higher. The controls cover for each other, and one weak control is the gap an attacker uses.

Know your Essential Eight maturity in 45 minutes.

Book a free Essential Eight review with a Perth engineer. You get your maturity on each control and the order to fix things. The report is yours to keep.

Or call (08) 9467 2269

We hold ISO/IEC 27001:2022 certification from BSI, certificate IS 840964.