ACSC · User Application Hardening

The Essential Eight's
ad blocking requirement.
Fully met.

From Maturity Level 1, browsers must not process web ads from the internet. Ghostery delivers exactly that — one extension, centrally managed and locked, across every major browser.

Get a license quote or send us a message to support@ghostery.com InformationFree for up to 50 devices · Enterprise licensing for larger deployments

Country Fire Authority Australia Already deployed for Essential Eight compliance by Country Fire Authority Australia.

Sydney Harbour skyline with the Opera House at dusk Ghostery Privacy Protection Active panel showing Ad-Blocking, Anti-Tracking, and Never-Consent enabled

Fully Manifest V3 compliant · Open source · Centrally managed & policy-locked · 100M+ downloads

The requirement, in the assessor's own words

Australia's Essential Eight requires, through its User Application Hardening strategy, starting at Maturity Level 1, that web browsers do not process web advertisements from the internet. ASD's Assessment Process Guide is explicit:

“Check whether web browsers have either an ad blocker add-in or extension installed.”

“Built-in settings within web browsers to block pop-ups do not meet the intent of this control.”

— Essential Eight Assessment Process Guide

An ad blocker extension, centrally deployed and locked against user tampering, is exactly what Ghostery Tracker & Ad Blocker provides.

How Ghostery maps to User Application Hardening

Here is how Ghostery satisfies the browser hardening requirements — and the evidence you can hand to your assessor.

Maturity Level 1 and upBrowsers do not process
web ads

Ghostery blocks advertisements and the ad-tech scripts that deliver them, before they load, in Chrome, Microsoft Edge, and Firefox. Malvertising delivered through ordinary ad slots is blocked before it executes.

Evidencedeployment policy export · on-device block statistics · ad-display test screenshots

Maturity Level 1 and upUsers cannot change security settings

The extension is force-installed and settings-locked via Intune, Group Policy (GPME), or Chrome Browser Cloud Management. Users cannot disable or reconfigure it. Settings are preconfigured by policy — no end-user onboarding and no user accounts required.

Evidenceforce-install policy screenshot · managed-settings configuration

Maturity Level 2 and upHardening is centrally managed

Blocklists are maintained daily and roll out through a central update channel — no per-user opt-outs, so protection cannot silently degrade. Every release is additionally reviewed through the extension store processes of Mozilla, Google, Microsoft, Apple, and Opera before it reaches your fleet.

EvidenceMDM version-compliance report · update logs

Fleet-wide in days, not months

Deploy and lock Ghostery across your fleet using the management tools already in place.

Microsoft Intune Force-install to Edge and Chrome, lock managed settings, report version compliance. “Works well with InTune for rollout and management.” — Country Fire Authority Australia View deployment instructions →

Group Policy (GPME) ADMX-based force-install and settings lock for on-premises managed fleets. View deployment instructions →

Chrome Browser Cloud Management Cloud policy for Chrome across Windows and macOS. View deployment instructions →

How Country Fire Authority Australia
met the requirement

“We have implemented the tool successfully across our compute fleet.”

Country Fire Authority Australia used Ghostery to address its Essential Eight ad blocking requirement after the removal of uBlock Origin from Chromium-based browsers.

Challenged by the imminent removal of UBlock Origin from Chromium-based browsers, CFA launched a PoC using Ghostery to address our compliance with ACSC Essential 8 to block internet based advertisements in web browsers.
We have found the tool works well with InTune for rollout and management and provides greater flexibility and options than just ad blocking. We have implemented the tool successfully across our compute fleet. Thank you to the support team at Ghostery in working with us during the PoC.
Damian Halloran, Cyber Security Manager Country Fire Authority Australia

Why built-in browser settings don't satisfy the control

The control covers web advertisements generally — not only “intrusive” ads, and not only pop-ups.

Browser “intrusive ads” settings

Edge and Chrome baselines block ads only on sites flagged for intrusive advertising. Ordinary ads — including malvertising on legitimate sites — are still processed by the browser.

Does not meet the control's wording

DNS / network filtering

Blocks known ad domains at the resolver, but the browser itself still processes in-page ad content — and the Assessment Process Guide's check is about what the browser processes, not what the network filters.

Partial — ads still processed

Managed ad blocker extension (Ghostery)

Blocks ads and ad scripts inside the browser itself, on and off the corporate network, with settings locked by policy — the implementation the Assessment Process Guide checks for.

Meets the control as written

Frequently asked questions

Does the Essential Eight really require ad blocking?
Yes. The User Application Hardening strategy requires, starting at Maturity Level 1, that web browsers do not process web advertisements from the internet. The Essential Eight Assessment Process Guide instructs assessors to check whether browsers have an ad blocker extension installed.

Which maturity level does this apply to?
The requirement applies from Maturity Level 1 and carries through Maturity Levels 2 and 3, which add central management and stricter hardening on top.

Isn't the built-in Edge or Chrome ad setting enough?
Those settings block ads only on sites flagged for intrusive advertising, and the Assessment Process Guide states that built-in pop-up blocking settings do not meet the intent of this control. Assessors expect a full ad blocking capability.

Can we deploy without any end-user interaction?
Yes. Force-install and settings lock via Microsoft Intune, Group Policy (GPME), or Chrome Browser Cloud Management. End users cannot disable or reconfigure the extension.

Does Ghostery support Microsoft Intune?
Yes. Ghostery force-installs to Edge and Chrome through Microsoft Intune, with managed settings locked so end users cannot change or disable protection. Country Fire Authority Australia deployed Ghostery across its fleet via Intune. Group Policy (GPME) and Chrome Browser Cloud Management are supported as well.

Can users disable or uninstall Ghostery?
No. When deployed via Microsoft Intune, Group Policy, or Chrome Browser Cloud Management, the extension is force-installed and settings-locked. End users cannot uninstall, disable, or reconfigure it, which is exactly what the Essential Eight's browser hardening controls require.

Which browsers and operating systems does Ghostery Enterprise support?
Chrome, Microsoft Edge, and Firefox, on Windows and macOS. Deployment and settings are managed centrally via Microsoft Intune, Group Policy (GPME), or Chrome Browser Cloud Management. Ghostery for Safari is available as a macOS and iOS app and can be distributed via MDM, but Safari does not support centrally enforced extension settings, so for Essential Eight compliance, standardize managed devices on Chrome, Edge, or Firefox.

What evidence can we provide to an Essential Eight assessor?
Ad-display test screenshots are the verification method suggested by the Essential Eight Assessment Process Guide. You can supplement them with a deployment policy export showing force-install and locked settings, block statistics viewable on each device, and MDM version-compliance reports. Ghostery's configuration maps directly to the User Application Hardening requirements from Maturity Level 1.

Still have questions?

If there is anything you miss in Ghostery or have any questions, please drop a line to support@ghostery.com. We’re happy to talk to you anytime.

Get in touch

Close the ad blocking control
this quarter

Tell us your fleet size and management tooling, and we'll come back with a license quote and a deployment plan.

Get a license quote or send us a message to support@ghostery.com InformationFree for up to 50 devices. Tell us your fleet size for larger deployments.