- NexSysIT Editorial Team
- 18 Sep 2026
- 8 min read
The Essential Eight, Explained for Firms That Run Revit
The Essential Eight is a set of eight security controls published by the Australian Cyber Security Centre, which sits inside the Australian Signals Directorate. It started life as guidance for federal agencies. It is now the thing your Tier 1 builder client’s procurement team asks about, the thing state government tenders want evidence of, and the reason your practice’s IT is about to become a compliance question rather than a helpdesk one.
Most guides to the Essential Eight framework are written for a generic office. This one isn’t. It’s written for a practice where the workstations run Revit, the BIM manager needs local admin to install add-ins, and the central file is the most valuable thing on the network. Those three facts change how every one of the eight controls lands.
The eight strategies
The ACSC names them as follows. Application control, patch applications, configure Microsoft Office macro settings, user application hardening, restrict administrative privileges, patch operating systems, multi-factor authentication, and regular backups. Four of those are about stopping malicious code running. Two are about limiting what an attacker can do once they’re in. Two are about recovering.
The Essential Eight mitigation strategies were chosen because they stop most real-world attacks, not because they’re exhaustive.
The maturity model
Each control is assessed at a maturity level. The ACSC maturity model defines three levels above a baseline of zero. Level One is built to stop opportunistic attackers using widely available tools. Level Two is built to stop a more capable adversary who’ll spend time and money on you specifically. Level Three is for targeted, persistent threats, and it’s the level defence contractors and critical infrastructure operators work to.
You’re assessed at the lowest level you meet across all eight. Seven controls at Level Two and one at Level One means you’re Level One. That trips up practices that have done most of the work.
ACSC guidance points at Level One as the starting point for every organisation. In our experience, the practices that get asked for evidence at all get asked for Level Two, because that’s what the government and Tier 1 supply-chain questionnaires are written around. Cameron Zad, our Director of Technical Services, would put it more bluntly. Level One is a floor, Level Two is what a tender means when it says “Essential Eight”, and Level Three for a forty-person practice is theatre that will slow your drafters down for no commercial gain.
The questionnaires themselves are worth reading before you’re sent one. Tier 1 builders increasingly ask consultants to state their Essential Eight maturity level and to name who assessed it, which means a self-assessment from your own IT provider carries less weight than one from a third party. Plan for that before the tender rather than during it.
Where each control collides with a design environment
This is the part the generic guides skip.
Application control
Application control means only approved software runs. In an accounting firm that’s a policy. In a practice, it’s a fight, because Revit add-ins, Dynamo scripts and rendering plug-ins arrive from a dozen sources and change every project. Done badly, application control blocks the BIM manager’s Tuesday. Done properly, it uses publisher-signed rules and a fast approval path, and the BIM manager becomes the person who can add things rather than the person being blocked.
Patching applications
Patching applications is where Autodesk complicates things. Revit updates mid-project can change how a model behaves, and no practice wants a point release landing the week a documentation set is due. The control requires patching within a window, and the practice needs patching that respects deadlines. Both are achievable, but only if the patching schedule is written around your submission calendar rather than the vendor’s release calendar.
Office macro settings
Office macro settings sound trivial until you remember how many practices run schedules and area calculations out of Excel workbooks that someone built in 2014. Blocking macros from the internet is the control. Finding the workbooks that will break is the work.
User application hardening
User application hardening means turning off the parts of browsers and PDF readers that attackers use. Low friction for most staff, more for the person who reviews consultant PDFs all day, so test it on them first.
Restricting administrative privileges
Restricting administrative privileges is the one that upsets BIM managers. Most have had local admin for years so they can install whatever a project needs. The control doesn’t say they can’t have it. It says admin should be a separate account, used only when needed, and reviewed. That’s a change in habit more than a loss of capability, and the practices that explain it that way get less resistance than the ones that just revoke it.
Patching operating systems
Patching operating systems is the least contentious. It’s also the one that interacts with workstation hardware, because a fleet on Windows 10 that Autodesk still supports for Revit 2026 is a fleet that will need to move, and the move is better planned than forced.
Multi-factor authentication
Multi-factor authentication is where the Essential Eight and Autodesk’s licensing model happen to agree. Autodesk sells named-user subscriptions only, so every Revit licence is already tied to a personal login. Putting MFA on that login is the control, and tying it to the same identity your directory uses means a departing drafter loses Revit the same hour they lose email.
Regular backups
Regular backups is the control practices think they’ve already done. Most have backups. Fewer have tested a restore of a live central model, and fewer still have thought about the fact that Autodesk recommends 100 GB of free space for Revit temp files alone, which tells you something about how much data a single workstation generates that isn’t in the central file at all. Level Two requires that backups are tested and that a compromised account can’t delete them. That second part is the one most practices fail.
What it costs to get there
Level One is mostly configuration, and a competent provider can get a practice there in a few weeks without buying much. Level Two adds tooling, particularly around application control and privileged access. It adds process too, because the ACSC wants evidence that things are reviewed rather than just set. That’s the level where it becomes a line item on your managed services bill rather than a one-off project.
We don’t recommend Level Three for a design practice. The controls at that level are built for organisations under sustained targeted attack, and applying them to a studio makes it slower without making it meaningfully safer against the attacks it will actually see. If a specific contract requires it, we build it, and we set out the day-to-day friction in writing first so nobody is surprised.
Where to start
Get assessed before you buy anything. The most common mistake we see is a practice purchasing a security platform because the vendor said it “covers the Essential Eight”. Then they discover that coverage and maturity aren’t the same word. An honest assessment against the ACSC model takes a day, tells you which controls you already meet, and gives you the list in priority order.
Then build the patching schedule around your project calendar and the application control rules around your add-in list, before either is switched on. The order matters. Practices that switch the controls on first and tune them second spend a month explaining to architects why their tools stopped working.
- Written by
Written and reviewed by the NexSys engineers, design technology specialists and consultants who build and support IT for architecture, engineering and construction firms across Australia. Every price, rule and vendor statement is checked against its source on the date shown.
Recent Posts
- Workflow Automation for Architecture and Engineering Firms: 2026
- IT Support for Architecture Firms With Internal IT Teams
- Cloud Infrastructure for Revit and BIM Workloads: A Guide
- IT Asset Management for AEC Firms: Digital Efficiency and Compliance
- BIM’s Next Leap: Automation, Validation, and Data Trust in AEC
Get assessed before you buy anything
An honest assessment against the ACSC model takes a day, tells you which controls you already meet, and gives you the list in priority order. Book a strategic review and we will start there.