ACSC Essential Eight for Australian SaaS Companies: A Practical Implementation Guide

If you run a SaaS company in Australia and you want to sell into government, health, or larger enterprise, sooner or later someone will ask how you stack up against the Essential Eight. It is the baseline the Australian Cyber Security Centre (ACSC), part of the Australian Signals Directorate, recommends for every organisation, and it is mandatory for non-corporate Commonwealth entities. I have run more than 200 security assessments across 14 countries since 2013, and the Essential Eight is one of the more honest frameworks I work with, because it does not reward paperwork. It rewards controls that actually run in production.

This guide walks through what the Essential Eight really is, how the maturity model works, and a practical order of implementation for a SaaS environment. No invented case studies, no magic numbers. Just the way I would sequence it if you handed me your environment on a Monday morning.

What the Essential Eight Actually Is

The Essential Eight is a set of eight prioritised mitigation strategies designed to make it significantly harder for an attacker to compromise a Windows-centric environment. It grew out of the ASD's larger catalogue of mitigation strategies, and these eight were singled out because they block the techniques behind the overwhelming majority of intrusions the ACSC responds to.

The eight strategies fall into three goals: prevent malware from running and spreading, limit the damage when something does get in, and make sure you can recover. Here they are in plain terms:

• Application control - only approved executables, scripts, installers, and libraries are allowed to run. This is the single most powerful control on the list and the hardest to do well.
• Patch applications - patch internet-facing and high-risk applications quickly, with critical vulnerabilities on public-facing services closed within 48 hours.
• Configure Microsoft Office macro settings - block macros from the internet and only allow vetted, signed macros where there is a genuine business need.
• User application hardening - disable or restrict risky features in browsers, PDF readers, and Office, such as Flash (now dead), Java in browsers, and web ads.
• Restrict administrative privileges - admin rights are granted on need, reviewed regularly, and privileged accounts cannot browse the web or read email.
• Patch operating systems - keep operating systems current and remove unsupported versions, with critical fixes on exposed systems applied within 48 hours.
• Multi-factor authentication - MFA on remote access, on privileged actions, and increasingly on any authentication to important data repositories.
• Regular backups - backups of data, software, and configuration, tested for restoration, and stored so ransomware cannot reach them.

Notice what is not on the list: buying a shiny new platform. Every one of these is about disciplined configuration and operations. That is exactly why so many organisations claim to have done them and quietly have not.

The Maturity Model: Level Zero to Three

The Essential Eight is not pass or fail. The ACSC publishes a maturity model with four levels, and you are expected to implement all eight strategies together at your target level rather than cherry-picking your favourites.

Maturity level	What it defends against	Typical fit
Level Zero	Nothing reliably. There are exploitable weaknesses in the organisation's posture.	Where most companies actually sit before an assessment
Level One	Opportunistic attackers using widely available, commodity tradecraft and known exploits.	Small businesses and early-stage SaaS starting their program
Level Two	Attackers willing to invest more time and use better tooling to bypass controls and target credentials.	The benchmark for non-corporate Commonwealth entities and most serious SaaS vendors
Level Three	Adaptive adversaries who focus effort on a specific target and exploit weak configuration aggressively.	High-value targets, critical infrastructure, sensitive government data

For a commercial SaaS business, Maturity Level Two is the honest target if you want to be credible with government and large-enterprise buyers. Level One is a legitimate starting point. Claiming Level Three when your backups have never been restored is the kind of thing an assessor catches in the first hour.

Why This Matters Commercially for SaaS

Since 2022 the Protective Security Policy Framework requires non-corporate Commonwealth entities to implement the Essential Eight. That requirement cascades to their suppliers. If you sell software to an Australian government department, or you want to, your security questionnaires and contract clauses will increasingly reference the Essential Eight and, for cloud services, the ACSC's cloud assessment guidance and IRAP.

Beyond government, enterprise procurement teams have started using the Essential Eight as a convenient shorthand in vendor due diligence, because it is concrete and locally recognised. Being able to say honestly "we are assessed at Maturity Level Two and here is our evidence" shortens sales cycles and removes objections. The commercial upside is real, but it comes from doing the work, not from a badge. If you want an independent view of where you stand, a structured IT security audit against the Essential Eight is the fastest way to get an honest baseline.

A Practical Order of Implementation

People fail the Essential Eight because they try to do all eight at once, run out of political capital on application control, and stall. Here is the sequence I use to get momentum without breaking production.

1. Turn on the controls that cannot break anything: MFA and backups

Multi-factor authentication and tested backups are the two strategies with the highest security payoff and the lowest chance of disrupting your users. Start with MFA on all remote access, admin consoles, and your identity provider, then extend it to any system holding customer data. In parallel, verify that backups exist for data, configuration, and code, that at least one copy is offline or otherwise immutable, and, critically, that you have actually restored from them. A backup you have never restored is a hope, not a control.

2. Get patching under control

Split patching into two workstreams: internet-facing systems and applications first, internal systems second. For anything exposed to the internet, you need the ability to close a critical vulnerability within 48 hours, which means you need an accurate inventory of what you actually run. Most SaaS teams discover during this step that they cannot list all their internet-facing assets, and finding those unknowns is worth the exercise on its own. A recurring vulnerability assessment plugs directly into this workstream and gives you the evidence trail assessors want.

3. Restrict administrative privileges

Inventory who has admin rights and why. Remove standing access no one can justify. Separate privileged accounts from day-to-day accounts, and block privileged accounts from email and web browsing so a phished admin does not equal a compromised domain. This is unglamorous and politically annoying, and it stops more real attacks than any product you can buy.

3.5. Harden Office and user applications

Block Office macros from the internet, allow only vetted signed macros where a business genuinely needs them, and disable the legacy browser and PDF features attackers still reach for. These changes are low-cost and rarely noticed by users, which makes them easy wins to bank while you build up to the hard one.

4. Tackle application control last, and properly

Application control is the crown jewel and the reason most Essential Eight programs stall. Done right, it stops unapproved code from executing at all, which neutralises a huge class of malware and living-off-the-land attacks. Done in a rush, it either blocks legitimate work and gets switched off, or it is configured so loosely it provides no protection. Run it in audit or learning mode first, build your allow-list from real usage, then enforce. Expect this to take months, not a weekend, and treat it as an ongoing operational discipline rather than a one-off project.

The Mistakes I See Most Often

• Cherry-picking strategies. Doing MFA and backups well while ignoring application control does not put you at Maturity Level Two. The model expects all eight at your target level.
• Untested backups. Ransomware groups specifically hunt and delete backups. If yours are reachable with the same credentials as production, assume they are gone in an incident.
• Application control theatre. An allow-list that permits any file in a user-writable folder is not application control. Attackers know exactly where those gaps are.
• No asset inventory. You cannot patch, restrict, or control what you have not counted. Almost every stalled program traces back to an incomplete inventory.
• Confusing tooling with maturity. Buying an EDR does not give you application control, and an identity platform you have not configured for MFA everywhere does not give you MFA.

Where a Consultant Actually Helps

You do not need a consultant to enable MFA. Where outside help pays for itself is in the honest baseline assessment, the sequencing decisions, and the political cover to remove admin rights and enforce application control without the whole thing being reversed the first time an executive is inconvenienced. A good virtual CISO engagement gives a growing SaaS company that senior judgement without the cost of a full-time hire, and for cloud-native platforms a focused cloud security review makes sure the Essential Eight principles are translated correctly into your actual AWS, Azure, or GCP environment rather than applied as if you still ran everything on Windows servers in a cupboard.

If you would like an independent read on your current maturity level and a realistic roadmap to your target, get in touch with Atlant Security. You review the readiness findings before any remediation work begins, so you know exactly what you are dealing with first.

Frequently Asked Questions

Is the Essential Eight mandatory for my SaaS company?

It is mandatory for non-corporate Commonwealth entities under the Protective Security Policy Framework. It is not legally mandatory for a private SaaS business, but it is increasingly a de facto requirement in government and enterprise procurement. If you want those customers, treat it as mandatory in practice.

What maturity level should we aim for?

Maturity Level Two is the sensible target for a commercial SaaS vendor that wants to be credible with government and large enterprise buyers. Start at Level One if you are early in your program, and only pursue Level Three if you handle genuinely sensitive data or critical infrastructure.

How long does it take to reach Maturity Level Two?

It depends on your starting point and how clean your asset inventory is, but for most mid-sized SaaS teams it is a program measured in months, not weeks. MFA and backups can move quickly; application control and full patch discipline are the long poles.

Does the Essential Eight apply to cloud and SaaS, not just Windows?

The controls were framed around Windows environments, but the principles map to cloud. Application control becomes workload and image control, administrative restriction becomes IAM and privileged access management, and patching becomes image and dependency currency. The intent carries over cleanly even when the implementation differs.

How is the Essential Eight different from SOC 2 or ISO 27001?

The Essential Eight is a prescriptive set of technical controls with a maturity scale. SOC 2 and ISO 27001 are broader management-system and attestation frameworks covering governance, risk, and process as well as technical controls. Many SaaS companies pursue both: the Essential Eight for Australian buyers and SOC 2 or ISO 27001 for international ones. They overlap heavily on the technical side.

Can we self-assess or do we need an external assessor?

You can and should self-assess as you build the program. For anything you plan to represent to customers or government, an independent assessment carries far more weight and tends to surface the comfortable assumptions internal teams make about their own maturity.