# Essential Eight, one strategy at a time | Eightstep > How Eightstep's services line up with each of the ACSC's Essential Eight strategies, and what changes for your people as your maturity level grows. Source: https://eightstep.com.au/articles/essential-eight-one-control-at-a-time [Articles](https://eightstep.com.au/articles) · Essential Eight # Essential Eight, one strategy at a time How the service lines up with each ACSC strategy, and what changes for your people as maturity grows. 14 October 2026 · 6 min read The Essential Eight comes up more often every year. An insurer asks for your maturity level on a renewal form. A larger client wants it in a tender response. A board member reads about it and asks where the business stands. The good news is that it's one of the clearest frameworks in Australian cyber security, and most of it is work a well-run environment should be doing anyway. This article walks through each of the eight strategies, what our services do about it, and what your people will notice as the level goes up. ## What it is, and what it isn't The Essential Eight is the Australian Cyber Security Centre's list of the eight most effective things an organisation can do to protect itself. Each strategy is measured against a maturity model with three levels. Level 1 is built to stop opportunistic attackers using widely available tools. Level 3 is built to stop capable adversaries who are willing to spend time on you in particular. Each level builds on the one below. It isn't a certification, and nobody can award you one. Our [Essential 8 assessment](https://eightstep.com.au/essential-8) is a benchmark: we test every control up to the level you're aiming for and give you a written report of where each strategy stands, with the evidence behind it. What you do next is up to you. ## The eight strategies, and what we do about each Here they are in the ACSC's order, with the plain-language version of each and how it's delivered in our [Managed IT Services](https://eightstep.com.au/it-services) and [Cyber security](https://eightstep.com.au/cyber-security). 1. **Application control.** Only approved programs and scripts can run, so unknown software can't get a foothold. Our application control starts in learning mode, recording what your business already uses, and we build the policies around that before anything is blocked. It's built to reach maturity level 3, the highest. 2. **Patch applications.** Browsers, Office, PDF software and the other applications people use every day, kept up to date, with unsupported ones removed. Patching is part of the managed service and runs to a schedule, with a report each month showing what was installed. 3. **Configure Microsoft Office macro settings.** Macros from the internet are blocked, and only the people who genuinely need macros can run the ones you approve. For most businesses this is a configuration change and a short conversation with finance about the spreadsheets that matter. 4. **User application hardening.** Browsers set up to refuse ads and risky content, with settings people can't change back. Done centrally, so a new computer gets the same settings as every other one. 5. **Restrict administrative privileges.** Admin access granted only when it's needed, kept separate from email and web browsing, and reviewed regularly. In practice this means separate admin accounts, local administrator passwords that are managed rather than shared, and a record of who can do what. 6. **Patch operating systems.** Windows, servers and network equipment patched on time, and unsupported versions replaced. Monitoring tells us which devices are behind, and the asset register tells us which ones are coming up for renewal before they fall out of support. 7. **Multi-factor authentication.** A second check on every sign-in to your online services and sensitive data, with no exceptions for seniority. This is the quickest win on the list and the one that closes the most doors. 8. **Regular backups.** Important data and settings backed up, kept safe and proven by restoring them. Backups are checked every weekday and a restore is tested every month, whether the data lives on a server, in [Microsoft 365](https://eightstep.com.au/microsoft-365-backup) or in the cloud. ## Get the next one in your inbox One email when we publish something new. No newsletters, no promotions, and you can stop any time. ## What changes for your people Maturity levels are written for assessors, so it helps to translate them into what the people in your business will actually notice. At **level 1**, the changes are mostly invisible. Updates arrive on a schedule. Everyone signs in with a second check on their phone. Macros from an email attachment stop running, and a message explains why. The only new habit is approving a sign-in prompt now and then. At **level 2**, the environment gets noticeably more deliberate. New software is requested through the service desk rather than downloaded, and your approvers decide what gets added. Anyone with admin rights has a separate account for admin work and uses their everyday account for everything else. Backups are tested more often and the results are reported to you. People notice that things are tidier, not slower. At **level 3**, the controls are tight enough to frustrate a determined attacker, and the business knows it. Application control covers every computer and server, with limits on what even approved software can do. Admin activity is logged in a record nobody can alter. Patches for the most serious vulnerabilities go on within days. By this point the environment runs on known processes rather than individual effort, which is the real goal. The common thread is that each level removes a way for a mistake to become an incident. People don't have to be perfect, because the environment doesn't rely on them being perfect. ## Start with a benchmark Every environment is already at some level on each strategy, even if nobody has measured it. That's where we start: an assessment scoped to your sites and target level, about four weeks from start to report, with the evidence quality you choose. You'll see each strategy's level today, beside the level you're aiming for, and a roadmap in the order that makes most sense, quick wins first, with one-off and ongoing costs beside each item. The roadmap is yours to work through at your own pace. We can scope and quote any recommendation, or you can hand it to your own provider. Most clients find that two or three of the strategies are already in good shape, a couple need configuration rather than spend, and the rest become a plan rather than a worry. ## One strategy at a time The Essential Eight is designed to be approached in steps, and that suits how we work. Multi-factor authentication on every sign-in this month. Separate admin accounts next month. Application control in learning mode for a quarter before it blocks anything. Each step is small enough to land cleanly and large enough to show up in the next assessment. Frameworks change and the questions on the renewal form will too. The fundamentals underneath them don't. If you'd like to know where your environment stands today, [book a scoping meeting](https://eightstep.com.au/contact) and we'll benchmark it. ## Keep reading Eightstep ### [Why eight steps?](https://eightstep.com.au/articles/why-eight-steps) Where our name comes from, and the method behind it: taking IT from chaos to a calm, well-run environment. 28 October 2026 · 6 min read Security ### [Security habits that stick.](https://eightstep.com.au/articles/security-habits-that-stick) Small, repeatable habits that give your team confidence with every email, link and login. 16 September 2026 · 4 min read