Essential Eight compliance for Australian businesses
The Essential Eight is the Australian Signals Directorate's set of eight baseline cyber security controls, assessed across maturity levels 0 to 3. Most regulated businesses target Maturity Level 2, and it is the current minimum for DISP membership. On 15 October 2026 ASD launched its successor, ASD Essentials, with separate chapters for enterprise IT, cloud and operational technology. ASD will maintain both frameworks during a transition it has not yet dated, the Essential Eight remains what DISP and most contracts reference today, and the controls you build for it carry across.
The eight controls are application control, patching applications, configuring Microsoft Office macros, user application hardening, restricting administrative privileges, patching operating systems, multi-factor authentication, and regular backups.
Start here
What does Essential Eight Maturity Level 1 involve?
What is Essential Eight Maturity Level 2, and what does it involve?
Is Microsoft Defender for Business enough for Essential Eight ML2?
Is the Essential Eight being retired, and what is ASD Essentials?
Does ASD Essentials for cloud apply to a Microsoft 365 Business Premium business?
How Blue Arc IT Solutions helps
We run a gap assessment against your target maturity level, or against the ASD Essentials chapter that fits your environment, implement and maintain the controls, and produce the evidence you need for audits, tenders or DISP self-assessment. We have supported Australian businesses since 2004 and are experienced supporting DISP member organisations. For Defence-industry work in particular, see our DISP IT support in Canberra.
Last reviewed: 19 October 2026, against ASD's Essentials launch announcement and Essentials FAQ (published 15 October 2026), the Essential Eight maturity model (unchanged since 27 November 2023) and Defence's DISP cyber and assurance page, which still requires the full Essential Eight at Maturity Level 2. ASD has not yet published a transition timeline.
Frequently asked questions
What Essential Eight maturity level should we target?
Most regulated Australian businesses target Maturity Level 2, and it is the minimum for DISP membership. The right target depends on your contracts, sector and risk, which we assess before recommending a level.
Is the Essential Eight still worth doing now ASD Essentials has launched?
Yes. ASD says organisations should keep meeting current regulatory obligations until regulators communicate changes, DISP still requires Maturity Level 2, and every Essential Eight mitigation strategy maps to at least one principle in ASD Essentials, so the controls carry across. Your maturity level rating does not convert automatically, but your controls and evidence do count.
Should a Microsoft 365 business use the enterprise IT or cloud chapter?
If you run no servers and your technology is delivered entirely as cloud services, ASD points you to Essentials for cloud. If you still run on-premises servers, an on-premises Active Directory or rented virtual machines, start with Essentials for enterprise IT. ASD expects most organisations to need both chapters over time.