Essential Eight
The Essential Eight is a set of eight mitigation strategies from the Australian Signals Directorate, with a maturity model that runs from level zero to level three.
ASD Essential Eight
What you get with Essential Eight.
- Essential Eight available as a prebuilt framework
- 24 requirements tracked with status and evidence
- Policies and tasks managed in the same platform
Running Essential Eight in Varman
ASD Essential Eight is available in Varman as a prebuilt framework. The numbers below are what it contains in the product today. You add it to your workspace and work through it in the same place as your policies, risks, vendors, and evidence.
- 24
- requirements
- 14
- controls mapped
- 19
- evidence tasks
- 14
- policy templates
1. Add the framework
Each Essential Eight requirement appears with its status, so you can see what is met and what is still open.
2. Connect your systems
Integrations run scheduled checks against your cloud, identity, and developer tools and record the results as evidence. See the integrations.
3. Close the gaps
Policies, tasks, and uploaded evidence cover what cannot be checked automatically. Readiness for Essential Eight updates as each item is completed.
4. Work with your auditor
Varman organizes the evidence. Any audit, assessment, or certification is carried out by an independent third party, not by Varman.
Essential Eight questions, answered.
What are the Essential Eight strategies?
Patch applications, patch operating systems, multi-factor authentication, restrict administrative privileges, application control, restrict Microsoft Office macros, user application hardening, and regular backups.
What are the Essential Eight maturity levels?
Levels zero to three. Each level is aimed at adversaries of increasing capability. The Australian Signals Directorate recommends reaching the same level across all eight strategies before moving to the next.
Is the Essential Eight mandatory?
For Australian non-corporate Commonwealth entities, the Protective Security Policy Framework requires Maturity Level Two. For private organizations it is voluntary, though customers and insurers may ask about it.
How does Varman help with Essential Eight?
Varman ships Essential Eight as a prebuilt framework with 24 requirements, 14 mapped controls, 19 evidence tasks, and 14 policy templates. Integrations collect evidence automatically, and any audit or certification is done by an independent third party.