The Essential Eight has become the default yardstick for Australian government suppliers, tender panels and cyber insurers, and someone has now asked what level you are actually at.
Non-corporate Commonwealth entities must reach Maturity Level 2 across all eight mitigation strategies under the Protective Security Policy Framework. The obligation is a policy instrument, not legislation, and it is reported against annually.
Tender panels, enterprise procurement teams, APRA-regulated supply chains and an increasing number of cyber insurers now ask for an Essential Eight position. None of these mandate it. All of them will decline to proceed without an answer, which in practice is the same thing.
Organisations with no government, regulated or enterprise supply-chain exposure are not bound by anything here. For them the right maturity level is set by the threat they actually face, not by their size, and Maturity Level 1 is a legitimate destination rather than a failure.
Sources: Protective Security Policy Framework · ASD Essential Eight Maturity Model. The official source governs.
E8 /
ASD
The Essential Eight is a prioritised set of eight mitigation strategies published by the Australian Signals Directorate through the Australian Cyber Security Centre. It exists to make the most effective controls explicit and measurable, and it is accompanied by a four-level maturity model.
It is a subset of the Information Security Manual: the ISM is the full ASD control framework and the Essential Eight is the prioritised starting point within it. That relationship is the fact most often missed, and it determines what an Essential Eight position does and does not get you.Source: ASD Essential Eight Maturity Model
Four maturity levels, described by the adversary capability each is designed to withstand rather than by the effort required to reach it. The distinction matters: the levels are threat-based, not size-based.
Exists to capture the position accurately rather than to describe a target. Common before a first assessment, including in organisations where individual controls feel reasonably mature.
ML0 · Maturity Level ZeroOpportunistic attackers, common malware, low-effort techniques. Achievable with reasonable effort in most environments and the minimum any organisation handling sensitive data should hold.
ML1 · Maturity Level OneThe PSPF baseline for non-corporate Commonwealth entities, and increasingly the expectation in enterprise procurement and APRA-regulated supply chains.
ML2 · Maturity Level TwoRequires granular technical controls and strict enforcement. A practical prerequisite for IRAP, and rarely the right target for an organisation outside that path.
ML3 · Maturity Level ThreeSource: ASD Essential Eight Maturity Model and Essential Eight Assessment Process Guide.
If you are a non-corporate Commonwealth entity, the PSPF sets Maturity Level 2 across all eight strategies. If you supply government or regulated buyers, the level is set by whoever is asking, which is increasingly Level 2 and occasionally Level 3. If neither applies, ASD's position is that the target should reflect the threat the organisation faces.
Level 2 is materially harder than Level 1 in three specific places: patch windows tighten to a fortnight for internet-facing services, logging must be centralised and retained, and multi-factor authentication must be phishing-resistant for privileged users. Those three account for most of the effort in most uplift programmes, and they are the three that require budget rather than configuration.
ASD advises reaching the same level across all eight strategies before going higher. Organisations routinely reach Level 3 on two or three strategies where the tooling made it easy, and sit at Level 1 on the rest, and then report a Level 3 position. That is worth less than a uniform Level 2, and an assessor will score it as Level 1. The maturity model is deliberately unforgiving about this.
The rule that changes the resultYour rating is your weakest strategy, not your average.
Useful overlap is not equivalence. One framework can create reusable evidence without satisfying another.
| Framework | Relationship | What it does get you | What it doesn't |
|---|---|---|---|
| Information Security Manual | Subset of | The Essential Eight is the prioritised starting point within the ISM. Reaching Level 3 covers a meaningful portion of ISM technical controls. | It does not cover the ISM's governance, personnel, physical or system-specific control families, which is most of the catalogue. |
| IRAP | Prerequisite for | Maturity Level 3 is a practical prerequisite for IRAP success. Organisations without mature patching, access control and application hardening face the longest remediation periods. | Maturity Level 2 does not make you IRAP-ready. Eight mitigation strategies against hundreds of ISM controls is not a comparison of degree. |
| ISO 27001 | Overlapping | Both require evidenced control operation, and the evidence you build for one is largely reusable for the other. | ISO 27001 is a management-system standard with risk-based control selection. The Essential Eight is prescriptive and technical. Neither satisfies the other. |
| Cyber insurance | Anchor for | Australian insurers increasingly anchor their questionnaires to Essential Eight controls, so an evidenced position answers much of the form. | An insurer's questions go beyond the eight: incident response, backups tested under load, and supplier exposure are all commonly asked and none is an Essential Eight control. |
It is cheaper, faster and it removes the remediation that otherwise stalls an IRAP assessment in its first weeks. Running them concurrently is possible and usually costs more than running them in sequence.
These are the ones we see most often. Each has a direct cost in elapsed time or in a rating that comes back lower than expected.
The policy says application control is in place. The assessment finds it enforced on the corporate fleet and not on the server estate, or running in audit mode rather than enforcement. This is the single most common gap between a self-assessed position and an evidenced one.
Three strategies at Level 3 and five at Level 1 gets reported as "around Level 2". An assessor scores it as Level 1, because the model takes the lowest.
Backup configuration is easy to evidence and restoration is not. Organisations routinely discover at assessment that nobody has tested a restore of a system that matters, or that the restore path depends on credentials stored in the environment being restored.
Level 2 requires internet-facing services patched within two weeks. Reporting usually covers the whole estate, where the average is comfortable and the exposed systems are the exception.
Service accounts created during migrations, shared credentials in runbooks, vendor accounts never revoked. Restricting administrative privileges is scored on what exists, not on what the identity platform knows about.
We run an evidence-based Essential Eight assessment across all eight strategies at your target maturity level, produce a rating you can put in front of an auditor or a tender panel, and sequence the uplift to the level you actually need rather than to the highest one available.
Everything below is yours to keep, in the format stated, handed to the named recipient.
A rating per strategy at the target level, with the evidence behind each rating stated rather than asserted.
Report · board and audit committee versionsAll eight strategies against the target level, on one page: the artefact that ends up in a board pack.
Heatmap · executive teamEvery gap with an effort estimate and a cost, sequenced so the next phase can be scoped rather than guessed.
Roadmap + spreadsheet · budget-readyWhat was tested, how, and what the test showed, so a third party can follow the reasoning.
Evidence set · audit-readyThe position, the gap to target, and the ask, in three pages.
Summary · board packOrganised by mitigation strategy, the framework's own structure, so it can be checked against the source.
Scope is agreed before testing. The target maturity level and the system classes in scope are agreed, and the evidence requirements stated in writing, before anything starts.
Application control: 3 areas, listed above
Patching: 3 areas, listed above
Macro settings & hardening: 3 areas, listed above
Administrative privileges: 3 areas, listed above
Multi-factor authentication: 3 areas, listed above
Backups: 3 areas, listed above
Remediation: We assess and sequence. Closing the gaps is your team or separate scoped work, and closing them is where the real effort lies.
ISM or IRAP assessment: The Essential Eight is a subset of the ISM. A full ISM position is a different engagement.
Penetration testing: Adversarial testing is a different service with a different method.
Ongoing monitoring: A point-in-time position. We state a review horizon in the report.
Certification: No one certifies against the Essential Eight. We produce a rating; nobody issues a certificate.
Anything outside the standard scope is quoted before it starts, never absorbed and invoiced later.
The word that matters is evidence-based. A defensible assessment separates what is claimed from what can be demonstrated: it inspects configurations, samples systems and tests controls rather than accepting a questionnaire answer. The gap between the two is usually where the report earns its fee, and it is always where a self-assessed position and an assessed one diverge.
What you do: one scoping call (60 minutes) plus read access to system management consoles.
Week 1What you do: a technical point of contact for roughly 3 hours a week, plus 2 to 3 interviews.
Weeks 2 to 3What you do: availability to clarify findings, roughly 2 hours.
Week 4What you do: one review cycle and a 60-minute readout session.
Weeks 5 to 63 to 6 weeks for the assessment, and roughly 12 to 15 hours of your team's time. The assessment is the smaller number. Closing the gaps it finds is where the real effort and the real cost lie, and the roadmap is built so that work can be scoped rather than estimated.
What your scope actually looks like, what it would cost, and whether this is the right framework for you at all. With Steve Sharma, who would lead the engagement.
Founder & Principal
Conducts the assessment personally: the evidence testing and the rating are not delegated.
Every engagement has a named lead. Where a second executive or specialist is needed, they are named in the proposal and subject to client approval.
Full profileWe assess against the maturity model and report a rating. The rating is ours, not a government endorsement.
No body issues a certificate, and any provider implying otherwise is describing something that does not exist.
We assess and sequence. We do not remediate within this engagement, and we never assess remediation we performed.
We are not a managed security service. We do not run your SOC or monitor your environment.
Standard assessment scope
Register to see indicative feesA fixed fee for the standard scope, confirmed in writing after a short scoping call. Anything outside it is quoted before it starts, never absorbed and invoiced later.
Increases the feeSize and spread of the environment: endpoint fleet, server count, sites and cloud tenancies all drive evidence volume.
Increases the feeTarget maturity level: assessing against ML2 or ML3 requires deeper technical verification than an ML1 baseline.
Reduces the feeEvidence readiness: where configuration and patch reporting is already centralised.
Increases the feeNumber of system classes: each additional distinct class beyond three adds to the evidence and testing.
A tender required an evidenced Essential Eight maturity position within eight weeks, and the organisation's existing position was a self-scored spreadsheet nobody was willing to sign.
Scoping in week one established that the self-score had averaged across strategies rather than taking the minimum. The real position was Level 1, not Level 2. The roadmap was built to the level the tender actually required rather than to Level 3.
From engagement to an evidenced position submitted with the tender, inside the window. Four strategies required uplift; the other four were already at target and were left alone.
Eight questions, one per mitigation strategy, phrased as the statement closest to your reality today. Returns an indicative maturity level and the two strategies most organisations at that level fix first. About five minutes.
This page summarises published guidance for practical use. Where it differs from the source, the source governs. The Essential Eight is evolving: the Australian Signals Directorate updates the Essential Eight Maturity Model periodically, and we review this page on publication of any revision, not only on our quarterly cycle.
Written by Steve Sharma, Founder & Principal, and reviewed by the same person.
Founder & Principal
Reviewed by the same person. At our scale the author and reviewer are one person, and saying so is more honest than inventing a second name.
If you are a non-corporate Commonwealth entity, the PSPF sets Level 2. If a tender or customer is asking, the level is theirs to set. Otherwise ASD's position is that the target should reflect the threat you face, and Level 1 across all eight is a legitimate destination, not a failure.
No. The Essential Eight covers eight mitigation strategies; an IRAP assessment tests the far broader ISM control catalogue. Level 3 is a practical prerequisite for IRAP, but it is a starting position rather than a substitute.
No. Nobody certifies against the Essential Eight, and no body issues a certificate for it. We produce an evidenced maturity rating, which is what tenders and insurers actually ask for, and any provider offering a certificate is describing something that does not exist.
Possibly not, and we would rather establish that in the scoping call. The question we would ask is whether the position was evidenced or self-scored, and whether it took the minimum across all eight or the average. If it was evidenced and took the minimum, bring us the gaps instead of the assessment.
We state a review horizon in the report, usually six to twelve months, shorter where the environment changes rapidly. Patch and configuration drift are the two that move fastest.
Some of them, as separate scoped work, and we never assess remediation we performed. Often your own team or a cheaper provider is the right answer for the technical uplift, and we will say so.
Official sources govern. This page explains their practical application.