Essential Eight Certification Australia

The Australian Signals Directorate's (ASD) Essential Eight is a set of eight baseline mitigation strategies - application control, patching applications, configuring Microsoft Office macro settings, user application hardening, restricting administrative privileges, patching operating systems, multi-factor authentication, and regular backups - assessed against four maturity levels from Zero (weak alignment, vulnerable to basic opportunistic attacks) through Three (resilient against adaptive adversaries using sophisticated tradecraft). The model requires progressing through the levels sequentially and implementing the same maturity level consistently across all eight strategies at once, since a single weak control undermines the others. Maturity Level Two is mandatory for non-corporate Commonwealth entities under the Protective Security Policy Framework and the Public Governance, Performance and Accountability (PGPA) Act, and it has become a de facto baseline expectation for government suppliers and increasingly for state government and critical infrastructure contracts even where it isn't strictly mandated. There is no formal government certification scheme for the Essential Eight itself - most organisations self-assess using documented evidence, though contracts or regulatory conditions can require an independent assessment, and ASD's guidance was last substantively revised in November 2023.