Essential Eight Explained: Framework, Maturity Levels

The Essential Eight is a set of eight prioritized cybersecurity controls published by the Australian Signals Directorate (ASD). Originally designed to protect Australian government systems, it has become the de facto baseline for organizations operating in or with the Australian public sector, and increasingly a reference point for private sector security programs across the Asia-Pacific region.

This guide covers what each control does, how the maturity levels actually work, who needs to comply, and what implementation looks like in practice across both Windows and Apple environments.

What the Essential Eight Framework Actually Is

The ASD developed the Essential Eight after analyzing real-world cyber incidents and identifying the controls that would have prevented the majority of them. The framework groups into three phases:

1. Prevent attacks from succeeding, Stop malware from executing and attackers from gaining a foothold

2. Limit the impact of attacks, Reduce what an attacker can do once inside

3. Recover data and system availability, Ensure business continuity when something does go wrong

The Essential Eight sits within a broader ASD Strategies to Mitigate Cyber Security Incidents list of 37 controls. The eight prioritized controls were selected because, as a group, they address the most common attack vectors at reasonable implementation cost.

It is worth noting that ASD has been developing an updated framework called "ASD Essentials" with broader coverage. Organizations subject to ASD guidance should monitor the transition timeline, but as of 2026, the Essential Eight maturity model remains the operative compliance standard.

The Eight Controls Explained

Each control targets a specific attack path. Here is what each one does and why it matters.

1. Application Control

Only approved applications can execute on a system. This prevents malware, ransomware, and unauthorized software from running even if it is delivered through phishing or a compromised website. On Windows, this is typically implemented through AppLocker or Windows Defender Application Control. On macOS, it requires MDM-enforced allowlisting, Gatekeeper configuration, and restrictions on unsigned or unnotarized code.

Application control is technically the highest-friction control to implement because it requires a complete inventory of approved applications before rollout. Many organizations underestimate this discovery phase.

2. Patch Applications

Vulnerabilities in internet-facing applications (browsers, PDF readers, office suites, email clients) must be patched within defined timeframes. At Maturity Level 2, the requirement is patching within 30 days for most vulnerabilities and within 48 hours for exploited vulnerabilities. At Maturity Level 3, the 48-hour window applies to a broader class of vulnerabilities.

Automated patch management is not optional at ML2 and above, manual patching cannot reliably meet these timeframes across a fleet of any significant size. For more background on how vulnerability severity feeds patching prioritization decisions, see CVE Prioritization and Remediation.

3. Configure Microsoft Office Macro Settings

Macros are a primary delivery mechanism for malware in enterprise environments. This control requires blocking macros from the internet, allowing only digitally signed macros from trusted locations, and logging macro execution attempts. For organizations that have standardized on Apple devices with no Microsoft Office dependency, this control is still assessed but scoped accordingly.

4. User Application Hardening

This control focuses on disabling or restricting features in browsers and other user-facing applications that are routinely exploited: Flash (now largely obsolete), web advertisements, and browser-based code execution. Modern implementations focus on browser extension controls, JavaScript execution policies, and disabling legacy features in PDF readers and office applications.

5. Restrict Administrative Privileges

Users should not have local administrator rights unless their role requires it, and admin accounts should not be used for email or web browsing. This is one of the most impactful controls because privilege escalation is a step in nearly every serious breach. Implementing it requires an audit of who currently has admin rights and a process to remove and request elevated access through a controlled workflow.

6. Patch Operating Systems

Similar to patching applications, but applied to OS-level vulnerabilities. The patching timeframe requirements mirror those for applications: 30 days for standard vulnerabilities, 48 hours for actively exploited ones at ML2. Unsupported operating systems, those no longer receiving vendor patches, must be removed from production environments.

7. Multi-Factor Authentication (MFA)

MFA must be enforced for all remote access, privileged accounts, and access to important data repositories. At ML3, phishing-resistant MFA (hardware security keys or passkeys) is required for privileged and sensitive access. SMS-based MFA does not meet ML3 requirements and is discouraged at ML2. This is consistently cited as one of the highest-ROI controls given how frequently credential theft drives incidents.

8. Regular Backups

Backups of important data, software, and configuration settings must be performed regularly and tested. The key requirements include: backups stored offline or in a separate environment from the production systems they protect, backup integrity tested regularly, and recovery procedures documented and rehearsed. Backups that are connected to the same network segment they protect are a common failure point in ransomware incidents.

Essential Eight Maturity Levels: How They Actually Work

The Essential Eight uses a four-tier maturity scale from 0 to 3. Understanding how overall maturity is determined is critical, because it is not an average.

Maturity Level 0: One or more of the eight controls is not implemented at all, or is implemented in a way that is ineffective.

Maturity Level 1: Controls are in place to address opportunistic threats. Attackers using commodity tools and techniques would be blocked, but targeted attacks would likely succeed. MFA is required for remote access and privileged accounts. Patching happens within 30 days. Application control covers user-accessible areas.

Maturity Level 2: Controls address more capable adversaries. Patching timelines tighten for exploited vulnerabilities. MFA is required for a broader set of access scenarios. Application control covers all user-accessible areas and server-side as well. Privileged access management becomes more structured.

Maturity Level 3: Controls address advanced persistent threats. Phishing-resistant MFA is mandatory for privileged access. Patching expectations are more aggressive. Application control is comprehensive and validated. Privileged access workstations are required for admin activities.

The weakest-link rule: Your organization's overall maturity level is determined by the lowest maturity level achieved across all eight controls. If you are at ML2 for seven controls but ML1 for backups, your overall maturity is ML1. This has significant implications for implementation sequencing, organizations often make the mistake of fully implementing two or three controls before touching the others, only to realize their overall maturity has not moved.

The ASD recommends ML2 as the baseline target for most organizations. Federal government entities have mandatory compliance obligations. For many private sector organizations, ML2 is also becoming a requirement in government contracts and insurance policy terms.

Who Needs to Comply with Essential Eight

The formal compliance requirement applies to non-corporate Commonwealth entities under the Public Governance, Performance and Accountability Act 2013. Federal agencies are required to report against the Essential Eight maturity model annually.

Beyond the formal mandate, Essential Eight compliance is increasingly expected in:

• Government supply chains: Contractors and vendors handling government data are often required to meet ML1 or ML2 as a contract condition
• Critical infrastructure sectors: Energy, water, health, and financial services organizations are under increasing regulatory pressure aligned to the Essential Eight
• Cyber insurance: Australian insurers are explicitly asking about Essential Eight controls and maturity levels during underwriting and renewals
• State government agencies: Several Australian state governments have adopted Essential Eight as their security baseline

Private sector organizations not subject to any of the above may still find the Essential Eight a practical, well-structured framework for building a security program, particularly because it is more specific and actionable than many international frameworks.

---

Implementing the Essential Eight: Where to Start

Most organizations do not start from zero, but many discover that their existing controls are patchier than assumed. A practical implementation sequence:

Step 1: Honest baseline assessment

Conduct a gap assessment against each control at ML1 before targeting ML2. The ASD publishes a self-assessment guide. Be honest about partial implementations, a patching process that covers 80% of devices but misses contractors' machines is an ML0 or ML1 finding, not ML2.

Step 2: Prioritize MFA and patching first

MFA and patching (both applications and OS) deliver disproportionate risk reduction relative to implementation cost. They also tend to have clearer tooling paths than application control. Getting these to ML2 while application control is still in its discovery phase is a reasonable sequencing choice.

Step 3: Build your application inventory before enforcing application control

Application control failures are almost always caused by rushing to enforcement before the approved application list is complete. Run in audit or monitoring mode for 30 to 60 days to capture everything actually running in your environment before creating blocking policies.

Step 4: Audit and remediate admin privileges

Run a full audit of local admin rights across your fleet. In most organizations, the actual number of accounts with local admin access is significantly higher than the IT team estimates. Remove access first, then build the request and approval process.

Step 5: Address backup testing, not just backup creation

Most organizations have backups. Many organizations have never tested recovery from those backups. The Essential Eight assesses backup integrity and recovery validation, not just whether backups exist.

For organizations running mixed Windows and Apple environments, implementation complexity increases significantly. Most vendor tooling and documentation for the Essential Eight assumes a Windows-centric environment. Apple device management requires purpose-built MDM capabilities to enforce the same controls. Understanding how device management works across different OS platforms is foundational before attempting to enforce Essential Eight controls at scale.

Essential Eight on Apple Devices: The Gap Nobody Addresses

Every competitor content piece on the Essential Eight assumes Windows. This is a real problem for organizations running significant macOS and iOS fleets, which now includes most of financial services, legal, media, and technology sectors in Australia.

Here is how each control maps to Apple-specific implementation considerations:

Application control on macOS: Apple's built-in Gatekeeper restricts applications to those from the App Store or identified developers, but this is not equivalent to ML2 application control. True allowlisting on macOS requires MDM-enforced restrictions on application execution, combined with macOS-aware application control tooling. The endpoint hardening guide covers macOS-specific hardening in more detail.

Patching macOS and iOS: Apple releases security updates frequently, and the patching timeframe requirements at ML2 and ML3 are aggressive. Automated patching via MDM, including silent OS updates and application updates, is the only realistic path to compliance at scale. Manual patching on a 48-hour timeline for a 500-device fleet is not operationally feasible.

Restricting admin privileges on Mac: Local admin rights on macOS are often granted by default during enrollment, particularly in self-service or BYOD scenarios. MDM policies can enforce standard user accounts and control privilege escalation. 

MFA on Apple devices: Apple devices support hardware security keys and passkeys natively, which means Apple environments can actually achieve phishing-resistant MFA for ML3 more cleanly than some Windows configurations. The challenge is consistent enforcement across all access scenarios, which requires coordination between MDM, identity provider, and application configurations.

Macro settings and Office on Mac: Microsoft 365 on macOS supports macro policy controls through Microsoft's configuration profiles, deployable via MDM. The controls work similarly to Windows, but the deployment mechanism is different and needs to be tested in macOS-specific workflows.

How Iru Approaches Essential Eight Compliance

Iru's approach starts from the recognition that Essential Eight compliance is both a technical enforcement problem and an evidence collection problem. You need to actually enforce the controls, and you need to be able to prove they are enforced at assessment time.

Iru Endpoint for device-level control enforcement:

Iru Endpoint is built specifically for Apple device management. For organizations with macOS and iOS devices, it enforces several Essential Eight controls directly:

• Automated macOS and iOS patch deployment meets the patching timeframe requirements at ML2 and ML3 without manual intervention. Patch status is tracked per device and visible in real time.
• MDM-enforced application restrictions support the application control requirement on Apple devices, including blocking unauthorized applications and enforcing Gatekeeper policies.
• Configuration profiles enforce standard user accounts, preventing local admin access by default and creating a controlled path for privilege escalation requests.
• Security baseline blueprints can be built around Essential Eight requirements and deployed across an entire Apple fleet from a single policy, rather than configuring each control separately.
• Endpoint security integrations extend user application hardening coverage beyond what native MDM profiles alone provide.

Iru Compliance for control mapping and audit evidence:

Iru Compliance maps your implemented controls to Essential Eight requirements and collects evidence continuously. When an assessor asks for evidence that patching occurred within the required timeframe, or that admin privileges were restricted across the fleet, Iru Compliance surfaces that evidence from Iru Endpoint's telemetry automatically.

The practical value: instead of spending the two weeks before an assessment manually pulling device reports and patch logs, the evidence is already organized and current. Control gaps surface in real time rather than at assessment time, which means you can remediate proactively.

For organizations with mixed Windows and Apple environments, Iru's compliance layer aggregates evidence across both, giving assessors a unified view rather than two separate reporting streams.

Getting to Essential Eight Maturity Level 2 in a Mixed Fleet

ML2 is the right target for most organizations, and achieving it requires consistency across every device in scope, not just the ones your MDM already manages well.

A few things that derail ML2 assessments in practice:

• Contractor and guest devices that fall outside MDM scope but access organizational systems. Resolve this through network access control policies and clear scoping agreements.
• Legacy systems running unsupported operating systems. ML2 requires removing or isolating systems that no longer receive vendor patches. Document compensating controls if immediate decommission is not feasible.
• Inconsistent MFA enforcement where some applications enforce MFA and others do not. ML2 requires consistent MFA for all remote access and privileged accounts, not selective enforcement.
• Application control gaps where the approved application list exists but is not regularly reviewed. New applications get installed through shadow IT channels and bypass control policies. Regular reconciliation of what is running against what is approved is a process control, not just a technical one.

The weakest-link rule means any of these gaps can hold your overall maturity at ML1 even if everything else is solid. Consistent compliance automation helps surface these gaps before an assessor does.

Essential Eight Compliance Starts with Enforcement, Not Paperwork

The Essential Eight is one of the most practical cybersecurity frameworks available because it is grounded in how attacks actually happen. The controls are specific, the maturity model is honest about what different levels actually protect against, and the self-assessment process is accessible without a consultant.

The gap most organizations run into is not understanding the framework. It is implementing and sustaining the controls consistently across every device in scope, particularly when the fleet includes Apple devices that most Essential Eight tooling was never designed for.

Essential Eight compliance gets significantly easier when enforcement and evidence live in the same place. Iru offers device management and compliance as separate products or as one, whichever matches where you are today. Whether you need to enforce application control and patching on a macOS fleet, collect audit evidence for your next ASD self-assessment, or both, Iru is built for it.