What an Essential Eight self-assessment takes

Each strategy is assessed at one of four levels, Maturity Level Zero through Maturity Level Three, and the criteria ask how completely and how consistently the mitigation is applied. Coverage asks whether every workstation and every internet-facing service carries the control. Timing asks whether patches land inside the window every cycle.

This is why a firm with an excellent security product can still sit at Maturity Level Zero on a strategy. A tool deployed to most of the fleet is a partial mitigation, and the maturity model scores the gap, whatever the intent. The logic runs the other way too: a small firm with no specialised tooling but disciplined patching, a short admin list, and enforced multi-factor authentication can claim Maturity Level One across much of the model.

The levels also encode adversary sophistication. Maturity Level One is pitched at commodity tradecraft: opportunistic attackers running public exploits and stolen credentials at scale. The higher levels assume adversaries who adapt to you specifically. Most small and mid-sized Australian firms should target Maturity Level One first and treat it as a floor.

"We have MFA" usually means multi-factor authentication is switched on for email, for most staff, most of the time. The maturity model asks four harder questions. Which factors: phishing-resistant methods, or an SMS code an attacker can socially engineer out of a telco. Which systems: remote access, the third-party services that hold your data, and privileged actions as well as the mail tenancy.

Which accounts: everyone, including directors, contractors, service accounts, and the break-glass account, or only some users. And which paths: the enrolment and reset flows, because that is where a real attacker goes once the front door is locked.

The test takes an afternoon. Pick accounts at random and try to reach something that matters without a second factor. Then walk the reset path and see what a help desk, or an unattended self-service flow, will hand over on the strength of a date of birth. If either test succeeds, record the maturity level you reached.

Evidence is an artefact someone else could verify. A policy that says patches land fortnightly is an intention. A patch report with release dates, deployment dates, and the delta between them is evidence. When we run an Essential Eight uplift for a client, the deliverable is an evidence trail for each mitigation for this reason, and we hold our own Maturity Level 3 position to the same standard.

For the execution controls, evidence is configuration as deployed; documentation of intent does not count. The application-control rule set alongside a log entry showing an unapproved binary refused to run. The tenancy or group-policy export showing macros from the internet blocked, plus the membership of whatever exemption group exists. The browser and Office hardening baselines pushed to endpoints, pulled from the endpoints.

For patching, it is the vulnerability or patch report by asset, with dates, and the exception list with owners and expiries. For privilege restriction, the current list of privileged accounts, a record showing each one was justified recently, and proof that administrators use separate accounts for daily work. For multi-factor authentication, the authentication-method report by account and a sign-in log showing challenges issued.

For backups, evidence is a restore test with a date and an outcome. A screenshot of the backup job succeeding proves the job runs. It says nothing about whether the data comes back, whether it comes back complete, or whether the person restoring it has ever done so outside an emergency.

The same findings come up again and again. Local administrator rights granted years ago to make a printer work, never revoked. One legacy application that cannot do multi-factor authentication and quietly became a permanent, undocumented exception.

Macros blocked for everyone except the finance team, the team attackers send macro-laden invoices to. Workstation patching in good shape while a server nobody owns runs months behind. Backups that run nightly and have never once been restored. Application control absent entirely, because it has a reputation for breaking everything.

Most small firms that grew faster than their controls find these. The failure mode is writing Maturity Level Two on a customer security questionnaire anyway.

We apply the same rule to ourselves. We hold SMB1001:2026 Gold, issued by CyberCert, and our own estate is at Essential Eight Maturity Level 3, assessed September 2026, with the position published alongside the evidence behind it. Usefully, most of the Essential Eight controls overlap with the SMB1001 controls, so evidence gathered once serves both.

Order the work by attacker value and blast radius. The order the strategies are listed in carries no priority. Identity first: multi-factor coverage and the administrative-privilege cleanup shift real risk fastest and disrupt delivery least, because most of the work is revoking access nobody was using. Patching cadence second, where automation carries the load once the windows are agreed and someone owns the exceptions. Macro settings and user application hardening next: they are configuration pushes with a short, dated exception process for the teams that need more.

Application control goes last, and it goes in audit mode first. Run it logging-only for a few weeks, mine the logs for the software the estate runs, then enforce team by team. Switching it on firm-wide overnight is how uplifts get rolled back and never attempted again. Backups need a scheduled restore test and a repeating calendar entry.

Two rules keep the program moving. One strategy in enforcement at a time, so any breakage is attributable and reversible. And every exception gets an owner and an expiry date.

If you want it run for you, this is our Essential Eight uplift engagement: a current maturity rating across all eight strategies, an uplift plan to your target maturity level, and an evidence trail for each mitigation. It runs as a defined program with milestones toward that target and the date you need to show it.