Short answer: The Essential Eight Maturity Model, published by the Australian Signals Directorate (ASD), grades each of the eight mitigation strategies from Maturity Level Zero to Maturity Level Three. Each level is built to resist a more capable attacker. Most small and medium businesses should reach Maturity Level One across all eight strategies first, then move towards Level Two.
If you have read our guide to what the Essential Eight is, you know the eight controls. This post covers the next question we hear from business owners in Toowoomba, the Gold Coast and Brisbane: what do the maturity levels actually mean, and which one do we need?
What is the Essential Eight Maturity Model?
The maturity model is the part of the Essential Eight that tells you how well each control is implemented, not just whether it exists. ASD (through the Australian Cyber Security Centre, which is why you will also see it called the “ACSC Essential 8 maturity model”) defines the requirements for each strategy at each level.
The eight strategies are:
- Application control
- Patch applications
- Configure Microsoft Office macro settings
- User application hardening
- Restrict administrative privileges
- Patch operating systems
- Multi-factor authentication (MFA)
- Regular backups
Each strategy is assessed separately. A business can be at Level Two for MFA and Level Zero for application control at the same time. ASD’s guidance is to reach the same level across all eight before trying to go higher on any one of them, because attackers look for the weakest control.
What are the four Essential Eight maturity levels?
There are four levels, counted from zero. Each one is based on the type of attacker it is designed to stop.
Maturity Level Zero
There are weaknesses in your overall cyber security posture. In plain terms, at least one requirement of Level One is not met. Many businesses are here without knowing it, often because backups are not tested or MFA is not on every account.
Maturity Level One
Level One is aimed at opportunistic attackers using widely available tools and techniques, such as phishing emails, stolen passwords and known vulnerabilities that have not been patched. Typical Level One requirements include:
- MFA for online services and remote access
- Patching internet-facing services and common applications within set timeframes
- Blocking Office macros from the internet
- Regular backups that are tested and kept separate from normal user access
- Limiting who has admin rights
For most small businesses, Level One is where the biggest drop in risk comes from.
Maturity Level Two
Level Two is aimed at attackers who are willing to spend more time and effort, and who use more effective tools, for example targeted phishing and attempts to get around basic MFA. Requirements tighten: faster patching, phishing-resistant MFA for more users and systems, more logging of admin activity, and stricter control over which applications can run.
Businesses that hold sensitive client data, work in regulated sectors, or supply government often look at Level Two.
Maturity Level Three
Level Three is aimed at skilled, adaptive attackers who target a specific organisation and will work hard to get past its defences. Requirements include very short patching windows, application control across workstations and servers, phishing-resistant MFA broadly, and central logging with monitoring of events.
Level Three takes ongoing effort and budget. It is usually driven by a contract or regulatory requirement rather than a general choice.
What is the difference between Maturity Level 1 and Maturity Level 2?
The short version is speed, coverage and strength.
| Area | Maturity Level One | Maturity Level Two |
|---|---|---|
| Attacker | Opportunistic, commodity tools | More targeted, more effort |
| Patching | Set timeframes for internet-facing and common apps | Shorter timeframes, wider coverage |
| MFA | Online services and remote access | Wider coverage, phishing-resistant options |
| Admin privileges | Restricted and reviewed | Tighter controls plus logging of privileged activity |
| Application control | Workstations | Broader, with logging |
ASD updates the model from time to time, so always check the current ASD publication for exact timeframes before an assessment.
Which Essential Eight maturity level should a small business aim for?
For most small and medium businesses we work with, the practical answer is:
- Find your current level for each of the eight strategies. Most businesses discover one or two strategies sitting at Level Zero.
- Bring every strategy to Level One. This is usually done with settings you already pay for. If you use Microsoft 365, our post on Microsoft 365 Business Premium and the Essential Eight shows how much is already included.
- Decide on Level Two based on risk. Look at the data you hold, your insurer’s questions and any customer or government contract requirements.
Level Three is rarely the right first target for a small business.
How is an Essential Eight maturity level assessed?
An assessment checks each requirement for each strategy and records evidence, for example screenshots of policy settings, patch reports, backup restore tests and admin account lists. The result is a level per strategy and a list of gaps.
A useful assessment gives you:
- Your current level for all eight strategies
- The specific gaps stopping you reaching the next level
- A prioritised plan, with quick wins first
- A view on what can be fixed with existing licences and what needs new tools
Our Essential Eight services cover this assessment and the remediation work afterwards, alongside our wider cybersecurity consulting and compliance and governance support.
How long does it take to reach Maturity Level One?
It depends on how many devices and systems you have and where you start. Businesses already on Microsoft 365 with managed devices can often close the main Level One gaps in weeks rather than months. The slower parts are usually application control and proving that backups restore properly. Staff habits matter too, which is where security awareness training helps.
Essential Eight support in Toowoomba, the Gold Coast and Brisbane
Loginet Technologies has been helping Queensland businesses for more than four years. We are a Microsoft Partner, AWS Partner and Microsoft Azure Partner, with a team of 20+ IT experts holding certifications across AWS, Microsoft, Cisco, Palo Alto, Fortinet and CEH.
We support businesses with managed IT services in Toowoomba from our head office, managed IT on the Gold Coast from our Bundall office, and managed IT for Brisbane businesses delivered remotely and on site from our Toowoomba and Bundall teams.
Frequently asked questions
How many Essential Eight maturity levels are there?
Four: Maturity Level Zero, One, Two and Three. Zero means Level One requirements are not fully met.
Is the Essential Eight mandatory for private businesses?
It is mandatory for many Australian Government entities. For private businesses it is not a law, but customers, insurers and government contracts increasingly ask about it.
What is the difference between the ACSC and ASD Essential Eight?
They are the same framework. The ACSC is part of ASD, so you will see both names used.
Can we be at different maturity levels for different strategies?
Yes. Each strategy is assessed separately. ASD recommends reaching the same level across all eight before going higher on any single one.
Does Microsoft 365 get us to Maturity Level One?
It can cover a large part of it, especially MFA, macro settings, patching and admin controls, but only if configured correctly. Backups and application control usually need extra work.
Find out where you stand
Not sure which maturity level you are at today? Let’s talk and we will walk you through an Essential Eight assessment and a practical plan to reach Level One and beyond.
