ACSC Essential Eight

Australia

8 domains

24 controls

Australian Cyber Security Centre Essential Eight Maturity Model: eight prioritised mitigation strategies with three maturity levels.

Verified

Framework summaries on this platform are AI-assisted interpretations for educational and compliance planning purposes. They do not reproduce or replace the official standards. Refer to the authoritative source for the definitive text. Framework names and trademarks belong to their respective organisations.

Framework Domains (8)

Application Control

3 controls

Controls in the Application Control domain of ACSC Essential Eight — 3 controls
Code	Title	Description
E8-APP-ML1	Application Control (ML1)	Application control is implemented on workstations. Application control is applied to user profiles and temporary folder...
E8-APP-ML2	Application Control (ML2)	All ML1 requirements plus: Application control is implemented on internet-facing servers. Application control is applied...
E8-APP-ML3	Application Control (ML3)	All ML2 requirements plus: Application control is implemented on non-internet-facing servers. Application control restri...

Configure Microsoft Office Macro Settings

3 controls

Controls in the Configure Microsoft Office Macro Settings domain of ACSC Essential Eight — 3 controls
Code	Title	Description
E8-MACRO-ML1	Configure Microsoft Office Macro Settings (ML1)	Microsoft Office macros are disabled for users that do not have a demonstrated business requirement. Microsoft Office ma...
E8-MACRO-ML2	Configure Microsoft Office Macro Settings (ML2)	All ML1 requirements plus: Microsoft Office macros are blocked from making Win32 API calls.
E8-MACRO-ML3	Configure Microsoft Office Macro Settings (ML3)	All ML2 requirements plus: Only Microsoft Office macros running from within a sandboxed environment, a Trusted Location...

Multi-factor Authentication

3 controls

Controls in the Multi-factor Authentication domain of ACSC Essential Eight — 3 controls
Code	Title	Description
E8-MFA-ML1	Multi-factor Authentication (ML1)	Multi-factor authentication is used to authenticate users to their organisation's online services that process, store or...
E8-MFA-ML2	Multi-factor Authentication (ML2)	All ML1 requirements plus: MFA is used to authenticate privileged users of systems. MFA is used to authenticate unprivil...
E8-MFA-ML3	Multi-factor Authentication (ML3)	All ML2 requirements plus: MFA is used to authenticate users of data repositories. MFA used for authenticating customers...

Patch Applications

3 controls

Controls in the Patch Applications domain of ACSC Essential Eight — 3 controls
Code	Title	Description
E8-PATCHAPP-ML1	Patch Applications (ML1)	An automated method of asset discovery is used at least fortnightly to support detection of assets for subsequent vulner...
E8-PATCHAPP-ML2	Patch Applications (ML2)	All ML1 requirements plus: A vulnerability scanner is used at least fortnightly to identify missing patches in applicati...
E8-PATCHAPP-ML3	Patch Applications (ML3)	All ML2 requirements plus: Patches or vendor mitigations for office productivity suites, web browsers and their extensio...

Patch Operating Systems

3 controls

Controls in the Patch Operating Systems domain of ACSC Essential Eight — 3 controls
Code	Title	Description
E8-PATCHOS-ML1	Patch Operating Systems (ML1)	An automated method of asset discovery is used at least fortnightly. A vulnerability scanner with an up-to-date vulnerab...
E8-PATCHOS-ML2	Patch Operating Systems (ML2)	The same set of requirements as ML1, applied consistently across the in-scope estate. ACSC defines ML2 for Patch Operati...
E8-PATCHOS-ML3	Patch Operating Systems (ML3)	All ML2 requirements plus: A vulnerability scanner is used at least fortnightly to identify missing patches in drivers a...

Regular Backups

3 controls

Controls in the Regular Backups domain of ACSC Essential Eight — 3 controls
Code	Title	Description
E8-BACKUP-ML1	Regular Backups (ML1)	Backups of data, applications and settings are performed and retained in accordance with business criticality and busine...
E8-BACKUP-ML2	Regular Backups (ML2)	All ML1 requirements plus: Privileged user accounts (excluding backup administrator accounts) cannot access backups belo...
E8-BACKUP-ML3	Regular Backups (ML3)	All ML2 requirements plus: Unprivileged user accounts cannot access their own backups. Privileged user accounts (excludi...

Restrict Administrative Privileges

3 controls

Controls in the Restrict Administrative Privileges domain of ACSC Essential Eight — 3 controls
Code	Title	Description
E8-ADMIN-ML1	Restrict Administrative Privileges (ML1)	Requests for privileged access to systems, applications and data repositories are validated when first requested. Privil...
E8-ADMIN-ML2	Restrict Administrative Privileges (ML2)	All ML1 requirements plus: Privileged access to systems, applications and data repositories is disabled after 12 months...
E8-ADMIN-ML3	Restrict Administrative Privileges (ML3)	All ML2 requirements plus: Privileged access to systems, applications and data repositories is limited to only what is r...

User Application Hardening

3 controls

Controls in the User Application Hardening domain of ACSC Essential Eight — 3 controls
Code	Title	Description
E8-UAH-ML1	User Application Hardening (ML1)	Internet Explorer 11 is disabled or removed. Web browsers do not process Java from the internet. Web browsers do not pro...
E8-UAH-ML2	User Application Hardening (ML2)	All ML1 requirements plus: Web browsers are hardened using ASD and vendor hardening guidance with the most restrictive g...
E8-UAH-ML3	User Application Hardening (ML3)	All ML2 requirements plus: .NET Framework 3.5 (includes .NET 2.0 and 3.0) is disabled or removed. Windows PowerShell 2.0...

Frequently Asked Questions

What is ACSC Essential Eight?

ACSC Essential Eight is a compliance framework from Australia with 8 domains and 24 controls. Australian Cyber Security Centre Essential Eight Maturity Model: eight prioritised mitigation strategies with three maturity levels. It is used by organisations to establish and maintain compliance with industry standards and regulatory requirements.

How many controls does ACSC Essential Eight have?

ACSC Essential Eight has 24 controls organised across 8 domains. The largest domains are Application Control (3 controls), Configure Microsoft Office Macro Settings (3 controls), Multi-factor Authentication (3 controls). Each control defines specific requirements that organisations must implement to achieve compliance.

What frameworks does ACSC Essential Eight map to?

ACSC Essential Eight does not currently have cross-framework mappings in our system. Check back as we continuously expand our mapping database.

How do I get started with ACSC Essential Eight compliance?

Start your ACSC Essential Eight compliance journey by running a self-assessment on our platform to identify your current compliance posture. Our AI advisory can answer specific questions about ACSC Essential Eight requirements, and cross-framework mapping helps you leverage existing controls from other frameworks you may already comply with. Create a free account to access all 24 controls and track your progress.

Start Your Compliance Journey

Create a free account to run self-assessments, get AI advisory, and track your compliance progress across 769 frameworks.

Get Started Free →

Free forever — no credit card required