Why the Essential Eight matters here
The Australian Signals Directorate's Essential Eight is the de facto baseline for Australian organisations. Federal entities are mandated to Maturity Level 2, and it is increasingly written into supplier contracts, tender responses and cyber insurance questionnaires for private businesses.
Most breaches we respond to in Australia would have been prevented or contained by two controls alone: patching internet-facing applications within 48 hours, and enforcing phishing-resistant multi-factor authentication on remote access.
How to use this checklist
Work through each of the eight mitigation strategies and mark every line as Implemented, Partial or Not Started. Anything marked Partial is where audit findings and incidents cluster.
Target Maturity Level 1 across all eight strategies before pushing any single control to Level 2 — uneven maturity leaves an exploitable path.
The checklist
1. Application control
- Allowed executables, scripts, installers and DLLs are defined for user profiles and temp folders
- Application control is enforced (not audit-only) on all workstations
- Blocked execution events are centrally logged and reviewed
2. Patch applications
- Internet-facing services patched within 48 hours of a critical CVE
- Office suite, browsers, PDF and collaboration tools patched within 2 weeks
- Automated vulnerability scanning runs at least fortnightly
- Unsupported or end-of-life applications removed from the fleet
3. Configure Microsoft Office macro settings
- Macros blocked for users with no documented business requirement
- Macros from the internet blocked at the platform level
- Macro execution events logged and alerted on
4. User application hardening
- Web browsers block Java, Flash and web advertisements
- Browser and Office security settings cannot be changed by users
- PowerShell script block logging enabled
5. Restrict administrative privileges
- Privileged accounts validated on creation and revalidated annually
- Privileged accounts cannot browse the internet or read external email
- Just-in-time or time-bound admin elevation in place
- Separate unprivileged account used for day-to-day work
6. Patch operating systems
- OS patches applied within 48 hours for internet-facing systems
- Workstation and server OS patched within 1 month
- Firmware and network device patching schedule documented
7. Multi-factor authentication
- MFA enforced on all remote access, VPN and RDP paths
- MFA enforced on email, cloud productivity and file sharing
- Phishing-resistant MFA (FIDO2 / passkeys / certificate) for privileged users
- Legacy authentication protocols disabled
8. Regular backups
- Backups of data, software and configuration performed and tested
- At least one immutable or offline copy retained
- Restoration tested end-to-end in the last 3 months
- Unprivileged accounts cannot delete or modify backups