ASD Essential Eight
Voluntary. This is ASD advice, not legislation, and it does not bind a private law firm unless a contract or a lawful direction makes it mandatory.
Eight mitigation strategies ASD recommends as a baseline for internet-connected IT networks, with maturity levels from zero to three.
MaintainedLast reviewed
Key facts
- Issued by
- Australian Signals Directorate
- Sources listed
- 2
This is a reading aid for an Australian law firm. It is not legal advice, not a certification, and not a finding that a tool or a firm complies. The sentences paraphrase the sources listed, checked on the date shown. Where a standard is sold by ISO or the AICPA, the page uses the publisher’s public description and does not reproduce the standard.
What it is
The Australian Signals Directorate recommends eight mitigation strategies, drawn from its Strategies to mitigate cyber security incidents, as a baseline. ASD’s FAQ says that while no set of strategies is guaranteed to stop every cyber threat, this baseline makes it much harder for malicious actors to compromise systems.
The eight strategies are patch applications, patch operating systems, multi-factor authentication, restrict administrative privileges, application control, restrict Microsoft Office macros, user application hardening, and regular backups. The maturity model, first published in June 2017, supports putting them in place in steps. The current model described on cyber.gov.au is the November 2023 update.
Who it applies to
ASD recommends the Essential Eight for organisations. It is not a statute that binds a private law firm. The FAQ says that for non-corporate Commonwealth entities subject to the Protective Security Policy Framework, Maturity Level Two is a mandatory baseline. A private firm is not that kind of entity unless a contract or another lawful direction says so.
The FAQ says the Essential Eight was designed to protect internet-connected information technology networks. The principles may be applied to enterprise mobility and operational technology, but it was not designed for those environments. It also says Maturity Level One may suit small to medium enterprises, Level Two large enterprises, and Level Three critical infrastructure and other high-threat environments. Those are ASD’s general indications, not a rule that a law firm must pick a level.
What it asks of a law firm using AI
- Identify a target maturity level and implement each level in order until that target is reached. The FAQ says an organisation should not jump straight to the target without assessing the levels in between.
- A mitigation strategy counts as fully implemented only when every requirement in it is implemented, or implemented with a compensating control the system owner can show gives an equivalent level of protection.
- Risk acceptance without a compensating control, or transferring the risk by buying cyber insurance, is not a substitute for an entire strategy such as application control or multi-factor authentication. The FAQ says that path is assessed as Maturity Level Zero for that strategy and for the overall result.
- The FAQ says legacy systems are not out of scope. Where the strategies are hard to implement, ASD strongly encourages upgrading those systems, and using compensating controls while the upgrade is underway.
- ASD’s Essential Eight and the Information Security Manual are separate. The FAQ says an organisation should consider them independently. A contractual Essential Eight level does not, by itself, take mapped ISM controls out of scope.
How it maps to this framework
The rows are this site’s questions. Where the cell says “Not set here”, the instrument does not set that requirement. The gap is still recorded, so it is not treated as answered.
| This site’s question | What the instrument says that bears on it |
|---|---|
| Efficiency Whether the tool saves total human work at the quality the task needs. | The FAQ says implementing the Essential Eight before an incident can cost less time, money and effort than responding to a large incident. That is about the cost of the firm’s own controls. It is not a score of how much human work an AI tool saves. |
| Effectiveness Whether the output is good enough for the task. The catalogue does not score this. | Maturity levels are about mitigating increasing levels of tradecraft and targeting. They are not a test of whether an AI draft is legally good enough. This framework’s effectiveness question stays a separate judgement. |
| Due diligence What the firm has actually read about hosting, training and assurance before it relies on the tool. | A firm can ask a vendor, or its own IT provider, which maturity level was assessed, for which systems, by whom, and against which edition. The answer is evidence. It is not an approval of the AI product. |
| Confidentiality Whether client and other confidential information can go into the tool. | Controls such as multi-factor authentication, restricting administration, and backups make unauthorised access and loss harder. The Essential Eight does not state a solicitor’s duty of confidentiality, and it does not say which client material may be pasted into a tool. |
| Disclosure When the firm tells the client, and where required the court or another party, that AI was used. | Not set here. |
| Certifications ISO, SOC 2 and IRAP names recorded against the tool. A listed name is not a finding that the certificate covers the firm’s plan. | The Essential Eight is not a certificate. A sentence that says “Essential Eight compliant” needs the maturity level, the systems in scope, the edition, and who assessed it. ASD publishes assessment tools. Completing a tool is not itself a certification of the firm. |
| Data residency Where the tool holds data, including whether that place is recorded as Australia. | The FAQ discusses online services and cloud services that store sensitive data, because those systems are in scope of the strategies. It does not choose a country where data must sit. |
Sources
Checked 2026-10-10. Issued by Australian Signals Directorate.