Essential Eight explained: what each maturity level actually requires

The Essential Eight is the Australian Signals Directorate's baseline set of mitigation strategies. It is mandatory for many non-corporate Commonwealth entities, and it is increasingly what Australian customers, insurers and boards ask about when they want to know whether a supplier takes security seriously. The framework is short to read but easy to misread. This guide explains the eight strategies, what the maturity levels really mean, and how to pick a realistic target.

The eight strategies

The strategies fall into three loose groups: stopping malicious code running, limiting the damage if something does run, and being able to recover.

1. Application control: only approved programs, scripts and installers can execute.
2. Patch applications: security fixes for internet-facing and common applications are applied within set timeframes.
3. Configure Microsoft Office macro settings: macros are blocked unless there is a business need and they are controlled.
4. User application hardening: browsers and other apps are configured to reduce attack surface, for example blocking legacy features.
5. Restrict administrative privileges: admin rights are limited, reviewed and separated from everyday accounts.
6. Patch operating systems: OS vulnerabilities are fixed within set timeframes and unsupported systems are replaced.
7. Multi-factor authentication: MFA protects users and administrators, especially for internet-facing services.
8. Regular backups: important data, software and settings are backed up, protected and restoration is tested.

What the maturity levels mean

The maturity model defines Maturity Level Zero to Three. Each level is aimed at a different kind of adversary, not at a different size of organisation. That framing matters: you choose a level based on who is likely to target you and what they would be after.

Maturity Level One

Level One targets opportunistic adversaries using widely available tools and techniques. They are looking for any victim, not you specifically. Requirements include patching internet-facing services quickly when an exploit exists, blocking macros from the internet, MFA for internet-facing services that hold sensitive data, and backups that are restorable.

Maturity Level Two

Level Two targets adversaries willing to invest a little more time and effort, and who may target you deliberately with phishing or credential theft. Expect broader application control, phishing-resistant or stronger MFA coverage for more users and privileged accounts, more frequent vulnerability scanning, logging of privileged activity, and tighter separation of administrative environments.

Maturity Level Three

Level Three targets adaptive adversaries who are prepared to invest significant effort to bypass controls. Requirements include application control on servers as well as workstations, rapid patching, centralised and protected logging with active monitoring, phishing-resistant MFA, and just-in-time administration. It is a serious programme, not a checklist.

Choosing a target level

The ACSC guidance is that organisations should first aim for Level One across all eight strategies before progressing. In practice, most small and mid-sized Australian businesses settle on Level One or Two as the target. Level Three is typically for organisations that hold highly sensitive data or are known targets for capable threat actors.

• Look at who might target you: commodity ransomware crews, a competitor, or a state actor interested in your clients.
• Look at what customers and contracts require: some government and critical-infrastructure contracts specify a level.
• Be honest about operating capacity: Level Three logging and monitoring needs people to watch it.
• Implement all eight strategies at one level before pushing any single strategy higher.

Common mistakes we see

• Treating MFA as done because staff use it for email, while admin portals, VPNs and remote access still accept a password alone.
• Patching operating systems well but leaving browsers, PDF readers and line-of-business apps months behind.
• Having backups that have never been restored, or that sit on the same domain an attacker would compromise.
• Granting local admin to developers or power users permanently instead of on request.
• Self-assessing without evidence. An assessor will ask to see configuration, logs and test results, not a policy statement.

How assessment works

The ACSC's assessment process guide describes how assessors test each control, ranging from reviewing documentation to technically testing that a control actually blocks something. Evidence quality matters: a screenshot of a Group Policy setting is weaker than a test showing an unapproved executable being blocked. Plan your evidence as you implement, not after.

Keeping it current

The maturity model is updated periodically, so check the current version on cyber.gov.au before you plan work or speak to an assessor. Treat the Essential Eight as a baseline, not the whole of your security programme. It is designed to make common attacks much harder, and it works best alongside good asset management, incident response planning and staff awareness.