Free checklist
Essential Eight checklist, in plain English
Our free Essential 8 checklist turns every Maturity Level One requirement into a yes or no question your team can answer in an afternoon. It shows what Level Two adds, the evidence an assessor will want to see and what to fix first.
- 8Mitigation strategies, each with its own checks
- ML1Every Maturity Level One requirement, as a question
- ML2What Level Two adds, strategy by strategy
- Nov 2023ASD maturity model version it follows
01What is inside
A checklist you can answer in an afternoon
Written for business owners and IT managers, not auditors. Each check is one question with a yes, a no or a not sure.
Every Level One requirement
All eight strategies broken into plain questions, from patching timeframes to who can delete your backups.
What Level Two adds
For each strategy, the extra controls Level Two asks for, if a contract, insurer or client wants it.
The evidence to keep
What an assessor will ask to see, so you collect it as you go rather than scrambling later.
A simple score
Count your yes answers per strategy to see which ones are close and which need real work.
What to fix first
The order we usually recommend, starting with the controls that stop the most common attacks.
The move to Essentials
What ASD's new Essentials series means for the work you do now. See what is replacing the Essential Eight.
02At a glance
The eight strategies and what Level One asks
A one line summary of each strategy. The checklist breaks every line into the individual requirements.
| Strategy | What it stops | Maturity Level One, in one line |
|---|---|---|
| Patch applications | Attackers using known holes in apps and browsers | Critical fixes for internet facing services within 48 hours, and office apps, browsers and PDF software patched within two weeks |
| Patch operating systems | Attackers using known holes in Windows and servers | Critical fixes for internet facing servers within 48 hours, workstations within a month and no unsupported systems |
| Multi-factor authentication | Stolen passwords | A second factor on online services that hold sensitive data, including third party services |
| Restrict administrative privileges | Attackers taking over admin accounts | Separate admin accounts that are checked when first given and cannot browse the web or read email |
| Application control | Malicious programs running on computers | Only approved programs, scripts and installers can run on workstations |
| Restrict Microsoft Office macros | Malicious macros in documents | Macros off unless there is a business need, and macros from the internet blocked |
| User application hardening | Attacks through the web browser | Browsers block Java and web ads from the internet, and Internet Explorer 11 is off |
| Regular backups | Losing data to ransomware or mistakes | Backups taken, protected from change and deletion, and restores tested |
Swipe the table sideways to see every column.
A plain English summary of the ASD Essential Eight maturity model (November 2023). The ASD maturity model is the authority on each requirement.
03Download
Get the Essential Eight checklist
Fill in the form and the download appears straight away. It is a PDF you can print, share with your IT provider or fill in on screen.
- 01Every Maturity Level One requirement as a yes or no question
- 02What Maturity Level Two adds for each strategy
- 03The evidence to keep, and a simple way to score yourself
- 04What changes as ASD moves to its Essentials series
Send me the checklist
Takes a minute. The download appears as soon as you send the form.
The form did not load. A browser extension may be blocking it.
Email sales@austintechnology.com.au and we will send the checklist, or call 1300 787 429.
Your checklist is ready
Thanks. Open it now, or save it to work through with your team.
Download the checklist04What is changing
The Essential Eight is evolving
In June 2026 ASD announced it will evolve the Essential Eight into a new Essentials series, with the current guidance becoming its first chapter, Essentials for enterprise IT. ASD has said the Essential Eight stays live while that happens.
The work does not go to waste. Patching, multi-factor authentication, admin controls, application control and backups carry straight across, and contracts and insurers still ask for Essential Eight maturity levels today. Our explainer covers what is replacing the Essential Eight and what to do now.
What stays the same
- Patch applications and operating systems
- Multi-factor authentication
- Restrict administrative privileges
- Application control and macro controls
- Harden browsers and apps
- Regular, protected, tested backups
05After the checklist
Three ways to close the gaps
Some businesses close their gaps themselves. Others want a second opinion or someone to do the work.
Free security assessment
We review your devices, Microsoft 365, email and backups, score you against the Essential Eight and give you a plan in plain English.
SuitsBusinesses that want a second opinion on their answers.
Essential Eight uplift
We close the gaps, collect the evidence and get you ready for an independent assessment. See Essential Eight assessment and uplift.
SuitsBusinesses with a contract, tender or insurer deadline.
SecureShield plans
Keep the controls in place month after month, with a 24/7 security operations centre on every plan. See SecureShield plans.
SuitsBusinesses that want it looked after for good.
06Questions
Essential Eight checklist questions
What owners and IT managers ask before they start. Anything else, call 1300 787 429.
01What is the Essential Eight?
The Essential Eight is a set of eight mitigation strategies from the Australian Signals Directorate (ASD) that make it much harder for attackers to get into your systems and do damage. Each strategy has maturity levels, from One to Three, so you can build up your defences in stages.
02Which maturity level does our business need?
Maturity Level One is the right first target for most small and medium businesses. Level Two is often asked for by government, Defence supply chains, larger clients and some insurers. Check your contracts and insurance policy for the level they name.
03Is the Essential Eight still current?
Yes. ASD is evolving it into a new Essentials series, and has said the Essential Eight stays live while that happens. The controls in this checklist carry across. See what is replacing the Essential Eight.
04Can we assess ourselves with this checklist?
Yes, to see where you stand and what to fix first. Some contracts ask for an assessment by an independent assessor, which tests each control rather than taking answers on trust. The checklist tells you what evidence to collect for that.
05How long does it take to reach Maturity Level One?
It depends on where you start, how many devices and applications you have and how much needs to change. The checklist shows your gaps, and a free security assessment turns them into a plan with a timeline.
06Is the checklist free?
Yes. Fill in the short form and the download appears straight away. Our team may get in touch to see if you have questions, and you are under no obligation.
What our clients say
800+ reviews from the people who call our Perth service desk every day.
700+
30+
70+
-
“Turns every IT problem into a non-issue”
Arthur turns every IT problem into a non-issue and does it with real patience and professionalism. He explains things in a way that makes the process easy and always leaves us feeling supported. We appreciate the way he handles every request.
Bronte J.Indian Ocean Hotel
-
“Patient, capable and a genuine listener”
The support was outstanding. Patient, capable and a genuine listener, which is rare in support calls. He took the time to understand the issue and work through it with care. You are fortunate to have him on your team and the level of service was impressive.
Peter MidgleyPowertech
-
“Steady, thoughtful and stress free”
Jamie put in a great deal of effort to resolve the problem and it showed in the result. His approach was steady and thoughtful and the support was appreciated. It made the whole experience smooth and stress free.
Jason CavallaroCallidus Process Solutions
-
“Resolved the issue within minutes”
The consultant knew exactly what to do and resolved the issue within minutes. He talked through each step so I understood what was happening and made the process simple. The clear communication and fast resolution made a real difference.
Kirk LentonPilbara Construction
-
“The extra guidance made it more valuable”
Brady tracked down an email I could not locate and took the time to show us how to search more effectively in the future. The extra guidance was helpful and made the experience more valuable. His support was straightforward and appreciated.
Tony YoungOptimus Real Estate
-
“Resolved quickly, with none of my work lost”
They resolved my issue quickly and efficiently, which meant I didn’t lose any of the work I had done today. The support was clear and straightforward, and the outcome made a real difference to my day. Thank you.
Warner PriestInterContinental Energy
-
“Calm, patient and always willing to help”
Dev Sandhu is outstanding in his knowledge and support. He has a calm and patient way of working through any IT issue and is always willing to help at short notice. His positive attitude makes the whole experience easier and more reassuring. Thank you to Dev and the team at Austin for the consistent support.
Peter AlexanderKoch Solutions
-
“A calm and methodical engineer”
Chris Wade is a great engineer and I have a lot of respect for his professionalism. He approaches every issue with a calm and methodical attitude and communicates clearly so I always understand what is happening. His steady approach and reliability make a real difference to our team, and his support is always appreciated.
Paul GreenGlobal Cardiology
-
“Refreshing after two unreliable IT providers”
After dealing with two unreliable IT providers in recent years, it has been refreshing to place my trust in Greg and the team at Austin. They have been professional and highly competent, even under pressure. Their support has made a real difference. Thank you, and keep it up.
Mark HutchisonLifewood
07Essential Eight
Want a second opinion
on your answers?
Book a free security assessment. We check your devices, Microsoft 365, email and backups against the Essential Eight and show you what to fix first.