Essential Eight checklist: the Level 1 items, plain English

Here's the direct answer: the Essential Eight checklist is the eight ACSC mitigation strategies, each broken into the specific Level 1 requirements a business needs to meet before it can call that control "partly aligned". There's no single official PDF. Below is the real Level 1 list, control by control, taken from the ACSC's own criteria, not a vendor's summary of them.

Most things online calling themselves an "Essential Eight checklist" are either a restatement of the eight control names with no detail, or a real checklist locked behind an email form. Neither helps you much on a Tuesday afternoon when a broker or a client's security questionnaire has just landed. This is the actual list, open on the page.

What this checklist covers

This is Level 1: the common starting target, and the baseline every higher level builds on. Level 2 is where most insurers and brokers eventually want to see a business land, but you can't skip to it. Levels are cumulative. Miss one Level 1 item on a control and that control sits at Level 0, no matter how strong anything else looks. Check each item honestly. "Mostly" and "I think so" both count as a no for now.

The checklist

1. Application control

• Application control is switched on for workstations, not just servers.
• Only an approved set of programs, scripts, installers and similar can run. Anything outside that approved list is blocked by default.

2. Patch applications

• Critical vulnerabilities in internet-facing services (anything customers or staff reach from outside the office) are patched within 48 hours.
• Everyday software (browsers, Office, PDF readers, email clients) is patched within two weeks of updates shipping.
• Software no longer supported by its vendor, including old browser extensions and Adobe Flash, is removed rather than left running.
• A vulnerability scanner checks for missing application patches at least weekly.

3. Restrict Microsoft Office macros

• Macros are switched off for anyone without an actual business reason to use them.
• Macros in files that arrive from the internet, such as email attachments, are blocked.
• Macro antivirus scanning is turned on.
• Staff can't change macro security settings themselves. (This control doesn't apply if the business doesn't use Microsoft Office at all.)

4. User application hardening

• Internet Explorer 11 has been removed or disabled.
• Browsers are blocked from running Java content from the internet.
• Browsers are blocked from loading web advertisements from the internet.
• Staff can't change browser security settings themselves.

5. Restrict administrative privileges

• Every request for admin-level access is checked and approved before it's granted, not assumed.
• Anyone with admin rights uses a separate, dedicated admin account, never their everyday login.
• Admin accounts can't browse the internet, check email or use general web services.

6. Patch operating systems

• Critical vulnerabilities in internet-facing servers and network devices are patched within 48 hours.
• Workstations and internal servers get OS patches within one month.
• Operating systems no longer supported by their vendor (old Windows or server versions, for example) have been replaced.
• A vulnerability scanner checks for missing OS patches at least fortnightly.

7. Multi-factor authentication

• MFA is turned on for the business's own online services that hold sensitive data.
• MFA is also turned on for third-party services (cloud accounting, email, file storage) that hold the business's sensitive data.
• The MFA used is a genuine second factor: something a person has and something they know, or something they have that's unlocked by something they know or are. An SMS code alone to a shared office phone doesn't count.

8. Regular backups

• Backups run on a schedule that actually matches how critical the data is and how fast the business needs to recover.
• Backups are stored securely and can't be reached by whoever might compromise the live systems.
• A restore has actually been tested, not just assumed to work.
• Ordinary staff accounts can't modify or delete backups.

How to read your results

Go control by control. If every item under a control is a genuine yes, that control is at Level 1. If even one is a no, a "not sure", or an "it depends", the control sits at Level 0 for now, and that's fine to write down honestly. Then look across all eight. Your overall maturity is your single weakest control, not an average of the eight. A business with seven strong controls and one Level 0 is, overall, at Level 0. It's worth reading the full maturity levels explained guide once you've got your eight results, since Level 2 and 3 add more on top of everything here.

Why this list matters beyond your own comfort

Cyber insurers commonly ask about several of these items (MFA, backups and patching come up the most) at application and renewal. The Privacy Act's expectation that a business take "reasonable steps" to protect personal information is often measured against a baseline like this one. And larger customers are increasingly putting versions of these same questions into their own supplier and tender forms. None of that makes the Essential Eight mandatory for most private businesses, and ticking every box here doesn't guarantee a particular premium or outcome. Insurers still make their own underwriting decisions. But showing up to a renewal or a questionnaire already knowing your answers, rather than guessing, changes that conversation.

From checklist to scored result

A paper checklist is only as good as how carefully it's marked, and it goes stale the moment someone changes a setting or a new starter gets an admin account. Our free self-assessment asks these same questions in plain English, control by control, and calculates your indicative Level 0 to 3 automatically instead of leaving the scoring to you. It takes about 20 minutes, needs no account to see your result, and it's a self-assessment based on your own answers: not an audit, and not a certification.