Essential Eight assessment, maturity levels and uplift.
Find out your maturity level across all eight strategies, close the gaps and get evidence you can hand to clients, insurers and your board. This guide explains the maturity levels, gives you a Maturity Level One checklist and covers what ASD’s new Essentials framework means for you.
ISO 27001:2022 certified
All eight strategies · Maturity Levels 1 to 3
Australian owned · Brisbane, Sydney and Melbourne
Update: October 2026
The Essential Eight and the new ASD Essentials
On 15 October 2026 the Australian Signals Directorate (ASD) launched the ASD Essentials, the successor to the Essential Eight. Its first chapter, Essentials for enterprise IT, replaces maturity levels with principles, actions and domains, and rates each action as not effective, partially effective or fully effective.
Here is what that means for you today:
- The Essential Eight still applies. ASD says organisations should keep meeting their current obligations until regulators announce changes, and it is keeping both frameworks on cyber.gov.au during the transition. A contract, tender or insurer that asks for an Essential Eight maturity level still means the Essential Eight Maturity Model, last reviewed in November 2023.
- Your Essential Eight work carries forward. Every Essential Eight strategy maps to at least one Essentials principle, and ASD advises against slowing or stopping uplift programs that are under way.
- Maturity levels don’t convert automatically. An Essential Eight maturity level isn’t translated into an Essentials rating, so you’ll need a gap analysis when you move across.
- There is no transition date yet. ASD will set expectations once it has worked through timeframes with regulators.
Our assessments report your Essential Eight maturity and note how your controls line up with the Essentials, so one piece of work covers today’s requirements and your transition planning. Read ASD’s announcement and transition guidance.
The basics
What is the Essential Eight?
The Essential Eight is a set of eight cyber security mitigation strategies published by the Australian Signals Directorate (ASD) through the Australian Cyber Security Centre. ASD ranks them as the most effective of its Strategies to mitigate cyber security incidents. The Essential Eight Maturity Model then measures how well each strategy is implemented, from Maturity Level Zero to Maturity Level Three.
It was designed for internet-connected IT networks. In most businesses that means Windows devices, Microsoft 365, and the servers and cloud services around them. The eight strategies work together across three goals: preventing attacks, limiting the damage if one gets through, and recovering your data.
| Strategy | What it does | Goal |
|---|---|---|
| 1. Application control | Only approved programs, scripts and installers can run, so malware dropped on a device can’t execute. | Prevent attacks |
| 2. Patch applications | Security updates for online services, browsers, Office, email clients and PDF software are applied within set timeframes, and unsupported software is removed. | Prevent attacks |
| 3. Restrict Microsoft Office macros | Macros are disabled for staff who don’t need them and blocked in files that come from the internet. | Prevent attacks |
| 4. User application hardening | Browsers and Office are locked down: no Java or web ads from the internet, Internet Explorer 11 removed, and security settings users can’t change. | Prevent attacks |
| 5. Restrict administrative privileges | Admin rights are approved, limited and kept in separate accounts that can’t browse the web or read email. | Limit the damage |
| 6. Patch operating systems | Workstations, servers and network devices are patched on time, and unsupported operating systems are replaced. | Limit the damage |
| 7. Multi-factor authentication | A second factor protects online services that hold sensitive data, and from Maturity Level Two every user of your systems, using phishing-resistant methods. | Limit the damage |
| 8. Regular backups | Data, applications and settings are backed up, restores are tested, and ordinary accounts can’t change or delete backups. | Recover |
Is the Essential Eight mandatory? Maturity Level Two has been the required baseline for Commonwealth entities and many critical infrastructure operators. For private businesses it isn’t a legal requirement, but it often becomes one through client contracts, government tenders and cyber insurance questionnaires. Source: ASD’s Essential Eight Maturity Model.
Maturity model
Essential Eight maturity levels explained
The maturity model has four levels. Levels One to Three are each designed to stop a more capable attacker. ASD recommends reaching the same level across all eight strategies before aiming higher, so your overall maturity is set by your weakest strategy.
| Level | Designed to stop | What it adds |
|---|---|---|
| Maturity Level Zero | Nothing reliably | There are weaknesses an opportunistic attacker could use to steal data or disrupt systems. Most organisations start here in at least one strategy. |
| Maturity Level One | Opportunistic attackers using widely available tools, such as public exploits for unpatched online services, or stolen, reused or guessed passwords | The foundations: MFA on online services that hold sensitive data, application control on workstations, macros from the internet blocked, separate admin accounts, backups ordinary users can’t delete, and critical online-service patches within 48 hours. |
| Maturity Level Two | Attackers who invest more time, run convincing phishing campaigns and try to get around weak MFA | Phishing-resistant MFA for online services and for every user of your systems, application control on internet-facing servers, central logging of MFA, admin and application control events, admin access that lapses after 12 months unless revalidated, and patches for other applications within one month. |
| Maturity Level Three | Adaptive attackers who exploit older software and weak logging, steal authentication tokens and move through the network | Just-in-time administration, Credential Guard, application control on all servers and for drivers, critical workstation, driver and firmware patches within 48 hours, and removal of .NET Framework 3.5 and PowerShell 2.0. |
Which maturity level should you target?
ASD asks each organisation to choose a target level that suits its environment, then work up to it one level at a time. For most of the organisations we work with, such as law firms, financial services and other professional services, that means:
- Maturity Level One across all eight strategies first. It is designed to stop the opportunistic, untargeted attacks most organisations face.
- Maturity Level Two where a client contract, government tender or insurer asks for it, or where you hold sensitive client data that makes you worth a targeted phishing campaign.
- Maturity Level Three only where you expect to be deliberately targeted by capable attackers.
Exceptions are allowed when they are documented, approved and backed by compensating controls, so one legacy system doesn’t have to hold you back. Our compliance and governance service keeps that record for you.
Self-check
Essential Eight checklist: Maturity Level One
Use this to check yourself against the main Maturity Level One requirements. If you can’t answer yes to every line under a strategy, you are at Maturity Level Zero for that strategy. This is a plain-English summary: the full wording is in ASD’s maturity model.
Patch applications
- Assets are discovered automatically at least fortnightly.
- Online services are scanned for missing patches daily; Office, browsers, email clients, PDF software and security products at least weekly.
- Critical online-service patches, or any with a working exploit, go on within 48 hours; others within two weeks.
- Office, browser, email, PDF and security product patches go on within two weeks.
- Software the vendor no longer supports is removed.
Patch operating systems
- Internet-facing servers and network devices are scanned daily; workstations and internal servers at least fortnightly.
- Critical patches for internet-facing servers and devices, or any with a working exploit, go on within 48 hours; others within two weeks.
- Workstations and internal servers are patched within one month.
- Unsupported operating systems are replaced.
Multi-factor authentication
- MFA protects your own and third-party online services that hold sensitive data, such as Microsoft 365 and your practice management system.
- MFA is used on third-party services with non-sensitive data where it’s available.
- Customer-facing services that hold sensitive customer data use MFA for staff and customers.
- MFA combines something users have with something they know or are.
Restrict administrative privileges
- Requests for admin access are validated when first made.
- Admins use a separate account only for admin work.
- Admin accounts can’t use the internet, email or web services, except where explicitly authorised and limited.
- Privileged and everyday work happen in separate environments, and accounts can’t cross between them.
Application control
- Application control is on every workstation.
- It covers user profiles and temporary folders used by Windows, browsers and email clients.
- Only an approved set of executables, libraries, scripts, installers, compiled HTML, HTML applications and control panel applets can run.
Restrict Microsoft Office macros
- Macros are disabled for anyone without a demonstrated business need.
- Macros in files from the internet are blocked.
- Macro antivirus scanning is on.
- Users can’t change macro security settings.
User application hardening
- Internet Explorer 11 is disabled or removed.
- Browsers don’t process Java or web advertisements from the internet.
- Users can’t change browser security settings.
Regular backups
- Data, applications and settings are backed up and kept according to how critical they are.
- Backups are synchronised so you can restore everything to a common point in time, and they’re stored securely.
- Restores are tested in disaster recovery exercises.
- Ordinary accounts can’t see other people’s backups, or change or delete any backup.
Why it matters now
The Essential Eight is becoming a requirement
Clients, insurers and tenders increasingly ask for your maturity level.
A contract or tender requirement
The Essential Eight written into a client contract or tender.
Insurance questionnaires
Renewal questions mapped to the Essential Eight controls.
No clear maturity level
You think you’re secure, but can’t say which maturity level you’ve reached.
Strong in places, weak in others
Maturity only counts when all eight strategies reach the same level.
What you get
From assessment to uplift
- Your maturity level across all eight strategies
- A target maturity level that suits your environment
- A prioritised remediation roadmap you can budget against
- Evidence packs for clients, insurers and tenders
- How your controls map to the new ASD Essentials
- Ongoing maturity tracking and reporting
How we assess
1. Scope
We agree the systems in scope, your target maturity level and what’s driving it: a contract, tender, insurer or board.
2. Test
Following ASD’s assessment process, we test controls on your systems and check configurations, not just policies and interviews.
3. Report
Your maturity level for each strategy, the evidence behind it and a prioritised, costed plan to reach your target.
4. Uplift
We close the gaps with you, retest, and track maturity over time so your evidence stays current.
Time, cost and credentials
How long an Essential Eight assessment takes, and what it costs
Timeline: four to six weeks
Most assessments take four to six weeks from kickoff to the final report. That covers scoping, evidence collection and testing, analysis, and a walkthrough of the results with your leadership team. Organisations with several sites, many servers or a lot of specialist software sit at the longer end.
Cost: from $5,000 + GST
Essential Eight assessments start from $5,000 + GST. The price depends mainly on the maturity level you’re assessed against, because each level adds requirements to test. The number of staff, devices, servers and sites also affects it. You get a fixed quote after the scoping call.
What’s in the report
- A plain-English summary for your board, partners or executive team
- Your maturity level for each of the eight strategies, and overall
- The evidence behind each rating: what we tested and how
- The gaps against your target level, ranked by risk
- A remediation roadmap with effort and indicative cost, ready to budget against
- Documented exceptions and compensating controls, the way ASD expects them
- A summary of how your controls line up with the ASD Essentials, for transition planning
Who does the work
Essential Tech is ISO 27001:2022 certified and a CyberCert partner for SMB1001 certification. Our assessments follow ASD’s Essential Eight assessment process guide.
Can you get Essential Eight certified? No. There’s no official Essential Eight certificate, and ASD’s maturity model says independent assessment is only needed where a government policy, regulator or contract requires it. If you need a certificate to show clients, SMB1001 is the usual route, and it covers many of the same controls.
Compare frameworks
Essential Eight vs ASD Essentials vs SMB1001 vs ISO 27001
These frameworks answer different questions, and many organisations use more than one. Here’s how they compare.
| Essential Eight | ASD Essentials | SMB1001 | ISO 27001 | |
|---|---|---|---|---|
| Published by | ASD | ASD, launched October 2026 | Dynamic Standards International | ISO and IEC |
| What it is | Eight technical mitigation strategies, measured at Maturity Levels Zero to Three | Principles and actions applied across eight domains, in phased priorities. The successor to the Essential Eight | A tiered cyber security certification for small and medium businesses, from Bronze to Diamond | An international standard for running an information security management system |
| Certificate? | No. Independent assessment only when a contract, regulator or policy requires it | No. Each action is rated not effective, partially effective or fully effective | Yes. Bronze to Gold are attested by a director; Platinum and Diamond are independently audited | Yes, from an accredited certification body, with regular surveillance audits |
| Best for | Meeting contracts, tenders and insurer questions that name a maturity level | Commonwealth entities, critical infrastructure and large organisations planning their next step | Small and medium businesses that need a recognised certificate | Organisations that need an internationally recognised certification |
Not sure which one you need? Start with what your clients, tenders or insurer are asking for. See SMB1001 certification, our Business Protect service with SMB1001 built in, or our vCIO services for ongoing guidance.
FAQ
Essential Eight questions
Is the Essential Eight being replaced?
Yes, over time. ASD launched the ASD Essentials on 15 October 2026 as its successor, but hasn’t set a transition date. Until regulators change their requirements, contracts and insurers that name the Essential Eight still apply. What the change means for you.
What’s the difference between an Essential Eight assessment and an audit?
People use the terms interchangeably. Both measure your controls against the maturity model. “Audit” usually means an independent assessment done for a third party, such as a government client. Either way, the result is a maturity level per strategy, backed by evidence.
How long does it take to reach Maturity Level One?
It depends on where you start. Organisations already on Microsoft 365 with managed devices can often close most Maturity Level One gaps within a few months. Application control usually takes longest, because it has to be tested against every business application before it’s enforced.
Does Microsoft 365 Business Premium make us Essential Eight compliant?
No, but it gives you many of the tools, including Intune, Microsoft Defender for Business and Entra ID Conditional Access. Your maturity depends on how those tools are configured, how quickly patches go on, and whether backups are tested.
Do we need Maturity Level Two for cyber insurance?
Insurers vary. Most renewal questionnaires ask about MFA, backups, patching and admin privileges, which line up with the Essential Eight. Some ask for a stated maturity level. An assessment gives you accurate, evidenced answers instead of best guesses.
Can you assess us if another provider manages our IT?
Yes. We work alongside your current provider, and the report is written so either of us can act on it.
Book your assessment
Let's find out where you stand
Tell us a little about your firm and what’s prompting the review. We’ll come back to you to book the discovery conversation.
- No obligation to proceed
- Written for leadership, not for IT
- Works alongside your current provider
Helping you protect what you’ve built and build what’s next. Australian owned, operating in Brisbane, Sydney and Melbourne with local accountability and global capability.