A practical guide for Australian businesses
Essential Eight. Make the basics work.
Understand ASD Essential Eight, identify the evidence behind your controls, and plan a considered move to ASD Essentials. Start with your business, not a score on a dashboard.
Independent guidance by SuperStack IT · Sources checked 28 October 2026
08
Strategies. One connected picture.
Software · updates · access · recovery
A starting point for reducing risk. Not a guarantee against every cyber threat.
October 2026 update: ASD Essentials is here.
ASD launched its successor series on 15 October. Both frameworks remain available during the transition. See what has changed. Read ASD’s announcement.
Understand the framework
What is the Essential Eight?
The Australian Signals Directorate’s Essential Eight brings together eight mitigation strategies for protecting IT systems. Its maturity model has levels zero to three. The model is a structured way to examine implementation; it is not a complete security program. Read the official model.
Application control
Limit which software can run.
Patch applications
Fix known weaknesses in applications.
Restrict Microsoft Office macros
Limit when Office automation can execute.
User application hardening
Reduce risky application features and settings.
Restrict administrative privileges
Limit access that can change systems.
Patch operating systems
Keep operating systems supported and updated.
Multi-factor authentication
Require more than a password to sign in.
Regular backups
Keep recoverable copies of important information.
A maturity level needs evidence
Level zero means the first level’s requirements have not been met. Levels one, two and three address increasing attacker capability and targeting. Assess the relevant requirements together; do not average a strong result in one strategy against a gap in another.
Name the scope
Write down which office, remote devices, services and users the review covers. Keep unknown or excluded systems visible.
Show the result
Pair the intended setting with a dated observation or safe test. Record who checked it, on which system, and what did not work.
Keep it current
Assign owners for gaps and repeat checks after material changes. Last year's report cannot describe a newly added payroll service.
For accounting and professional services
Start with the work you cannot afford to lose
For a practice, that could mean access to client workpapers, payroll processing or a lodgement workflow. List the people, devices, accounts and applications behind that work. Then ask which evidence describes those specific systems.
A useful first conversation is concrete: “These laptops process client files. This provider manages our accounts. Here is the last restore test.” You do not need to send confidential documents to start that discussion.
IT support for accounting firms · Cyber security services
For an example from an accounting practice, read Essential Eight to ASD Essentials: what changes?
Questions before you start
Is Essential 8 the same as Essential Eight?
Yes. Essential 8 is a common shorthand for ASD's Essential Eight. ASD Essentials is the newer series; it is not simply a different spelling of the same framework.
Should we stop our Essential Eight work?
Keep current protections operating and check your existing obligations. ASD is maintaining both frameworks during the transition. Use the new guidance to plan what needs a wider scope or further evidence, rather than switching controls off.
Does buying a security product establish a maturity level?
No. Product features need to be configured, applied to the relevant systems and checked. A licence or a dashboard alone is not an assessment result.
Can SuperStack IT discuss a review for our firm?
Yes. Start with a conversation about your systems, current evidence and business priorities. The scope, access needed, deliverables and fees should be agreed before work begins. An enquiry does not constitute a formal assessment.
From reading to a practical plan
Know what to keep. Know what to check.
Tell us which systems matter to your business and what evidence you already have. We can discuss scope, priorities and the help you need before agreeing on any work or fees.
- 01. Describe your environment
- 02. Discuss the evidence gaps
- 03. Agree the next step
Do not send passwords, client records or security reports through the enquiry form.
Sources and scope
- Essential Eight maturity model
- ASD Essentials launch announcement
- Official Essential Eight transition mapping
Checked 28 October 2026. These pages summarise guidance and offer planning examples. They are not an ASD publication, endorsement, certification or assessment of your organisation. Use the current official guidance for exact requirements and confirm any contractual or regulatory obligations separately.