ACSC Essential Eight

Essential Eight Compliance

The Essential Eight is the Australian Cyber Security Centre baseline for protecting against ransomware and business email compromise. Oxana maps your environment to it, closes the gaps, and helps you reach and evidence the right maturity level.

Start a Readiness Assessment Pair with SMB1001 Certification

The eight controls

An Essential Eight cybersecurity audit assesses your environment against the ACSC's eight mitigation strategies: application control, patching applications, macro settings, user application hardening, restricting admin privileges, patching operating systems, multi factor authentication, and regular backups. Oxana maps each control to a maturity level, identifies gaps, and produces a prioritised remediation roadmap with evidence documentation.

Application Control

Only approved applications can run, blocking ransomware and malware executables at the source.

Patch Applications

Internet facing applications patched within 48 hours of a critical release, two weeks for others.

Macro Settings

Microsoft Office macros blocked from the internet, with only vetted, signed macros permitted.

User Application Hardening

User application hardening locks down browsers and Office against Flash, Java, ads and unnecessary features attackers exploit. The most exploited control after phishing, and the one with the highest commercial value when evidence is required.

Restrict Admin Privileges

Administrator access limited to those who need it, with separate accounts for privileged and daily tasks.

Patch Operating Systems

Operating systems patched on the same cadence, with no unsupported versions in use.

Multi Factor Authentication

MFA enforced on every internet facing service and all privileged accounts, the single highest impact control.

Regular Backups

Daily backups stored offline or immutably, with restores tested so recovery is guaranteed.

Maturity levels

Each control is measured at three maturity levels. We help you target the level that matches your risk and your obligations.

Maturity Level 1

Partially implemented. Reduces opportunistic, targeted attacks. The realistic starting point for most SMEs.

Maturity Level 2

Mostly implemented. Reduces more sophisticated threats and is the target for businesses handling sensitive data.

Maturity Level 3

Fully implemented. Aligns with a strong security posture for high value or regulated organisations.

The modern threat landscape for Australian mid-market companies

Traditional firewalls and antivirus are no longer enough for Sydney based professional services firms, manufacturers, and distributors. Modern attacks bypass perimeter defenses through phishing, compromised credentials, and supply chain compromise. The Essential Eight addresses the attack paths that actually lead to breaches: unpatched applications, macro based malware, excessive admin privileges, and weak identity controls.

Perimeter defenses are bypassed

Modern attacks do not break through the firewall. They walk in through a phishing email, a reused password, or a compromised supplier. Once inside, the perimeter cannot help you.

Mid-market firms are the target

Sydney professional services, manufacturers, and distributors hold valuable data and have weaker security postures than enterprises. Ransomware groups specifically target this segment because the payout is reliable.

Insurance demands evidence

Cyber insurers and enterprise customers now require documented controls, not promises. The Essential Eight gives you the framework and the evidence to prove your posture is mature.

Operationalising the ASD Essential Eight

Oxana implements the Essential Eight across three maturity levels using a structured, evidenced approach. Here is how we operationalise the three controls that stop the most attacks: application control, patch management, and multi factor authentication.

Application control (application whitelisting)

Level 1

Block known malicious executables using Microsoft Defender for Endpoint in audit mode. Identify the applications your business actually needs and build an allow list.

Level 2

Enforce application control in block mode using Windows Defender Application Control or AppLocker. Only approved, signed applications can run.

Level 3

Centralise policy via Intune, enforce on all endpoints including servers, and document the change management process for adding new approved applications.

Patch management (applications and operating systems)

Level 1

Inventory all internet facing applications and operating systems. Patch critical vulnerabilities within two weeks, internet facing applications within 48 hours of a critical release.

Level 2

Automate patching via Intune and Microsoft Configuration Manager. Patch all applications, not just internet facing ones, on a defined monthly cycle.

Level 3

Patch within 48 hours of release for all vulnerabilities. Remove unsupported applications and operating systems entirely. No exceptions for legacy software.

Multi factor authentication

Level 1

Enforce MFA on all internet facing services and all privileged accounts using Microsoft Entra ID. Prioritise email, VPN, and admin portals.

Level 2

Extend MFA to all users and all remote access. Require phishing resistant MFA (number matching, hardware keys) for privileged accounts.

Level 3

Enforce phishing resistant MFA universally. Block legacy authentication protocols entirely. Monitor and alert on MFA fatigue and token theft attempts.

Compliance vs security: why checking boxes is not enough

Essential Eight compliance and cyber insurance compliance are not the same as true organisational resilience. Compliance proves you have implemented controls to a stated level at a point in time. Resilience means your people, processes, and technology can detect, respond to, and recover from an attack that gets through. Oxana helps you achieve both: documented compliance for insurers and auditors, and operational resilience through 24/7 monitoring, tested backups, and incident response readiness.

Compliance

  • Documented controls at a maturity level
  • Evidence for insurers and auditors
  • Point in time attestation
  • Meets contractual obligations

Resilience

  • 24/7 detection and response
  • Tested backups and recovery
  • Incident response playbooks
  • Continuous improvement

Implement the Essential Eight, then prove it with SMB1001

Many of our clients implement the Essential Eight controls and then certify to SMB1001 so customers, insurers and suppliers can see the evidence.

Explore SMB1001

Frequently asked questions

The Essential Eight is the Australian Cyber Security Centre baseline of eight mitigation strategies designed to protect organisations against ransomware, business email compromise and other common cyber attacks.

It is mandatory for Australian government entities under the PSPF. For private businesses it is not legally mandatory, but it is increasingly required by insurers, enterprise customers and government suppliers as evidence of a sound security posture.

The Essential Eight is a set of controls published by the ACSC with no formal certification. SMB1001 is an assessable certification standard built for small and medium businesses. Many businesses implement the Essential Eight and then certify to SMB1001 to prove it.

Reaching Maturity Level 1 typically takes four to eight weeks. Level 2 can take three to six months as it introduces more advanced controls like application control and EDR. Oxana scopes a roadmap after an initial assessment.

User application hardening is one of the eight Essential Eight controls. It means configuring browsers, Microsoft Office and PDF readers so they cannot run the content and extensions attackers most often abuse, including Flash, Java, legacy ActiveX, JavaScript from untrusted sources and web advertisements. The goal is to stop malware and exploits from executing through the applications your staff use every day, without breaking legitimate workflows. Oxana implements user application hardening across your estate using Microsoft Defender for Endpoint, Intune, Group Policy and Edge settings, then helps you evidence the maturity level for insurers, customers and auditors.

Evidence is what insurers and enterprise customers ask for. Oxana documents the configuration baselines per platform, captures the Microsoft Defender for Endpoint and Intune policy states, and produces an attestation report showing each control meets the maturity level you are claiming. This is the same evidence package that supports SMB1001 certification and PSPF alignment.

Standard IT security is a general posture that may include antivirus, a firewall, and ad hoc patching. Essential Eight compliance is a structured, evidenced framework published by the Australian Cyber Security Centre that defines eight specific mitigation strategies across three maturity levels. Compliance means every control is implemented to a stated maturity level and documented with evidence that insurers, enterprise customers, and auditors can verify. Standard IT security is a starting point; Essential Eight compliance is the benchmark that proves your security is mature.

For a 50 user firm, a typical Essential Eight remediation roadmap takes eight to twelve weeks to reach Maturity Level 1, and four to six months to reach Maturity Level 2. The timeline depends on the current state of your environment, the number of legacy applications, and whether cloud identity is already centralised. Oxana scopes a firm timeline after an initial assessment and delivers the roadmap in weekly sprints so your team can see progress without disruption.

Oxana is one of the few Sydney based managed service providers that implements Essential Eight to Maturity Level 3 across application control, patch management, and multi factor authentication. Level 3 requires phishing resistant MFA on every account, patching within 48 hours of release for all vulnerabilities, and fully enforced application control on every endpoint including servers. We deliver this with Microsoft Defender for Endpoint, Intune, and Entra ID, and evidence it for insurers and auditors.

Level 3 adds three things Level 2 does not: phishing resistant MFA on every account (not just privileged), patching within 48 hours of release for all vulnerabilities (not just internet facing), and fully enforced application control on servers as well as endpoints with no exceptions for legacy software. Level 3 also requires removing unsupported applications and operating systems entirely. Most Sydney mid-market firms target Level 2 and move to Level 3 when insurers or enterprise customers require it.

Find out where you stand against the Essential Eight

Our readiness assessment maps your current environment and gives you a prioritised uplift roadmap.

Book a Readiness Assessment Managed Cybersecurity