ASD Essential Eight

What is the ASD Essential Eight?

The Australian Signals Directorate (ASD) recommends eight essential strategies to prevent malware delivery, limit the impact of cybersecurity attacks and improve recovery. Released in 2017, the Essential Eight is an evolution of the ASD’s Top Four recommendations.

The Essential Eight strategies cover:

  1. Application Whitelisting 
  2. Patching Applications
  3. Restricting Administrative Privileges
  4. Patching Operating Systems
  5. Disabling Untrusted Microsoft Office Macros
  6. Using Application Hardening
  7. Multi-Factor Authentication
  8. Daily Backups


The ASD Essential Eight can mitigate up to 85% of data breaches1.

Where do you begin?

Implementing systems that minimise the impact of cyber incidents is crucial, but how do you know where your vulnerabilities lie, and which gaps to address first?

Do you know your weakest links?

It can be hard to find direction and know what best practice looks like when building a security strategy.

As an insider, it can be difficult to assess your environment objectively in order to identify risks. With limited time and resources, knowing where to begin and what to prioritise when building and implementing a security strategy can be challenging.

Threats are also constantly changing; it’s hard to keep up. In fact, 70% of today’s malware is customised to the targeted organisation2.

Pro Tip: Have an external expert assess your environment to understand your security posture.

How many security tools are you managing?

Many businesses have adopted ‘productised’ security solutions that often overlap with each other or leave gaps in your security stack. These point solutions lack the integration with your broader IT environment to make sure your organisation is secure.

Managing security across many tools creates a complex environment, which only creates more room for error. With so many systems to monitor, it’s hard to notice the red flags amongst the many notifications in order to promptly remediate issues.

Pro Tip: Don’t over-engineer your security strategy – simplicity is the ultimate sophistication.

What is the status quo costing you?

Customers without a standardised approach to security have a higher risk of attack, increased impact of attack and slower recovery. On average, it takes 281 days for an Australian organisation to identify and contain a breach3.

Breaches can incur financial and legal penalties for non-compliance. The average cost of an Australian data breach is $2.13 million3.

Compromised credentials account for 74% of data breaches, according to the Notifiable Data Breaches Scheme4.

Pro Tip: Standardise your approach to security, to better manage your defensive strategy.

eBook | The Essential Eight Explained

Authored by Logan Daley, Information Assurance Specialist at Data#3, this collection of works deep dives into the practical actions organisations can take to stay secure in an era of ever-changing threats.


Essential Eight Adoption Roadmap

Using the ASD recommendations as a framework, Data#3 has built the Essential Eight Adoption Roadmap to help organisations understand and improve their security posture.

Learn how to leverage your existing Microsoft investment to execute an Essential Eight security strategy.

What is an Essential Eight Adoption Roadmap?

The Essential Eight Adoption Roadmap is a 5-day engagement, conducted by a Data#3 Information Assurance Specialist, including up to 2 days spent onsite with the customer. The audit will help you understand your current security maturity and defensive posture, in alignment with the ASD Essential Eight.

The engagement will begin with a discovery session to understand your business, technology environment and key objectives. Technical workshops will follow, focusing on application whitelisting, patching applications, patching operating systems, multi-factor authentication, managing administrator rights, daily backups, managing Microsoft Office macros and application hardening.

The Data#3 Information Assurance Specialist will gather data and analyse each of the above factors. Detailed findings will be compiled into a report providing evidence of your current security state, as well as expert recommendations for optimisation. A high-level roadmap will be shared outlining the projects to be undertaken, indicative costs, timelines and the recommended software, hardware and services required. The report will be shared with you for review, followed by a presentation lead by the assessor to discuss your results in-depth.

What will you achieve?

  • Gain clear insight into your defensive posture and best practice advice for an integrated, Microsoft-based security platform.
  • Understand which tools, technical controls, business systems and people processes to implement in order to mature your cybersecurity practices.
  • Be confident that your organisation is protected using widely accepted mitigation strategies.
  • Improve your cybersecurity policies and procedures, including the governance of information systems throughout the enterprise.
  • Standardise on one integrated platform, understand its full functionality, simplify your security stack and get better use of your currently investments.
  • Eliminate the unnecessary costs of point products that often overlap in functionality.
  • Simplify your team’s training and product knowledge requirements.
  • Increase efficiency and save valuable IT time and resources, with less systems to manage, fewer risks, faster detection of threats and enhanced ability to action remediation for a faster recovery.
  • Discover and identify your gaps and overlaps, and learn how to secure them with administrative and technical controls.
  • Ensure compliance with business and industry information security requirements leveraging the wealth of proactive controls in the Microsoft platform.
  • Assist in achieving compliance with industry standards such as ISO27001, NIST and PCI.

Secure the Modern Workplace with Microsoft

The Essential Eight Adoption Roadmap will provide insightful and actionable information regardless of your security strategy or vendor mix. However, many controls needed to make an immediate difference and improve your cybersecurity posture may be available via your existing Microsoft investments. By leveraging the Microsoft security portfolio across threat protection, information protection, compliance and identity and access management, you can achieve the desired results and reduce complexity in your environment.

Data#3 for your best defence

Combining the experience of a dedicated strategic consulting team, as well as hands-on cybersecurity specialists, Data#3 has one of the most mature and highly accredited security teams in Australia. Leveraging a breadth of security solutions and a strong vendor portfolio Data#3 can help you design, implement and maintain superior security measures, tailormade to protect your business. Having conducted countless security assessments, we have developed a proven model to strengthen resilience, incident response and recovery.

As Microsoft’s largest Australian partner, and a Microsoft Gold Security Partner Data#3’s expert team are globally recognised as leaders in securing your environment with the Microsoft security portfolio.

Next Steps

Download The ASD Essential Eight Explained eBook to learn more about the strategic controls.
Download a Solution Overview of the Essential Eight Adoption Roadmap Service.
Submit the form below to request a sample report of an Essential Eight Adoption Roadmap.
Contact us below to book an Essential Eight Adoption Roadmap.

Contact us here


ASD Essential Eight Explained – Part 8: Daily Backups

The Essential Eight The Australian Signals Directorate (ASD) Essential Eight has received considerable attention since it included an additional four…

ASD Essential Eight Explained – Part 7: Multi-Factor Authentication

The Essential Eight The Australian Signals Directorate (ASD) Essential Eight has received considerable attention since it included an additional four…

ASD Essential Eight Explained – Part 6: Using Application Hardening

The Essential Eight The Australian Signals Directorate (ASD) Essential Eight has received considerable attention since it included an additional four…

ASD Essential Eight Explained – Part 5: Disabling Untrusted Microsoft Office Macros

The Essential Eight The Australian Signals Directorate (ASD) Essential Eight has received considerable attention since it included an additional four…

1. The Essential Eight expand upon the ‘Top 4’ mitigation strategies, part of the Australian government’s Protective Security Policy Framework. The Australian Signals Directorate have stated that implementing the Top 4 mitigation strategies can prevent up to 85% of unauthorised intrusions.
2. Rainey, Larry B. (September 3, 2018) Engineering Emergence: A Modeling and Simulation Approach. [Online] Available at:
3. IBM Security. (2019) Cost of a Data Breach Report. [Online] Available at:
4. Office of the Australian Information Commissioner. (February 28, 2020) Notifiable Data Breaches Report July – December 2019. [Online] Available at: