Framework guide

FEHA and the Essential Eight

What it takes, and how FEHA handles it

The Essential Eight is the Australian Signals Directorate's baseline of eight mitigation strategies: patching applications, patching operating systems, multi-factor authentication, restricting administrative privileges, application control, restricting Microsoft Office macros, user application hardening, and regular backups.

Each strategy is measured against a maturity model from Level Zero to Level Three. Non-corporate Commonwealth entities must reach Maturity Level Two under the Protective Security Policy Framework, and government buyers and larger customers increasingly ask suppliers to show the same.