ASD Essential Eight mitigation strategies
The Australian Cyber Security Centre's baseline of eight mitigation strategies against common cyber threats. It is guidance, not a general legal duty; separate policy or contractual requirements may apply to particular entities.
Australian Cyber Security Centre (guidance, not legislation)
General information, not legal advice
Australian Digital Duty of Care obligations are subject to legislation and service applicability; this platform does not certify compliance. Digital Care provides tools and records to support your own risk management. It is not legal advice.
The text below is explanatory guidance, not a reproduction of legislation. The official complete text and commencement information control. These steps support your work; they do not guarantee that an obligation is met.
Does it apply to your business?
A recommended cyber-security framework, not a general statutory duty for businesses. Specific government policy, regulatory instruments or contracts may require its use; check the applicable instrument and scope.
The checklist supports action tracking only. Digital Care does not issue an Essential Eight maturity level, security audit result or certification.
Detailed guidance
ASD’s Essential Eight is a baseline of eight technical mitigation strategies intended to reduce common cyber threats. The maturity model describes progressively stronger implementations and encourages an appropriate target for the environment.
The strategies work together. A checklist, policy document or purchase of a security product does not establish maturity, successful implementation or protection against every threat. Technical validation is required for control claims.
Recommended strategies 1–4
Prevent malicious code and harden applications
Application control, patch applications, configure Microsoft Office macros and harden user applications. Apply the current maturity model’s scoped implementation details, not only the strategy names.
Recommended strategies 5–7
Limit access and address system vulnerabilities
Restrict administrative privileges, patch operating systems and use multi-factor authentication. Review coverage, exceptions, account lifecycles and whether measures actually operate.
Recommended strategy 8
Regular backups
Maintain backups with appropriate protection and test restoration. Check the current model for frequency, retention, access and recovery requirements applicable to the selected target.
Digital Care action checklist
0 of 4 preparation steps checked · This page only; not saved to your assessment or evidence records.
Identify systems, data, upload risks and your business’s security needs. Choose an appropriate target with technical support; Digital Care does not perform an Essential Eight maturity assessment.
Keep a record: System inventory and a scoped improvement objective.
Record actions for application control, application patching, macro configuration, user application hardening, restricted administrative privileges, operating-system patching, MFA and regular backups.
Keep a record: Eight-strategy action register with owners and due dates.
Use actual configuration reviews, patch records, access reviews and restore tests. A policy or unchecked supplier statement is not evidence that a control works.
Keep a record: Configuration records and dated backup-restoration results.
Record unsupported systems, exceptions and compensating measures. Obtain a qualified technical assessment if a contract or regulator requires a maturity claim.
Keep a record: Self-review of control gaps without a maturity or certification claim.
Where your plan does not include the risk register or file evidence, retain those records securely outside Digital Care and reference them in your self-review. Legal notifications and technical controls must be completed through the appropriate external channels.
Official full text & sources
Read the complete instrument on the official publisher’s website, including amendments, definitions, exemptions and commencement notes. Official sources may change after this guidance was reviewed.