---
title: "Essential Eight compliance in Perth: controls explained | CCP"
description: "The ASD Essential Eight explained for Perth businesses: what each of the eight controls does, which maturity level to aim for, and where to start."
url: "https://ccp.com.au/essential-eight/"
datePublished: "2026-04-18"
dateModified: "2026-09-28"
author: "Computer Consultant Professionals"
---

# Essential Eight compliance in Perth

## Eight controls, and the order to put them in.

The Essential Eight is the Australian Signals Directorate’s baseline set of cyber security controls. What each one does, what the maturity levels mean, and where to start.

Changing ASD is replacing the Essential Eight with a new Essentials series. The work you do now still counts. [What’s changing ](https://ccp.com.au/essential-eight/essentials-series/)

## What is the Essential Eight?

### Three jobs. Eight controls.

Eight mitigation strategies from ASD, designed for internet-connected business networks. Each control does one of three jobs.

#### Prevent attacks

Stop malicious code getting in and running.

-   [01 Application control Only approved software can run. Read the guide ](https://ccp.com.au/essential-eight/application-control/)
-   [02 Patch applications Fix known flaws in software, fast. Read the guide ](https://ccp.com.au/essential-eight/patch-applications/)
-   [03 Configure Microsoft Office macro settings Block macros most people never need. Read the guide ](https://ccp.com.au/essential-eight/configure-office-macros/)
-   [04 User application hardening Switch off risky features in everyday apps. Read the guide ](https://ccp.com.au/essential-eight/user-application-hardening/)

#### Limit the impact

Stop an attacker spreading or taking control.

-   [05 Restrict administrative privileges Limit who holds the keys. Read the guide ](https://ccp.com.au/essential-eight/restrict-administrative-privileges/)
-   [06 Patch operating systems Keep Windows, macOS and servers current. Read the guide ](https://ccp.com.au/essential-eight/patch-operating-systems/)
-   [07 Multi-factor authentication A password alone isn’t enough. Read the guide ](https://ccp.com.au/essential-eight/multi-factor-authentication/)

#### Recover

Get data and systems back.

-   [08 Regular backups Recover when everything else fails. Read the guide ](https://ccp.com.au/essential-eight/regular-backups/)

## Essential 8 maturity levels explained

### Four levels, matched to the attacker.

Maturity Level 0 means the basics are missing. Each level after it adds to the one before. Most businesses aim for Level 1 on all eight controls first.

At each level ML1 Start here ML2 ML3

Defends against Opportunistic attackers using public tools and stolen passwordsAttackers who invest time, phish for credentials and get around weak MFAAdaptive attackers who pick a target and move fast on new flaws

Usually the target for Most small and mid-sized businessesSensitive client data, or a contract asks for it. Required for non-corporate Commonwealth entitiesGovernment, defence and critical infrastructure

Example: MFA On online services with sensitive dataPhishing-resistant, and on staff sign-insAdds data repositories

Example: patching Office and browsers Within 2 weeks No change 48 hours if critical or exploited

Example: backups Staff can’t delete themAdmins can’t either, except backup adminsNot even backup admins, until retention ends

Based on the [ASD Essential Eight Maturity Model (November 2023)](https://www.cyber.gov.au/business-government/asds-cyber-security-frameworks/essential-eight/essential-eight-maturity-model)

## How to implement the Essential Eight

### A practical order for busy businesses.

The order we usually follow: the biggest risk reduction first, the most disruptive changes last.

1.  First · weeks

    #### MFA and backups

    Stops most account takeovers and makes ransomware survivable, with little disruption.

    -   [MFA ](https://ccp.com.au/essential-eight/multi-factor-authentication/)
    -   [Backups ](https://ccp.com.au/essential-eight/regular-backups/)

2.  Next · ongoing

    #### Patching and macros

    Automated, reported patching, and macros off for staff who don’t need them.

    -   [Applications ](https://ccp.com.au/essential-eight/patch-applications/)
    -   [Operating systems ](https://ccp.com.au/essential-eight/patch-operating-systems/)
    -   [Macros ](https://ccp.com.au/essential-eight/configure-office-macros/)

3.  Then · planned

    #### Admin, hardening and application control

    The controls that need testing and staff notice. Done in stages, audit mode first.

    -   [Admin ](https://ccp.com.au/essential-eight/restrict-administrative-privileges/)
    -   [Hardening ](https://ccp.com.au/essential-eight/user-application-hardening/)
    -   [Application control ](https://ccp.com.au/essential-eight/application-control/)

Free tool

#### Check your own maturity first.

Eight questions, one per control, and a PDF report for your board or insurer. Nothing you enter leaves your browser.

[Start the Essential Eight self-assessment](https://ccp.com.au/resources/essential-eight-checklist/)

## Essential Eight questions for small business

### What businesses ask before they start.

Or call [(08) 9467 2269](tel:+61894672269) and ask an engineer.

### Is the Essential 8 mandatory in Australia?

For non-corporate Commonwealth entities, yes. For private businesses it’s voluntary, but cyber insurers, larger clients, government contracts and regulators increasingly ask for it.

### How long does it take to reach Maturity Level 1?

For a typical 20 to 50 person business on Microsoft 365, usually two to four months. MFA and backups can often be done in weeks. Application control takes the longest.

### Can we go to Level 2 on some controls first?

ASD recommends reaching the same level on all eight before moving any higher. The controls cover for each other, and one weak control is the gap an attacker uses.