Framework · Cybersecurity · Australia

Essential Eight compliance: the 8 strategies and maturity levels

Essential Eight compliance means implementing the eight mitigation strategies published by the Australian Signals Directorate to the maturity level your risk calls for. The current maturity model, updated in November 2023, defines levels zero to three, and Australian government entities generally target maturity level two.

Written by QULDEX EditorialReviewed by Ankit Tiwari, Framework reviewerUpdated
Check your Essential Eight maturityBook a 30-min walkthrough
Key takeaways

What you need to know about Essential Eight

Eight strategiesApplication control, patching, macros, hardening, admin privileges, OS patching, MFA and backups.
Level by levelReach one maturity level across all eight before moving up.
Government baselineCommonwealth entities generally target level two.
Phishing-resistant MFAExpected for privileged users at higher levels.
Changes aheadASD has consulted on a broader "Essentials" series; the 2023 model still applies.

Who needs the Essential Eight?

Australian government entities by policy, and many suppliers and businesses by contract or choice.

Commonwealth entitiesRequired under the Protective Security Policy Framework.
State and local governmentMany states adopt it.
Government suppliersContracts often ask for a maturity level.
Australian businessesA practical baseline recommended by ASD.
MSPs and IT providersServing government customers.

QULDEX helps here first: the readiness check shows where you stand before you commit budget.

What the model requires

What does the Essential Eight require?

The Essential Eight requires eight mitigation strategies, implemented to a chosen maturity level, with each level's requirements met across all eight before moving to the next.

E8-1–4 Prevent

Prevent malware delivery

Application control, patching apps, macros, hardening.

In QULDEX: Requirements per level
E8-5–7 Limit

Limit the extent

Admin privileges, OS patching, MFA.

In QULDEX: Privileged access reviews
E8-8 Recover

Recover data

Regular, tested, protected backups.

In QULDEX: Restore tests
ML0–3 Mature

Maturity levels

Same level across all strategies.

In QULDEX: Maturity tracked per strategy
Strategy explorer

What are the Essential Eight strategies and maturity levels?

The eight strategies and the four maturity levels. Select any one to see what it asks for, typical evidence and the matching ISO 27001 and CIS Controls references.

8strategies
4maturity levels
Nov 2023current model
ML2government target

Showing up to 6 per group. Search, filter, or open a group to see all 12.

Prevent malware delivery 4

  1. E8-1Application control

    Allow only approved applications, scripts and libraries to run on workstations and servers.

    In QULDEXQULDEX tracks this strategy's maturity level with evidence per requirement, so the next assessment starts from current proof.

    Typical evidence
    Allow-list policy, test results
    Maps to
    ISO 27001 A.8.19CIS 2

  2. E8-2Patch applications

    Patch internet-facing services, browsers, office and security products quickly, and remove unsupported applications.

    In QULDEXPatch timelines are tracked against the maturity level's targets.

    Typical evidence
    Patch reports
    Maps to
    ISO 27001 A.8.8CIS 7

  3. E8-3Configure Microsoft Office macro settings

    Block macros from the internet and allow only trusted, signed or vetted macros.

    In QULDEXQULDEX tracks this strategy's maturity level with evidence per requirement, so the next assessment starts from current proof.

    Typical evidence
    Group Policy evidence
    Maps to
    CIS 4

  4. E8-4User application hardening

    Harden browsers and office apps, for example blocking ads, Java and web scripts where not needed.

    In QULDEXQULDEX tracks this strategy's maturity level with evidence per requirement, so the next assessment starts from current proof.

    Typical evidence
    Hardening baselines
    Maps to
    ISO 27001 A.8.9

Limit the extent of incidents 3

  1. E8-5Restrict administrative privileges

    Limit, validate and review privileged access; keep privileged accounts away from email and web browsing.

    In QULDEXPrivileged access reviews run as recurring tasks.

    Typical evidence
    Privileged user list, reviews
    Maps to
    ISO 27001 A.8.2CIS 5

  2. E8-6Patch operating systems

    Patch operating systems quickly, and replace unsupported versions.

    In QULDEXQULDEX tracks this strategy's maturity level with evidence per requirement, so the next assessment starts from current proof.

    Typical evidence
    Patch reports
    Maps to
    ISO 27001 A.8.8

  3. E8-7Multi-factor authentication

    Use MFA for online services, remote access and privileged users; phishing-resistant MFA is expected at higher levels.

    In QULDEXMFA coverage is tracked per system and user type.

    Typical evidence
    MFA settings
    Maps to
    ISO 27001 A.8.5CIS 6

Recover data and availability 1

  1. E8-8Regular backups

    Back up important data, software and settings, test restoration, and protect backups from unauthorised change.

    In QULDEXQULDEX tracks this strategy's maturity level with evidence per requirement, so the next assessment starts from current proof.

    Typical evidence
    Backup logs, restore tests
    Maps to
    ISO 27001 A.8.13CIS 11

Maturity levels 4

  1. ML0Maturity level zeroMaturity level

    Weaknesses in the overall posture that would let an adversary easily compromise systems.

    In QULDEXQULDEX tracks this strategy's maturity level with evidence per requirement, so the next assessment starts from current proof.

  2. ML1Maturity level oneMaturity level

    Defends against adversaries using commodity tradecraft and widely available tools.

    In QULDEXQULDEX tracks this strategy's maturity level with evidence per requirement, so the next assessment starts from current proof.

  3. ML2Maturity level twoMaturity level

    Defends against adversaries willing to invest more time and use more effective tools; the common target for government entities.

    In QULDEXQULDEX tracks this strategy's maturity level with evidence per requirement, so the next assessment starts from current proof.

  4. ML3Maturity level threeMaturity level

    Defends against more adaptive adversaries that are less reliant on public tools.

    In QULDEXQULDEX tracks this strategy's maturity level with evidence per requirement, so the next assessment starts from current proof.

Strategy names follow the ASD Essential Eight Maturity Model (November 2023). Summaries are QULDEX paraphrases; check cyber.gov.au for each level's exact requirements.

Maturity path

How do you reach an Essential Eight maturity level?

Pick a target level, assess each strategy against it, close the gaps across all eight, then assess again. Most organisations need 3 to 9 months per level.

  1. Choose the target level

    Based on risk, contracts or government policy.

    1–2 weeksReadiness assessment →

  2. Assess each strategy

    Test against the level's requirements, using ASD's assessment process guide.

    3–6 weeksPre-mapped control library →

  3. Close gaps strategy by strategy

    Usually MFA, admin privileges and patching first.

    2–6 monthsCAPA automation →

  4. Prove it with evidence

    Configuration exports, patch reports and test results.

    3–6 weeksSecure evidence vault →

  5. Independent assessment

    Where contracts or policy require it.

    2–6 weeksMulti-auditor workspace →

  6. Hold the level

    WeeklyPatch and MFA reports
    YearlyRe-assess maturity
    Next levelRepeat for the next target
    OngoingRisk register →

Durations are QULDEX planning ranges.

Records to keep

Which evidence does an Essential Eight assessment need?

Assessors look for configuration and test evidence, not just policies.

EvidenceStrategyWhere it lives in QULDEX
Application control rules and test resultsE8-1Evidence vault
Patch reports with timelinesE8-2, E8-6Evidence vault
Macro settingsE8-3Evidence vault
Hardening baselinesE8-4Evidence vault
Privileged user list and reviewsE8-5Evidence vault
MFA configuration and coverageE8-7Evidence vault
Backup logs and restore testsE8-8Evidence vault
Maturity assessment reportAllAudit workspace

Evidence names are QULDEX recommendations based on ASD guidance.

Time and cost

How long does the Essential Eight take and what drives the effort?

Most organisations need 3 to 9 months to reach maturity level two. Application control, patching speed and phishing-resistant MFA drive most of the effort.

Where the time goes

Target and assessment4–8 wk
Application control2–6 mo
Patching1–3 mo
MFA and admin1–3 mo
Backups3–6 wk

Bars show the upper end of each range on one scale (9 months = full width).

What changes the effort

  • Target level: each level adds requirements
  • Estate size: more endpoints and servers to cover
  • Legacy systems: unsupported software must be removed
  • MFA type: phishing-resistant methods take longer
  • Existing CIS or ISO 27001: covers parts of the work
Readiness check · 2 minutes

How mature is your Essential Eight?

Check these eight things first. Nothing you enter leaves this page.

E8-1Is application control enforced on workstations and servers?
E8-2Are internet-facing apps patched within the required time?
E8-3Are internet macros blocked?
E8-4Are browsers and office apps hardened?
E8-5Are admin privileges restricted and reviewed?
E8-6Are operating systems patched and supported?
E8-7Is MFA used for remote access and privileged users?
E8-8Are backups tested and protected?
Crosswalk

How the Essential Eight maps to CIS Controls, ISO 27001 and NIST CSF

The Essential Eight is a prioritised technical baseline; CIS Controls and ISO 27001 cover the same ground and more.

Essential Eight crosswalk

Essential EightCIS Controls v8.1ISO 27001:2022NIST CSF 2.0Shared evidence
Application controlCIS 2A.8.19PR.PSAllow-lists
PatchingCIS 7A.8.8ID.RA, PR.PSPatch reports
Macros and hardeningCIS 4A.8.9PR.PSBaselines
Admin privilegesCIS 5A.8.2PR.AAAdmin reviews
MFACIS 6A.8.5PR.AAMFA settings
BackupsCIS 11A.8.13PR.DS, RC.RPRestore tests

Indicative mapping for planning.

Where QULDEX fits

How QULDEX runs the Essential Eight from assessment to maturity level

QULDEX is Essential Eight assessment and evidence software built from EGV Group's audit delivery, used by organisations, their MSPs and the assessors who check them. Pick your role to see who does what.

For government entities and businesses.

  1. TargetSet the target levelTarget per strategy
  2. AssessSelf-assessRequirements per level with evidence
  3. FixClose gapsGaps into CAPA
  4. ProveCollect evidenceConfiguration and patch evidence
  5. ReportReport maturityMaturity by strategy
  6. HoldKeep the levelRecurring evidence
Controls

Pre-mapped control library

Requirements with owners, test steps and the crosswalk to 50+ frameworks.

Explore →Evidence

Secure evidence vault

Evidence linked to controls and findings, with upload, review and approval history.

Explore →Risk

Risk register

Risk assessment and treatment, with decisions traced to the controls they drive.

Explore →Findings

CAPA remediation

Findings from internal and external audits tracked to closure with due dates.

Explore →
Without one systemWith QULDEX
Maturity scored once a yearMaturity tracked per strategy
Evidence pulled from tools by handConfiguration evidence on schedule
MSP reports in different formatsOne template across clients
E8 and ISO 27001 run separatelyOne control set mapped to both
10+years of audit delivery500+audits deliveredBoth sidesof the audit on one platformRBACand a full audit trail on every action
FAQ

Essential Eight questions people ask

What is the Essential Eight?

Eight mitigation strategies published by the Australian Signals Directorate: application control, patching applications, configuring Microsoft Office macros, user application hardening, restricting administrative privileges, patching operating systems, multi-factor authentication and regular backups.

What are the Essential Eight maturity levels?

Levels zero to three. Each level defends against a more capable adversary, and you reach a level only when all eight strategies meet it.

Who must meet the Essential Eight?

Australian Commonwealth entities under the Protective Security Policy Framework, generally to maturity level two. Others adopt it by contract or choice.

Is the Essential Eight being replaced?

ASD consulted in 2026 on expanding it into a broader "Essentials" series. The November 2023 maturity model remains the one assessed against until ASD publishes a replacement.

How is the Essential Eight assessed?

Against ASD's Essential Eight Assessment Process Guide, by testing each strategy's requirements at the target level with technical evidence.

From the QULDEX blog

Go deeper on Essential Eight

blog.quldex.com

NIST & CIS topic hub

NIST CSF, 800-53 and CIS Controls articles.

blog.quldex.com

Audit evidence naming convention

A file-naming scheme assessors can follow.

blog.quldex.com

Audit sampling size for compliance

How many samples assessors look at.

blog.quldex.com

NIST CSF 2.0: the Govern function explained

Governance around a technical baseline.

CIS ControlsPrioritised safeguardsISO 27001Information securityNIST CSF 2.0Cybersecurity frameworkMAS TRMSingapore technology riskSOC 2Trust services criteriaPCI DSSPayment security
Sources

References

  1. ASD, Essential Eight Maturity Model, November 2023. cyber.gov.au
  2. ASD, Essential Eight Assessment Process Guide. cyber.gov.au
  3. Protective Security Policy Framework. protectivesecurity.gov.au
  4. iTWire, Essential Eight: what applies now and what ASD is changing, 2026. itwire.com

Reviewed by

Ankit Tiwari

Framework reviewer · QULDEX

Reviewed this page against the ASD Essential Eight Maturity Model (November 2023).

Page history
  • : Page first built: strategy explorer, maturity levels and readiness check

Know your Essential Eight maturity level

Answer a short readiness check and get an indicative maturity level. No sales call needed to see the result.

Check your Essential Eight maturityBook a walkthrough
Schedule
Book a Demo