Compliance | Essential 8
Essential Eight: finding the maturity level that's
right for you.
We help organisations reach the Essential Eight maturity level that aligns with their risk profile, operational requirements, and compliance obligations. For some, that's Level 1. For others, it's Level 2 or Level 3. Our role is to determine what's appropriate and help you get there.
Which Essential Eight maturity level do you need?
Level 1 is the minimum every Australian organisation should be at. Beyond that, the right target depends on your security maturity. Organisations with an established security function, sensitive or regulated data, or contractual and insurance expectations to meet should aim for Level 2. Level 3 is for defence, critical infrastructure and organisations holding highly sensitive data.
Aim for Level 2 if two or more of these are true:
- Security is someone's actual job, not something IT covers between other work.
- You hold sensitive, regulated or customer data you would have to report on if it were breached.
- Customers, insurers or tenders are already asking what your controls are.
- Your environment is complex: multiple sites, cloud services, remote access, or operational technology.
Level 1 is a recommended baseline, not a law. Non-corporate Commonwealth entities are required to reach Level 2 under the PSPF. For everyone else the pressure comes from insurers, tenders and customer contracts, and it is increasing rather than easing.
Some sectors carry more specific expectations on top of that. APRA-regulated entities are typically expected at ML2 or higher to satisfy CPS 234 expectations. Critical infrastructure operators covered by the SOCI Act usually need ML2 with selected ML3 controls. ML3 is appropriate for entities holding highly sensitive data or running systems whose compromise would carry wide downstream impact.
Eight strategies. Four maturity levels. One baseline.
The Essential Eight (also known as the Essential 8 or E8) is a set of prioritised mitigation strategies developed by the Australian Signals Directorate (ASD) to help organisations protect against cyber threats. It represents the minimum baseline for Australian organisations, and is increasingly expected by government agencies, regulators, and enterprise procurement teams.
Each strategy has four maturity levels (0–3), where Level 0 indicates significant gaps and Level 3 represents the strongest implementation. The Australian Government expects all non-corporate Commonwealth entities to achieve at least Maturity Level 2.
Most organisations stop at Level 2. Level 3 is where it gets hard.
Maturity Level 1 and Level 2 are achievable with reasonable effort for most organisations. Maturity Level 3 is a fundamentally different challenge. It requires granular technical controls, rigorous enforcement, and often significant changes to how your IT environment operates.
Cliffside has the experience to help you get there, not just by documenting controls, but by implementing the technical solutions that actually achieve ML3 compliance. We know where the hard parts are because we've done them.
The eight strategies
ASD's Essential Eight mitigation strategies.
Prevent execution of unapproved and malicious programs, including .exe, DLL, scripts, and installers, on workstations and servers.
Patch, update, or mitigate vulnerabilities in internet-facing applications and high-risk applications within 48 hours when exploits or critical patches exist.
Block macros from the internet, only allow vetted macros in trusted locations, and implement macro signing and notification for users.
Configure web browsers to block Flash, ads, and Java. Disable unneeded features in Microsoft Office, web browsers, and PDF viewers.
Restrict admin privileges to only those who need them. Use separate privileged and unprivileged accounts. Validate need for privileges regularly.
Patch, update, or mitigate vulnerabilities in operating systems within 48 hours when exploits or critical patches exist. Replace unsupported operating systems.
Implement MFA for remote access, privileged access, and access to important data repositories. Use phishing-resistant MFA where possible at ML3.
Perform regular backups of important data, software, and configuration settings. Test restoration of backups. Store backups disconnected and retain for at least three months.
The Essential Eight Maturity Model: ML0 through ML3 at a glance.
The ASD assesses each of the eight mitigation strategies against four maturity levels. The levels are cumulative: ML2 includes everything required at ML1, and ML3 includes everything required at ML2. The November 2023 update raised the bar at every level, which is why most organisations now sit below the rung they assume they hold.
Weaknesses that commodity attacks are built to find. This is where most organisations discover they are.
Closes the doors that opportunistic ransomware and credential theft walk through. Every Australian organisation should be here.
Withstands attackers willing to spend time and effort on you specifically.
Defence, critical infrastructure, and organisations holding highly sensitive data. Scoped individually, and the work most consultants won't take on.
Each level is defined by the attacker it is built to stop. ML1 targets opportunistic attackers using widely available tradecraft, and is achievable with reasonable effort in most environments. ML2 targets attackers with a degree of capability and targeting. ML3 targets adaptive attackers willing to invest time in compromising you, which is why it requires granular technical controls, strict enforcement, and often significant changes to how your environment operates. We assess where you actually sit and build a practical roadmap to where you need to be. Read our Essential Eight Maturity Level 3 guide for what ML3 actually requires in practice.
Our services
How Cliffside helps with Essential Eight.
A thorough assessment of your current Essential Eight maturity level across all eight strategies. We provide an honest evaluation with clear evidence of where you meet, partially meet, or fail to meet each maturity level's requirements.
Hands-on remediation to close the gaps identified in your assessment. We don't just write reports; we lead the uplift to your target maturity level alongside your IT team or MSP, with responsibilities agreed and documented before remediation begins.
Specialist support for organisations targeting Maturity Level 3. This includes application control whitelisting, advanced MFA deployment, privileged access management, and the granular technical controls that ML3 demands.
Essential Eight maturity isn't a one-time assessment; it requires ongoing maintenance as your environment changes. We provide periodic reassessment and continuous monitoring to ensure you maintain your target maturity level.
The assessment, the Level 1 programme and ongoing monitoring each have a published price. See Essential Eight pricing.
Checklist
Essential Eight compliance checklist.
Use these self-assessment questions to evaluate your current state across each of the eight strategies before a formal maturity assessment.
Have you identified all approved applications? Are unapproved executables, scripts, and installers blocked on workstations and servers? Is your application control solution tested regularly?
Are internet-facing application patches applied within 48 hours of release? Do you have visibility of all installed applications and their versions? Are unsupported applications removed or isolated?
Are macros from the internet blocked? Are only vetted macros allowed in trusted locations? Is macro execution logged and monitored for anomalies?
Are web browsers configured to block ads, Flash, and Java? Are unnecessary features disabled in Office, browsers, and PDF viewers? Are security settings enforced via group policy?
Do administrators use separate privileged and unprivileged accounts? Is privileged access limited to only those who need it? Are admin privileges validated and reviewed regularly?
Are OS patches for internet-facing systems applied within 48 hours? Are unsupported operating systems replaced or isolated? Do you have automated patch compliance reporting?
Is MFA enforced for remote access, privileged access, and sensitive data? Are you using phishing-resistant MFA methods for ML3? Is MFA coverage complete across all applicable systems?
Are backups of important data performed regularly and tested? Are backups stored disconnected from the network? Are backup retention periods at least three months? Can you restore within your target timeframe?
Frequently asked questions.
What maturity level should our organisation target?
Do you publish your Essential Eight prices?
How long does an Essential Eight assessment take?
What is the difference between Essential Eight and ISO 27001?
Does Essential Eight apply to state government and private sector?
Is there an official Essential 8 checklist?
Know your maturity level.
Start with an honest assessment. We'll tell you exactly where you stand across all eight strategies and give you a practical roadmap to your target maturity level, whether that's Level 1, 2, or 3.