What is the Essential Eight?

The Essential Eight means eight specific security controls the Australian Signals Directorate recommends every organisation implement: application control, patching applications, restricting Office macros, hardening user applications, restricting administrative privileges, patching operating systems, multi-factor authentication and regular backups. They are grouped as “essential” because together they block the attack methods ASD sees most often in real incidents. Each control is implemented to one of three maturity levels, so doing the Essential Eight always means doing all eight to a stated level — not picking the convenient ones.

The Essential Eight is Australia’s baseline cyber security framework, written by the Australian Signals Directorate for Australian conditions and published free on cyber.gov.au. It is mandated for non-corporate Commonwealth entities, and used as the reference standard by Australian cyber insurers, defence supply chains and larger customers assessing their vendors. In June 2026 ASD announced it will be superseded by a broader “Essentials” series — see the next question.

Yes. On 24 June 2026 the Australian Signals Directorate announced the Essential Eight will be replaced by a new “Essentials” series, beginning with Essentials for enterprise IT. ASD expects to deprecate the Essential Eight around mid-2027 and retire it around mid-2028. The reason is structural: the Essential Eight was designed for on-premises, Windows-centred networks, and its controls do not map cleanly onto cloud and SaaS environments where responsibility is shared with the provider. ASD has said organisations that have already implemented the Essential Eight will not lose that work, because the new guidance is expected to align closely with the existing controls. If you are being asked for Essential Eight evidence today, it still applies — keep going, and expect the language to change. Call 1800 456 567 if you want to know what the transition means for your business.

For private businesses the Essential Eight is not legislated, but it is rapidly becoming unavoidable in practice: cyber insurers ask for it, government and defence supply chains (including DISP) expect it, and larger customers increasingly require evidence of it from their vendors. For non-corporate Commonwealth entities, Essential Eight implementation is mandated under government policy. Otaris aligns Adelaide businesses to the framework and provides the evidence. Call 1800 456 567.

Maturity Level 1 means all eight controls are implemented well enough to stop opportunistic attacks using commodity tools — application control, prompt patching, macro restrictions, application hardening, restricted admin privileges, multi-factor authentication and tested backups. It is the sensible baseline for most Australian businesses, and the level the Otaris Fortress plan delivers in full.

With Otaris, full Essential Eight Maturity Level 1 is built into the Fortress plan at $139 per user per month — with Level 2 (Knox, $179) and Level 3 (Titan, $199) above it and pricing published openly. There's no separate compliance project fee: the controls are implemented and maintained as part of managed IT. Call 1800 456 567 for a quote.

The Australian Signals Directorate (ASD), through the Australian Cyber Security Centre (ACSC) — the Australian Government's technical authority on cyber security. The full framework and its maturity model are public on cyber.gov.au, so you can verify everything a provider tells you against the standard itself.

Start with an assessment against each of the eight controls. Otaris runs this as the free Essential Eight Cyber Security Scorecard — a plain-English review of your environment that scores your business against the framework and gives you a clear maturity level and a prioritised fix list. Call 1800 456 567 or book it online.