Skip to content
PHP2Shell: the critical PHP vulnerability and how to patch it
Black Shard

Popular

Black Shard
Talk to us24/7 incident line 1800 370 270

Report

Essential Eight Maturity Level 3 in practice

Level 3 on all eight strategies, and the order to follow: identity and backups first, application control last, and every control read back from the system that enforces it.

  • Assessed 24 Sep 2026
  • PDF, 7 pages, 247 KB
  • BS-RPT-03, version 1.1
Download the PDF, PDF, 7 pages, 247 KBEvery report

Executive summary

Essential Eight Maturity Level 3 across all eight strategies. Assessed on 24 September 2026, with each rating read back from the system that enforces it.

Level 3 is the top of the Essential Eight Maturity Model, aimed at adversaries who adapt their methods and will invest in a specific target. Reaching it is a matter of order and discipline more than budget: identity and backups first, administration next, application control last, and every control read back from the system that enforces it.

ASD launched ASD Essentials on 15 October 2026 as the Essential Eight’s successor; ASD maps every strategy to an Essentials principle, so this record carries across as the transition baseline.

The controls are watched by the same monitoring that reads our scale figures. Our security monitoring analysed its first 430 million security events from 1 October to 26 October 2026, counted at 00:45 AEST.

  • Start with phishing-resistant sign-in and backups an administrator cannot delete: they are the fastest controls to put in and they stop the most damage.
  • For a firm working toward Level 3: run application control in audit, then enforce once the audit is quiet.
  • Measure each control on the live system, never from the policy document, and give each one a check that runs every day.

Report

The figures

The eight strategies on our own estate

Grid of the eight Essential Eight strategies against maturity levels 0 to 3. All eight are at Maturity Level 3. The running check for each: application control, a daily check that the allowlist still enforces; patch applications, internet-facing hosts scanned every day; configure microsoft office macro settings, macros from the internet blocked by tenant policy; user application hardening, attack surface reduction rules on every managed device; restrict administrative privileges, separate admin identities, activated just in time; patch operating systems, critical updates on a fixed schedule; multi-factor authentication, phishing-resistant, on every account; regular backups, a restore from the off-site copy every day. Maturity Level 3across all eight strategiesLevel 0Level 1Level 2Level 3Application controlA daily check that the allowlist stillenforcesPatch applicationsInternet-facing hosts scannedevery dayConfigure Microsoft Office macro settingsMacros from the internet blockedby tenant policyUser application hardeningAttack surface reduction rules onevery managed deviceRestrict administrative privilegesSeparate admin identities,activated just in timePatch operating systemsCritical updates on a fixed scheduleMulti-factor authenticationPhishing-resistant, on everyaccountRegular backupsA restore from the off-site copyevery day
Every strategy is held at Maturity Level 3, and each has a running check that keeps it there. Source: Essential Eight Maturity Level 3, assessed 24 September 2026.

What to do

For a firm working toward Level 3, the order to follow:

  1. Enforce phishing-resistant multi-factor authentication on every account and block legacy authentication.
  2. Lock the off-site backup copy so no administrator can delete or shorten it, and test a restore every day.
  3. Give administrators separate identities and make privileged roles something they activate for a task.
  4. Block macros from the internet and turn on the attack surface reduction rules in block mode.
  5. Patch on a written schedule, with critical updates on the shortest clock you can hold.
  6. Run application control in audit, read the records, sign your own software, and enforce when the audit is quiet.
  7. Read every control back from the system that enforces it, and give each a check that runs every day.

We run the same assessment for clients: all eight strategies rated against the ASD maturity model, read from the live systems, with a written report and an uplift plan sequenced by risk and effort. The uplift is delivered in the order above, with each control read back at the end. Scope and price are at blackshard.com.au/essential-eight-assessment.

Method

The ASD Essential Eight Maturity Model rates each of eight mitigation strategies from Level 0 to Level 3. Overall maturity is the lowest level reached across all eight, so Level 3 means no strategy sits below it.

Assessed on 24 September 2026, with each rating read back from the system that enforces it. A rating is the configuration as the enforcing system reports it, with its mode and its assignment, never the policy document that describes it. Client environments are assessed separately, under their own engagements.

The same method is the one a reader applies at home: for each strategy, name what the control stops, find the system that enforces it, read the setting back from there, and give it a check that runs every day.

BS-RPT-03, published 26 Oct 2026

The full report, as a PDF

PDF, 7 pages, 247 KB. Assessed 24 Sep 2026.

Download the PDF, PDF, 7 pages, 247 KBTalk to us

More reports