The Essential Eight is what it advertises – eight key mitigation strategies that work together primarily to prevent and limit cyber incidents. It has rightly become a widely adopted baseline for Australian organisations in and beyond the public sector. But it explicitly states that it is not a complete security strategy, and this assertion is correct. Organisations need to understand what Essential Eight does and does not cover, and use this to plan their next steps.