Essential Eight uplift: a practical guide.

What it is and who is asking

The Essential Eight is a set of eight mitigation strategies published by the Australian Signals Directorate, each assessed at maturity levels one to three. It was written for government, and it escaped: cyber insurers now price against it, enterprise customers put it in security questionnaires, and boards ask for the number because it is the one security metric everyone in the room can compare. The consequence is practical. Whether or not any regulation compels you, someone with commercial leverage over your organisation will ask for your maturity level, and the quality of your answer will cost or save real money. We covered who is asking and why in a companion post; this guide covers what to do about it.

The eight, and where each one bites

Application control restricts what can execute to an approved set. It is the strategy with the biggest security payoff and the longest implementation, because it needs tooling, an accurate application inventory, and patience with the exceptions process. Patch applications and patch operating systems are measured in elapsed time from vulnerability disclosure to deployment, and this is where documented policy and observed practice diverge most: the stated 48-hour window for critical patches meets the observed six weeks in almost every first assessment.

Configure Microsoft Office macro settings and user application hardening close the paths commodity malware actually uses: macros from the internet, legacy browser features, Office spawning child processes. These are configuration work, cheap to do and commonly half-done. Restrict administrative privileges is an archaeology project everywhere: privileges accrete for years, and the first honest audit typically finds several times more admin accounts than anyone expected, many belonging to processes or people that no longer exist.

Multi-factor authentication is assessed on coverage, not existence: the maturity model asks what it protects and which paths bypass it, which is how the forgotten legacy webmail endpoint fails an otherwise strong implementation. Regular backups get credit only when restoration is tested; a backup that has never been restored end to end is a hope with a storage bill.

Choosing a target maturity level

Maturity level one defends against commodity attacks using widely available tradecraft, and it is the sensible floor for most commercial organisations. Level two addresses adversaries willing to invest in targeting you, and is increasingly the expectation for organisations holding sensitive data at scale, operating in critical sectors, or selling into government supply chains. Level three is for organisations facing well-resourced, persistent adversaries, and pursuing it without that threat profile spends money on the wrong risks. The honest inputs to the choice are your threat profile, your contractual and insurance obligations, and what your customers require, in that order. It is also legitimate, and common, to hold different levels across the eight strategies for a period, provided the gaps are chosen rather than discovered.

Assess what exists, not what is written

The single decision that determines whether an uplift succeeds is made at assessment: score controls as they operate, with evidence, rather than as they are documented. Pull the actual patch deployment records. Enumerate the actual admin accounts. Test the actual MFA coverage from outside. Restore an actual backup. An assessment done this way is mildly confronting for a week and produces an uplift plan that is short, concrete and defensible. An assessment done from documentation produces a good score and a bad surprise, delivered later by an insurer's assessor or an attacker, whichever arrives first.

Sequencing the uplift

The uplift order that works runs cheapest-first with one exception. The early wins are configuration: macro settings, application hardening, and closing MFA coverage gaps, weeks of work that move the score and the actual risk. The admin privilege cleanup comes next; it is politically harder than it is technically hard, and it needs an executive sponsor who will hold the line when exceptions are requested. Patching improves when it becomes machinery rather than effort: automated deployment, a measured cadence, and reporting that shows elapsed days so drift is visible. Backup restoration testing gets scheduled like the recurring obligation it is.

The exception to cheapest-first is application control, which should start early precisely because it takes longest: inventory in audit mode for a quarter before anything is enforced, then enforcement by tranche. Organisations that defer it to last are still deferring it two years later, and it is usually the strategy standing between them and their target level.

Keeping the level once you have it

Maturity decays by default: new systems arrive unhardened, privileges re-accrete, patch cadences slip when the person who owned them leaves. The organisations that hold their level treat it as an operating property with an owner, a re-verification cadence, and a standing line in board reporting, the same posture a finance team takes to controls. A light quarterly self-check against the evidence, and an independent re-assessment annually or after major change, keeps the answer current for whoever asks next. Our cyber security practice runs Essential Eight assessments and uplifts on exactly this basis, scored against what exists.