Reach your Essential Eight maturity target with evidence to prove it

The Essential Eight is a set of eight cyber security mitigation strategies published by the Australian Signals Directorate (ASD). The strategies are patch applications, patch operating systems, multi-factor authentication, restrict administrative privileges, application control, restrict Microsoft Office macros, user application hardening and regular backups. ASD recommends them as a baseline that makes it much harder for adversaries to compromise systems, and measures implementation using the Essential Eight Maturity Model.

The Essential Eight is mandatory for Australian non-corporate Commonwealth entities, which must implement all eight strategies to Maturity Level Two under the Protective Security Policy Framework. For most other organisations it is voluntary, although state agencies, government buyers, insurers and customers increasingly ask for evidence of Essential Eight maturity. Private businesses usually adopt it because it is a recognised, practical baseline for Australian cyber security.

The Essential Eight Maturity Model has four levels: Maturity Level Zero to Maturity Level Three. Level One targets opportunistic adversaries using commodity tools, Level Two targets adversaries willing to invest more time and effort, and Level Three targets more adaptive adversaries. ASD advises reaching the same level across all eight strategies before moving to a higher one, as an organisation's overall maturity is only as strong as its weakest strategy.

The November 2023 update tightened requirements across the model. Changes included patching critical vulnerabilities within 48 hours where working exploits exist, more frequent vulnerability scanning and patching for internet-facing and high-risk software, and stronger requirements around multi-factor authentication and privileged access. Organisations assessed against the earlier version should re-check their maturity, because some controls previously met at a level may no longer qualify.

No. ASD does not offer a formal Essential Eight certification. Organisations self-assess or engage an independent assessor, who follows ASD's Essential Eight Assessment Process Guide to determine the maturity level achieved for each strategy. Claims of being Essential Eight certified usually refer to an assessment report, so buyers and auditors typically ask for the assessed maturity level and supporting evidence instead.

The Essential Eight and ISO 27001 complement each other. ISO 27001 is an international, certifiable standard for running an information security management system, while the Essential Eight is a focused set of technical mitigation strategies. Many Essential Eight controls, such as patching, MFA, backups and privileged access, support ISO 27001 Annex A controls, so evidence collected for one can often be reused for the other.

It depends on your starting point, the size and complexity of your environment and how mature each strategy already is. Patching timeframes, application control and Office macro restrictions often take the most effort, because they change how people and systems work. A gap assessment against each strategy is the best way to estimate your timeline, and automating evidence collection reduces the effort of proving each level.

Yes. OneClickComply supports the Essential Eight today. The platform maps all eight strategies at Maturity Levels One to Three to controls, collects evidence automatically from connected identity, device and cloud tools, and monitors for drift. OneClickFix corrects supported misconfigurations in one click, and our in-house audit team can guide you towards your target maturity level. OneClickComply does not issue certifications or assessments of maturity.