ACSC Essential Eight & Microsoft 365

Strengthening Your Cyber Security with Microsoft 365

The ACSC Essential Eight is a set of cybersecurity strategies developed by the Australian Cyber Security Centre (ACSC) to help organisations protect their systems and data from cyber threats. Microsoft 365 includes a range of built-in security features such as Multi-Factor Authentication, Conditional Access, Microsoft Defender, and Intune device management that help businesses implement and maintain many of the Essential Eight security controls.

What is it?

EndPoint Security Questions?

CONTACT US

What are the Essential Eight?

The ACSC Essential Eight is a cybersecurity framework developed by the Australian Cyber Security Centre (ACSC) to help organisations protect their systems, data, and users from common cyber threats. It outlines eight key security strategies designed to reduce the risk of cyber attacks such as ransomware, malware infections, and unauthorised access. These strategies include important security practices such as patching applications, enabling Multi-Factor Authentication (MFA), restricting administrative privileges, and maintaining reliable data backups.

The Essential Eight provides organisations with a practical and structured approach to improving cybersecurity and strengthening their overall security posture. Rather than focusing on complex security frameworks, it prioritises the most effective controls that significantly reduce cyber risk.

Each strategy is measured across three maturity levels —

  • Level 1 (basic protection),
  • Level 2 (improved security management), and
  • Level 3 (advanced proactive security).

These levels help organisations progressively strengthen their cyber resilience and implement measurable, practical security improvements over time.

Find Out more Contact us


NEXT

Check Check

1. Application Control

Application Control restricts execution of unapproved software to prevent malware and unauthorized programs on systems.

Check Check

2. Application patching

Application Patching involves updating software to fix vulnerabilities, reducing security risks and preventing exploitation by attackers.

Check Check

3. Configure Microsoft Office Macro Settings

Office Macro Settings restrict macro execution in Microsoft Office to prevent malicious code from compromising systems.

Check Check

4. User Application Hardening

User Application Hardening configures apps to block unnecessary features, reducing exposure to security threats and exploits.

Check Check

5. Restrict Administrative Privileges

Restrict Administrative Privileges limits admin access to essential users, reducing potential damage from compromised accounts.

Check Check

6. Patch Operating Systems

Patch Operating Systems involves regularly updating OS to fix vulnerabilities and protect against security threats and exploits.

Check Check

7. Multi-factor Authentication

Multi-Factor Authentication uses two or more verification methods to secure accounts and prevent unauthorized access.

Check Check

8. Regular Backups

Daily Backup involves regularly copying data to secure storage, ensuring recovery after data loss or cyber incidents.

How Microsoft 365 Supports Each Essential Eight Control

1. Application Control

ACSC 1 of 8

ACSC Guidelines

Implementing strong privileged access management (PAM) practices is essential to align with the ACSC Essential Eight and maintain a secure Microsoft 365 or Windows environment. The following measures help protect your systems from misuse of elevated permissions and reduce the risk of cyber compromise:

ACSC Guidelines
• Application control is implemented on workstations and servers.
• Application control restricts the execution of executables, software libraries,
scripts, installers, compiled HTML, HTML applications, control panel applets
and drivers to an organisation-approved set.
• Microsoft’s ‘recommended block rules’ are implemented.
• Microsoft’s ‘recommended driver block rules’ are implemented.
• Application control rulesets are validated on an annual or more frequent basis.
• Allowed and blocked execution events on workstations and servers are
centrally logged.
• Event logs are protected from unauthorised modification and deletion.
• Event logs are monitored for signs of compromise and actioned when any signs
of compromise are detected

Microsoft 365 Solution

  • Application control is applied on workstations and servers using built-in tools such as Microsoft AppLocker or Windows Defender Application Control (WDAC).

  • The control blocks known malicious executables and only allows software from an approved allowlist.

  • Users cannot install or run new or unapproved applications.

  • Policies may still allow script files (e.g. .vbs, .ps1) or temporary directory execution, so protection is partial.

  • Application allow lists are maintained manually and updated as needed.

  • Application control is centrally managed via Group Policy, Intune, or other endpoint-management tools.

  • Whitelisting includes file paths, publisher certificates, and file hashes for legitimate business software.

  • The policy applies to both standard and administrative accounts.

  • Execution of applications from user profile paths (AppData, Temp, Downloads) or removable media is blocked.

  • Any attempts to bypass controls (renaming executables, using scripts) are detected and logged.

  • There is a defined change-management process for updating the allowlist and testing new applications.

  • Application control is fully integrated into the organisation’s security operations and aligned with threat intelligence.

  • Controls extend to servers, workstations, and mobile endpoints, with enforcement through Defender for Endpoint or similar EDR solutions.

  • Automation tools verify application integrity before deployment.

  • All execution from non-system directories, removable media, or untrusted network shares is blocked.

  • Policies are validated regularly and monitored for tampering.

  • Logs feed into a central SIEM/Graylog/Sentinel platform for alerting and investigation.

  • Application control works in combination with least-privilege, patch management, and vulnerability scanning

Find Out more Contact us


NEXT

2. Application Patching.

ACSC 2 of 8

ACSC Guidelines

To maintain strong cyber resilience and meet ACSC Essential Eight standards, organisations must implement structured, automated vulnerability management and application patching practices.

• An automated method of asset discovery is used at least fortnightly to support
the detection of assets for subsequent vulnerability scanning activities.
• A vulnerability scanner with an up-to-date vulnerability database is used for
vulnerability scanning activities.
• A vulnerability scanner is used at least daily to identify missing patches or
updates for security vulnerabilities in internet-facing services.
• A vulnerability scanner is used at least weekly to identify missing patches or
updates for security vulnerabilities in office productivity suites, web browsers
and their extensions, email clients, PDF software, and security products.
• A vulnerability scanner is used at least fortnightly to identify missing patches
or updates for security vulnerabilities in other applications.
• Patches, updates or vendor mitigations for security vulnerabilities in internet-
facing services are applied within two weeks of release, or within 48 hours if
an exploit exists.
• Patches, updates or vendor mitigations for security vulnerabilities in office
productivity suites, web browsers and their extensions, email clients, PDF
software, and security products are applied within two weeks of release, or
within 48 hours if an exploit exists.
• Patches, updates or vendor mitigations for security vulnerabilities in other
applications are applied within one month of release.
• Applications that are no longer supported by vendors are removed

Microsoft 365 Solution

  • At this level, organisations ensure that security updates for applications are installed within 30 days of release. Patching may be performed manually or via limited automation. The goal is to address known vulnerabilities and reduce the risk of exploitation from outdated software. Applications such as browsers, PDF readers, and Microsoft Office are prioritised. While this level establishes a security foundation, patch verification and compliance reporting may still be minimal.

  • Patching becomes more structured and automated. Critical and high-risk updates are deployed within two weeks using tools such as Microsoft Intune, Endpoint Manager, or Windows Update for Business. Unsupported or legacy applications are removed to prevent exposure. Centralised reporting and alerting are introduced, allowing IT teams to monitor compliance across all endpoints and generate audit-ready reports. This maturity level aligns with most small to medium-sized business requirements under the ACSC Essential Eight.

  • At the highest level, patch management is fully automated, verified, and continuously monitored. Updates are deployed within 48 hours of release or when a critical exploit is identified. Validation ensures every application is current and no unsupported versions exist. Continuous compliance dashboards provide visibility across the environment, supporting rapid response to new threats and demonstrating Essential Eight compliance at the highest standard.

Find Out more Contact us


NEXT

3.Office Macro Restrict

ACSC 3 of 8

ACSC Guidelines

Controlling how Microsoft Office macros are used is critical for protecting your organisation from malicious code and phishing-based attacks. Properly managing macro execution aligns with the ACSC Essential Eight and reduces the risk of malware entering through Word, Excel, or PowerPoint documents.

• Microsoft Office macros are disabled for users that do not have a demonstrated
business requirement.
• Only Microsoft Office macros running from within a sandboxed environment, a
Trusted Location or that are digitally signed by a trusted publisher are allowed
to execute.
• Only privileged users responsible for validating that Microsoft Office macros are
free of malicious code can write to and modify content within Trusted Locations.
• Microsoft Office macros digitally signed by an untrusted publisher cannot be
enabled via the Message Bar or Backstage View.
• Microsoft Office’s list of trusted publishers is validated on an annual or more
frequent basis.
• Microsoft Office macros in files originating from the internet are blocked.
• Microsoft Office macro antivirus scanning is enabled.
• Microsoft Office macros are blocked from making Win32 API calls.
• Microsoft Office macro security settings cannot be changed by users.
• Allowed and blocked Microsoft Office macro execution events are centrally logged.
• Event logs are protected from unauthorised modification and deletion.
• Event logs are monitored for signs of compromise and actioned when any signs
of compromise are detected.

Microsoft 365 Solution

  • Macros are disabled by default for most users, except for those with a documented business requirement.
    Only macros from trusted or internal sources are permitted to run.
    Users are trained to identify and avoid enabling macros from unknown sources.
    This level reduces the risk of accidental execution of malicious macros but relies partly on user awareness.

  • Macro execution is restricted to sandboxed environments or Trusted Locations, and only those digitally signed by trusted publishers can run.
    Files containing macros from the internet or email attachments are automatically blocked.
    Macro antivirus scanning is enabled, and users cannot alter macro security settings.
    Logs of allowed and blocked macros are retained and reviewed periodically.

  • Macro policies are centrally managed and enforced across all Microsoft Office applications.
    Only validated administrators can modify Trusted Locations or manage trusted publishers.
    The trusted publishers list is reviewed regularly, and Win32 API calls from macros are fully blocked.
    Macro execution events are centrally logged, protected from tampering, and actively monitored for compromise indicators.

Find Out more Contact us


NEXT

4.User Application Hardening

ACSC 4 of 8

ACSC Guidelines

User Application Hardening focuses on reducing your organisation’s attack surface by disabling or removing unnecessary features that cybercriminals commonly exploit. Applying these controls helps protect against malware, phishing, and malicious document payloads by limiting what applications can do.

• Web browsers do not process Java from the internet.
• Web browsers do not process web advertisements from the internet.
• Internet Explorer 11 is disabled or removed.
• Web browser security settings cannot be changed by users.
• Microsoft Office is blocked from creating child processes.
• Microsoft Office is blocked from creating executable content.
• Microsoft Office is blocked from injecting code into other processes.
• Microsoft Office is configured to prevent activation of OLE packages.
• Microsoft Office security settings cannot be changed by users.
• PDF software is blocked from creating child processes.
• PDF software security settings cannot be changed by users.
• ACSC or vendor hardening guidance for web browsers, Microsoft Office and PDF
software is implemented.
• .NET Framework 3.5 (includes .NET 2.0 and 3.0) is disabled or removed.
• Windows PowerShell 2.0 is disabled or removed.
• PowerShell is configured to use Constrained Language Mode.
• Blocked PowerShell script execution events are centrally logged.
• Event logs are protected from unauthorised modification and deletion.
• Event logs are monitored for signs of compromise and actioned when any signs
of compromise are detected.

Microsoft 365 Solution

  • Web browsers, Microsoft Office, and PDF software are configured to block the most common exploitation methods.

    • Java and Flash are disabled in web browsers.

    • Web advertisements are blocked to prevent malicious scripts.

    • Legacy components like Internet Explorer 11 are disabled or removed.

    • Basic restrictions stop Office and PDF programs from launching external executables.
      These controls reduce exposure to everyday internet-based attacks and phishing payloads.

  • Application hardening policies are consistently applied and centrally managed.

    • Users cannot change browser or Office security settings.

    • Microsoft Office is blocked from creating child processes, injecting code, or activating OLE packages.

    • PowerShell 2.0 and older .NET Framework versions are removed.

    • PowerShell is configured in Constrained Language Mode to limit abuse by attackers.

    • PDF readers and browsers follow vendor or ACSC hardening guidelines.
      Logs of blocked execution attempts are retained and periodically reviewed.

  • Application hardening is fully enforced across all user systems and integrated with enterprise security monitoring.

    • All policies are centrally deployed via Intune, GPO, or endpoint management tools.

    • Event logging is centralised, protected from tampering, and actively monitored for compromise indicators.

    • PowerShell and script execution are tightly controlled; only approved administrative scripts can run.

    • Continuous validation ensures browsers, Office, and PDF software remain compliant with ACSC and vendor benchmarks.
      This level provides a mature, proactive defence against exploitation of user applications.

Find Out more Contact us


NEXT

5.Restrict Administrative Privileges

ACSC 5 of 8

ACSC Guidelines

Restricting administrative privileges is one of the most important cybersecurity practices in the ACSC Essential Eight. Attackers frequently target privileged accounts to gain control of networks and data. Implementing strict access controls, auditing, and monitoring helps minimise the risk of compromise and limits the potential impact of an attack.

• Requests for privileged access to systems and applications are validated when
first requested.
• Privileged access to systems and applications is automatically disabled after 12
months unless revalidated.
• Privileged access to systems and applications is automatically disabled after 45
days of inactivity.
• Privileged access to systems and applications is limited to only what is required
for users and services to undertake their duties.
• Privileged accounts are prevented from accessing the internet, email and
web services.
• Privileged users use separate privileged and unprivileged operating
environments.
• Privileged operating environments are not virtualised within unprivileged
operating environments.
• Unprivileged accounts cannot logon to privileged operating environments.
• Privileged accounts (excluding local administrator accounts) cannot logon to
unprivileged operating environments.
• Just-in-time administration is used for administering systems and applications.
• Administrative activities are conducted through jump servers.
• Credentials for local administrator accounts and service accounts are long,
unique, unpredictable and managed.
• Windows Defender Credential Guard and Windows Defender Remote Credential
Guard are enabled.
• Privileged access events are centrally logged.
• Privileged account and group management events are centrally logged.
• Event logs are protected from unauthorised modification and deletion.
• Event logs are monitored for signs of compromise and actioned when any signs
of compromise are detected

Microsoft 365 Solution

  • Administrative privileges are limited to users who genuinely need them.

    • Admin accounts are created only when required and are reviewed periodically.

    • Privileged accounts are not used for routine tasks such as email, internet browsing, or document creation.

    • Access requests are validated before approval, and multi-factor authentication (MFA) is required for all administrative logins.

    • Logs of privileged activity are captured and stored locally for review.
      This level helps reduce exposure to credential theft and accidental misuse.

  • Administrative privileges are centrally managed and actively monitored.

    • Separate privileged and standard user accounts are enforced.

    • Privileged accounts cannot log on to unprivileged environments and vice versa.

    • Inactive accounts are automatically disabled after a defined period (e.g., 45 days).

    • Access reviews occur at least annually, and re-approval is required for ongoing admin rights.

    • Privileged accounts are blocked from accessing the internet, webmail, and external content.

    • Administrative actions are conducted through secure jump servers, and JIT (Just-in-Time) access is implemented for temporary elevation.

  • Privileged access is fully controlled, audited, and integrated into enterprise-grade identity management systems.

    • Privileged Access Management (PAM) solutions automate provisioning, monitoring, and expiry of admin rights.

    • All credentials for local and service accounts are long, unique, and centrally managed.

    • Windows Defender Credential Guard and Remote Credential Guard are enabled to prevent credential theft.

    • All privileged activity is centrally logged, protected from modification, and continuously monitored for compromise indicators.

    • Alerts from log monitoring feed directly into the organisation’s SIEM or SOC platform for real-time detection and response.
      This level represents a mature, proactive security posture aligned with the ACSC Essential Eight recommendations.

Find Out more Contact us


NEXT

6.Patch Operating Systems

ACSC 6 of 8

ACSC Guidelines

Keeping operating systems fully patched is essential to protect against known vulnerabilities and maintain compliance with the ACSC Essential Eight. Attackers often exploit outdated or unpatched operating systems to gain unauthorised access, deploy ransomware, or exfiltrate data. A strong patch-management process ensures your systems stay secure and supported.

  • An automated method of asset discovery is used at least fortnightly to support
    the detection of assets for subsequent vulnerability scanning activities.
  • A vulnerability scanner with an up-to-date vulnerability database is used for
    vulnerability scanning activities.
  • A vulnerability scanner is used at least daily to identify missing patches or
    updates for security vulnerabilities in internet-facing services.
  • A vulnerability scanner is used at least weekly to identify missing patches or
    updates for security vulnerabilities in office productivity suites, web browsers
    and their extensions, email clients, PDF software, and security products.
  • A vulnerability scanner is used at least fortnightly to identify missing patches
    or updates for security vulnerabilities in other applications.
  • Patches, updates or vendor mitigations for security vulnerabilities in internet-
    facing services are applied within two weeks of release, or within 48 hours if
    an exploit exists.
  • Patches, updates or vendor mitigations for security vulnerabilities in office
    productivity suites, web browsers and their extensions, email clients, PDF
    software, and security products are applied within two weeks of release, or
    within 48 hours if an exploit exists
  • Patches, updates or vendor mitigations for security vulnerabilities in other
    applications are applied within one month of release.
  • Applications that are no longer supported by vendors are removed

Microsoft 365 Solution

  • Operating systems are updated to protect against known vulnerabilities.

    • Security patches are applied within vendor-recommended timeframes.

    • Internet-facing systems are patched within two weeks of release, or within 48 hours if an exploit exists.

    • Internal systems (workstations, servers, and network devices) are patched within one month.

    • Unsupported or end-of-life operating systems are progressively replaced.

    • Patch activity is logged manually for accountability.

  • Patching is centrally managed and automated across the organisation.

    • All servers and workstations are enrolled in a central patch-management platform (e.g., Intune, WSUS, Endpoint Manager).

    • Vulnerability scans run at least weekly, with reports reviewed by IT security staff.

    • Internet-facing systems are updated within two weeks, or within 48 hours if exploits are detected.

    • Internal systems are patched on a monthly cycle, with compliance tracking and exception management.

    • Unsupported systems are identified and scheduled for replacement.

  • Operating-system patching is fully integrated into the organisation’s cybersecurity operations and continuous-monitoring strategy.

    • Vulnerability scanners run daily for internet-facing systems and weekly for all others.

    • Patch deployment is automated, verified, and logged centrally, with dashboards tracking compliance in real time.

    • Patching priorities are driven by threat intelligence and risk-based assessment.

    • All OS activity is monitored via SIEM or security analytics tools to detect anomalies or failed patches.

    • Only supported OS versions are used, and end-of-life systems are immediately decommissioned.
      This level ensures rapid, verified patch deployment and proactive defence against exploitation.

Find Out more Contact us


NEXT

7.Multi-factor Authentication

ACSC 7 of 8

ACSC Guidelines

Implementing Multi-Factor Authentication (MFA) is one of the most effective ways to protect accounts from unauthorised access. By requiring two or more verification methods, MFA ensures that even if a password is compromised, attackers cannot easily gain entry.
This control aligns with the ACSC Essential Eight framework and forms a crucial layer in defending against phishing, credential theft, and brute-force attacks.

  • • Multi-factor authentication is used by an organisation’s users if they
    authenticate to their organisation’s internet-facing services.
    • Multi-factor authentication is used by an organisation’s users if they
    authenticate to third-party internet-facing services that process, store or
    communicate their organisation’s sensitive data.
    • Multi-factor authentication (where available) is used by an organisation’s users
    if they authenticate to third-party internet-facing services that process, store or
    communicate their organisation’s non-sensitive data.
    • Multi-factor authentication is enabled by default for non-organisational users
    (but users can choose to opt out) if they authenticate to an organisation’s
    internet-facing services.
    • Multi-factor authentication is used to authenticate privileged users of systems.
    • Multi-factor authentication is used to authenticate users accessing important
    data repositories.
    • Multi-factor authentication is verifier impersonation resistant and uses either:
    something users have and something users know, or something users have that
    is unlocked by something users know or are.
    • Successful and unsuccessful multi-factor authentication events are
    centrally logged.
    • Event logs are protected from unauthorised modification and deletion.
    • Event logs are monitored for signs of compromise and actioned when any signs
    of compromise are detected

Microsoft 365 Solution

  • MFA is implemented for accounts that access the organisation’s key online services.

    • MFA is required for users signing in to internet-facing services such as Microsoft 365, VPNs, and remote portals.

    • Privileged accounts (administrators) must always use MFA.

    • Third-party applications containing sensitive data also require MFA where available.

    • MFA logs are retained locally, helping identify failed logins or brute-force attempts.
      This level provides basic protection against stolen credentials and unauthorised access.

  • MFA is centrally managed, consistently applied, and integrated with identity-management systems.

    • All users—internal and external—authenticating to organisational or third-party systems must use MFA.

    • MFA is enforced for all privileged accounts, users accessing critical data, and cloud-based services.

    • MFA settings cannot be bypassed or disabled by end users.

    • Logs of successful and failed MFA events are centrally collected and reviewed for anomalies.

    • Authentication relies on something users have and something they know, such as an authenticator app plus a password.
      This level ensures uniform MFA enforcement and stronger credential protection.

  • MFA is fully enforced, phishing-resistant, and integrated into the organisation’s overall cybersecurity strategy.

    • MFA uses verifier-impersonation-resistant methods, such as FIDO2 security keys, Windows Hello for Business, or certificate-based authentication.

    • All authentication events—including successful and failed logins—are centrally logged, protected, and continuously monitored for compromise indicators.

    • Logs feed directly into a SIEM or security-operations platform for real-time alerting and response.

    • MFA coverage extends to administrative, standard, and third-party accounts, including guest users and API connections.

    • Legacy authentication protocols (e.g., Basic Auth, POP, IMAP) are disabled to prevent bypass.
      At this level, MFA provides robust, organisation-wide defence against phishing, credential theft, and identity compromise.

Find Out more Contact us


NEXT

8.Regular Backups

ACSC 8 of 8

ACSC Guidelines

Performing and protecting regular backups is critical to maintaining business continuity and recovering quickly from cyber incidents such as ransomware, hardware failure, or data corruption.
This control ensures that data, software, and configuration settings can be restored to a known, secure point in time, helping organisations minimise downtime and data loss in the event of a breach.

  • • Backups of important data, software and configuration settings are performed
    and retained with a frequency and retention timeframe in accordance with
    business continuity requirements.
    • Backups of important data, software and configuration settings are
    synchronised to enable restoration to a common point in time.
    • Backups of important data, software and configuration settings are retained in a
    secure and resilient manner.
    • Restoration of important data, software and configuration settings from backups
    to a common point in time is tested as part of disaster recovery exercises.
    • Unprivileged accounts cannot access backups belonging to other accounts, nor
    their own accounts.
    • Privileged accounts (excluding backup administrator accounts) cannot access
    backups belonging to other accounts, nor their own accounts.
    • Unprivileged accounts are prevented from modifying and deleting backups.
    • Privileged accounts (including backup administrator accounts) are prevented
    from modifying and deleting backups during their retention perio

Microsoft 365 Solution

  • Backups are performed and retained regularly to protect critical information.

    • Important data, software, and configuration settings are backed up in line with business continuity requirements.

    • Backups are stored offline, offsite, or in secure cloud repositories to protect against ransomware and accidental deletion.

    • Restoration of key systems is tested periodically to confirm data can be recovered.

    • Access to backups is restricted to authorised users only.
      This level provides a basic safeguard against data loss and system outages.

  • Backups are centrally managed, consistent, and regularly verified.

    • Backups occur automatically and are synchronised to a common point in time to ensure consistency across systems.

    • Restoration testing is incorporated into disaster-recovery exercises and verified at least annually.

    • Unprivileged accounts cannot access, modify, or delete backups.

    • Backup data is encrypted and stored securely with defined retention periods.

    • Logs record backup status, restoration results, and failed backup events for review.
      This level ensures reliable, secure, and tested backups across the organisation.

  • Backups are fully automated, secured, and integrated into enterprise-grade recovery planning.

    • Backup and recovery operations are centrally orchestrated and continuously monitored.

    • Privileged accounts, including backup administrators, are prevented from modifying or deleting backups during their retention period.

    • Backups are encrypted in transit and at rest, stored in immutable or air-gapped environments, and routinely validated for integrity.

    • Recovery testing is conducted quarterly or after major system changes to confirm business-critical restoration timelines.

    • Backup logs are centrally collected, protected from modification, and monitored for signs of compromise through a SIEM or security-operations platform.
      This level provides resilient, tamper-proof, and verifiable backups aligned with the highest standards of the ACSC Essential Eight.

Find Out more Contact us


NEXT

Essential Eight Frequenty Asked Questions

The ACSC Essential Eight is a set of eight cybersecurity strategies developed by the Australian Cyber Security Centre (ACSC).
They provide a practical baseline for protecting organisations against the most common cyber threats such as ransomware, phishing, and data breaches.

Implementing the Essential Eight helps reduce the likelihood of cyber incidents and minimises the impact if one occurs.
It aligns your business with Australian Government security standards and demonstrates a proactive commitment to cybersecurity and data protection.

  1. Application Control

  2. Patch Applications

  3. Configure Microsoft Office Macro Settings

  4. User Application Hardening

  5. Restrict Administrative Privileges

  6. Patch Operating Systems

  7. Multi-Factor Authentication (MFA)

  8. Regular Backups

Together, these controls cover protection, detection, and recovery — forming a complete defence-in-depth strategy.

Each control has three maturity levels (1–3) that measure how effectively the control is implemented:

  • Level 1: Basic protection against common, opportunistic attacks.

  • Level 2: Stronger, centrally managed, and consistent defences.

  • Level 3: Advanced, automated, and continuously monitored security controls.

For Australian Government agencies, the Essential Eight is a mandatory requirement under the Protective Security Policy Framework (PSPF).
For private organisations, it’s a highly recommended best-practice framework that aligns with national cybersecurity standards.

Many cyber insurance providers and auditors now use the Essential Eight as a benchmark for security maturity.
Demonstrating compliance can reduce premiums, limit liability, and prove due diligence under regulatory frameworks.

Timeframes vary depending on your organisation’s size and current IT environment.
A typical implementation plan takes 3–12 months, progressing from Level 1 to higher maturity levels over time.

Yes — the Essential Eight is scalable and can be applied to organisations of any size.
SMBs can start with the most critical controls, such as MFA, patching, and backups, then progress toward full maturity.

Without these controls, your business remains exposed to preventable cyber threats such as ransomware, credential theft, and data loss.
Failure to implement these measures can also impact your reputation, compliance, and insurance eligibility.

Total Solutions IT (TSIT) specialises in designing and implementing ACSC-aligned cybersecurity frameworks.
We provide:

  • Secure Microsoft 365 configuration

  • Vulnerability and patch management

  • Multi-Factor Authentication and Conditional Access

  • Backup and disaster-recovery solutions

  • Ongoing monitoring and reporting

Our experts help your organisation achieve and maintain Essential Eight maturity compliance through tailored, measurable, and fully managed solutions.

Total Solutions IT provides modern and secure digital workplaces, focusing on the B2B market with comprehensive services in Telecommunications, Internet, Cloud, IT Managed Services, and Cyber Security.

Navigation

Customer Service

Contact

EMAIL
support@tsit.au

PHONE
(02) 6061 4222

ADDRESS
23 Stanley Street
Wodonga VIC 3690 Australia

Microsoft 365 App Protection PoliciesMicrosoft 365 Modern Workplace