¶ History
https://www.cyberoxide.com/blog/exploring-the-origins-and-significance-of-the-essential-8
- 2010-2014: Strategies to Mitigate Targeted Cyber Intrusions Originally published 18 February 2010. (top_35_mitigations_2012.pdf , top-four-mitigation (2012).pdf)
- 2014-2017: Strategies to Mitigate Cyber Security Incidents (replaces the document Strategies to Mitigate Targeted Cyber Intrusions)
- 2017-2026 The “Essential Eight” maturity model. Released in June, the Essential Eight is an evolution of the Australian Signals Directory’s (ASD) Top Four recommendations.
- 2017: https://www.aph.gov.au/Parliamentary_Business/Committees/Joint/Public_Accounts_and_Audit/CybersecurityCompliance/Report_467/section?id=committees%2Freportjnt%2F024076%2F24814
- 2018: new PSPF commenced on 1 October
- 2020: PSPF updated to realign with (ACSC) updated advice on assessment and authorisation of information and communication technology (ICT) systems using a risk-based approach. (28 August 2020)
- 2022: PSPF mandates Essential 8 (15 March 2022) https://www.protectivesecurity.gov.au/news/policy-amendment-information-security
- 2023: PSPF went from Attorney-General's Department (AGD) to Home Affairs in August. Format changed as well.
- 2024: Essential Eight assessment process guide updated (orig 2022) (pdf)
- Essential Eight assessment toolkit on ACSC partner site
- 2025: PSPF update review > pspf-new-in-2025
- 2026: Essential 8 evolving into “Essentials” with Enterprise IT, Cloud and OT versions. Maturity levels are being retired and replaced with implementation levels.
- June 2026: “Essentials” for Enterprise IT draft paper released for review (not public)
- July 2026: new PSPF release, but E8 related content not changed. expected to come in 2027 release.
¶ Notes
(DSD became ASD, but the ISM goes back at least as far as 2009)
ASD first published its list of 35 controls as “Strategies to Mitigate Targeted Cyber Intrusions” in 2010 based on its experience in responding to cyber security incidents. The strategies were updated in 2012 and 2014. In 2011, the ASD found that the Top Four controls, when properly implemented, effectively mitigates 85% of targeted cyber attacks.
The revised documents present 37 controls as mitigation strategies against a list of six threats and expands the Top Four controls to the Essential Eight. The strategies have been updated to address changes to the threat landscape, current attack patterns and defensive technologies and capabilities to cover a wider threat range than just “targeted attacks”.
The Strategies to Mitigate Cyber Security Incidents was a document created by the Australian Signals Directorate (ASD). The document had a list of 37 strategies that Australian Government Agencies must or should implement to reduce risk of targeted cyber intrusions. The list was informed by ASD’s experience in operational cyber security, including responding to serious cyber incidents and performing vulnerability assessments and penetration testing for Australian Government Agencies.
The list is ranked according to each strategy’s effectiveness in preventing targeted cyber intrusions. Control number one is the most effective and control 35 being the least effective.
As a result, there was great emphasis placed on the top 4 strategies in the document. The ASD stated “While no single strategy can prevent malicious activity, the effectiveness of implementing the Top 4 Strategies remains very high. At least 85% of intrusion techniques that ASD responds to involves adversaries using unsophisticated techniques that would have been mitigated by implementing the Top 4 mitigation strategies as a package”.
The Top 4 mitigations were:
- Application allow listing of permitted/trusted programs, to prevent execution of malicious or unapproved programs including executables. Scripts, and installers.
- Patch applications - e.g. Java, PDF viewer, Flash, web browsers and Microsoft Office. Patch/mitigate systems with "extreme risk" vulnerabilities within two days. Use the latest version of applications.
- Patch operating system vulnerabilities. Patch/mitigate systems with "extreme risk" vulnerabilities within two days. Use the latest suitable operating system version. Avoid Microsoft Windows XP.
- Restrict administrative privileges to operating systems and applications based on user duties. Such users should use a separate unprivileged account for email and web browsing.
In 2017, the Prime Minister at the time Malcolm Turnbull, released the unclassified version of the 2017 Independent Intelligence Review, which made recommendations for the reorganisation of intelligence agencies in Australia. One of the recommendations was that the ACSC should become part of ASD. This recommendation was implemented through the Intelligence Services Amendment (Establishment of the Australian Signals Directorate) Bill 2018, which was passed into law in April 2018. As a result, the ACSC is now part of ASD and the two agencies work closely together to protect Australia's cyber security interests.
Essential Eight (Top 4 plus these 4 New Ones)
- Disable untrusted Microsoft Office Macros so malware cannot run unauthorized routines.
- Block Web browser access to Adobe Flash, web advertisements, and untrusted Java code on the Internet. If possible, uninstall all browser plugins that are not required.
- Multi-factor authentication for all systems when possible to make it harder for an adversary to access a system and information
- Daily backup of important data securely and offline to ensure even if data is compromised, protected versions are available for recovery.
(2017) The ASD has also revised its listing of mitigation strategies – five strategies comprising 37 mitigation controls. These are not just technical steps but involve the whole organization in modifying behaviour.
- Prevention of malware delivery and execution;
- Limiting the extent of cyber security incidents;
- Detecting cyber security incidents;
- Recovering data and system availability; and
- Preventing malicious insiders.
(2017) They have now been escalated to "essential" status, but do not become mandatory until - and if - the government decides to include them alongside the existing top four in its protective security policy framework (PSPF). → this mandate came in 2022
¶ Essentials
ASD is shifting to a broader, principles-based ‘Essentials’ series, evolving the existing Essential Eight to the Essentials for enterprise IT. The evolved framework moves away from requiring prescriptive technical controls, and instead provides a series of cyber security principles, with respective implementation approaches to address these principles.
The proposed framework has been designed around five structural shifts:
- Prescriptive controls to flexible principles
- Fixed maturity to targeted implementation
- Uniform progression to sequenced implementation
- Maintaining a broad threat approach, with increased focus on the level of sophistication of cyber threats.
- Tailored for Commonwealth entities and Critical Infrastructure (CI) operators but remains relevant for all organisations.
¶ Purpose
¶ Framework structure
¶ Implementing the framework
¶ How the mitigation strategies map to cyber security principles
Each mitigation strategy under the Essential Eight maturity model can be mapped to at least one cyber security principle in the Essentials for enterprise IT. In most cases, a mitigation strategy maps to a cyber security principle that is broader in scope, meaning existing controls contributes to, but may not fully satisfy, the corresponding implementation approaches.