Skip to main content

Australia

The Essential Eight in a Windows and Microsoft 365 business

The Australian Signals Directorate's Essential Eight is the most concrete baseline an Australian business can use to protect its Windows environment. Here is what the eight strategies and their maturity levels actually ask of your systems, and how to get there.

What the Essential Eight is

The Essential Eight is a set of eight mitigation strategies published by the Australian Signals Directorate (ASD), through its Australian Cyber Security Centre, to make it much harder for attackers to compromise systems. It is accompanied by a maturity model that sets out, for each strategy, what an organisation has to do to reach Maturity Level One, Two or Three. The ASD revises the model from time to time: always check the latest version on its website.

Applicable Australian Government organisations must reach Maturity Level Two under the Protective Security Policy Framework. For a private business, the Essential Eight is not a legal obligation, but it gives a clear, public yardstick for the basics, one that a board, an insurer or a larger client can understand. It was designed around Microsoft Windows environments connected to the internet, which is exactly what most small and medium-sized businesses run.

This page describes the strategies from the point of view of an IT provider who implements them. It does not replace the ASD's own publications, listed in the sources below, and it is not an assessment.

The eight strategies

Patch applications and patch operating systems

Known vulnerabilities must be fixed quickly: within 48 hours for critical vulnerabilities in online services, and within two weeks for most other applications at the lower levels, with regular automated scans to find what is missing. Operating systems and applications that are no longer supported by their vendor must be removed at every maturity level. With Windows 10 now out of support, a Windows 11 migration is often the first line of any Essential Eight plan.

Multi-factor authentication

Multi-factor authentication is required for users of online services at the first level. From Maturity Level Two, it must be phishing-resistant for users of third-party online services and of the organisation's own online services that hold sensitive data, and all successful and failed authentication events must be logged centrally. In a Microsoft 365 environment, this is set through conditional access policies and security keys or passkeys.

Restrict administrative privileges

Privileged access is validated when first requested and limited to the duties that need it. Privileged accounts should not browse the web or read email. From Maturity Level Two, access is disabled after 12 months without revalidation or 45 days of inactivity, and administration goes through jump servers. Maturity Level Three adds just-in-time administration, hardened admin workstations and Credential Guard. An Active Directory audit shows exactly who holds which privileges today, including the forgotten ones.

Application control

Only approved executables, scripts, installers and libraries may run on workstations, then on internet-facing servers from Maturity Level Two, then on all servers at Maturity Level Three, where drivers are also controlled. Microsoft's recommended block rules are required from Maturity Level Two. In practice this is done with Windows Defender Application Control deployed through Intune.

Restrict Microsoft Office macros

Macros are disabled for everyone without a demonstrated business need, macros in files from the internet are blocked, macro antivirus scanning is on, and users cannot change these settings. Higher levels restrict what the remaining macros can do and require trusted locations or digital signatures.

User application hardening

Internet Explorer 11 is disabled or removed, browsers do not process Java or web advertisements from the internet, and users cannot change browser security settings. From Maturity Level Two, browsers, Office and PDF software are hardened following ASD and vendor guidance, and PowerShell and command-line activity is logged. Maturity Level Three removes .NET Framework 3.5 and PowerShell 2.0 and uses PowerShell Constrained Language Mode.

Regular backups

Backups are made and kept according to business criticality, synchronised so that systems can be restored to a common point in time, and tested through restoration exercises. Ordinary accounts cannot reach other users' backups or modify or delete any backup; from Maturity Level Two the same applies to privileged accounts. This is what makes the difference between a bad day and a ransom demand.

Reading the maturity levels

Each maturity level is designed to resist a more capable attacker than the last. Maturity Level Zero means weaknesses remain in the overall posture. Maturity Level One stops opportunistic attacks that rely on widely available tools. Maturity Level Two addresses attackers willing to invest more time and effort, and Maturity Level Three those who are more adaptive and targeted.

The ASD's advice is to choose a target level based on your risk, then bring all eight strategies up to it before aiming higher. A business with perfect application control and untested backups is not at Maturity Level Two: the model is only as strong as its weakest strategy. For most small and medium-sized businesses, Maturity Level One across the board is a realistic first target, and Maturity Level Two a sensible medium-term one.

A realistic path for a small Windows environment

In the Windows and Microsoft 365 environments we work on, the order that usually gives the most protection for the effort is:

  1. Take stock: which devices, operating systems and applications you run, who holds administrative rights, and whether backups can actually be restored. Our IT audit produces this picture with a prioritised roadmap.

  2. Remove what is unsupported and set up automated patching, starting with Windows 11 and Microsoft 365 Apps.

  3. Clean up Active Directory and Entra ID privileges, separate admin accounts from everyday accounts, and turn on multi-factor authentication for everyone.

  4. Enforce macro, browser and Office hardening settings centrally through Microsoft 365 and Intune.

  5. Protect backups from the accounts they back up, and test a restore.

  6. Introduce application control in audit mode, then enforce it once the allowed list is stable.

Each step is a project with a defined scope. We carry out the technical work remotely from France, often during your night so that changes do not disrupt your staff, and we document what was changed so that your team, or an assessor, can check it. We do not certify a maturity level and do not guarantee one: we implement and document the controls, and show you honestly where you stand.

Frequently asked questions

Is the Essential Eight mandatory for my business?

Not by law for a private business. Applicable Australian Government organisations must reach Maturity Level Two; for everyone else it is a recommended baseline, which clients or insurers may ask about.

Which maturity level should we aim for?

The one that matches your risk, reached across all eight strategies before going further. For most small and medium-sized businesses, Maturity Level One everywhere is a realistic first target.

Can the work be done remotely from France?

Yes. Patching, Intune policies, Active Directory clean-up, macro and browser hardening and backup protection are configuration work done through secure remote sessions, often during your night.

Will you certify our maturity level?

No. We implement and document the controls and show you where you stand against the model, but we do not certify or guarantee a maturity level.

Let’s talk about your project

Describe your context: you will receive a first reply, with no commitment.

Discuss your project

Sources

Services·See pricing·Discuss your project
Call
Email us