Whitepaper
What each Essential Eight maturity level demands
Level 1, Level 2 and Level 3 ask more of the same eight strategies, and the model’s own words set the bar at each. The patch clock is the part that moves fastest, and the level a firm holds is the level of its lowest strategy.
- Model of Nov 2023, read 17 Mar 2026
- First published 17 Mar 2026, this edition 29 Oct 2026
- PDF, 9 pages, 318 KB
- BS-RPT-07, version 1.1
Executive summary
The Essential Eight Maturity Model of November 2023 defines four maturity levels, Level 0 to Level 3, and rates each of the eight strategies against the tradecraft and targeting the level is meant to defeat. At Level 1, Level 2 and Level 3 alike, a vulnerability in an online service or in the operating system of an internet-facing server or network device is patched within 48 hours of release when the vendor rates it critical or a working exploit exists.
Each level is written against an adversary. Level 1 is set against opportunists using commodity tools on any victim they can reach. Level 2 is set against attackers who invest in a particular target, phish for credentials and work around weak multi-factor authentication. Level 3 is set against adaptive attackers who move on a public exploit the day it appears, steal authentication tokens, hunt privileged credentials and cover their tracks. The requirements at each level are the controls that defeat that adversary and no more.
Online services, internet-facing operating systems and the applications that handle content from the internet (office productivity suites, web browsers and their extensions, email clients, PDF software and security products) are otherwise patched within two weeks of release at every level; the November 2023 edition cut the application window from one month. The clock is the part of the model firms most often misjudge. Six of the strategies are a state a system is in; the two patching strategies carry a stopwatch, and the stopwatch starts when the vendor publishes, whatever day of the week that is.
For a small or mid-sized firm the practical reading is this. Level 1 is a floor every business can reach with the products it already licenses. Level 2 is the level a government buyer or an insurer usually has in mind when the questionnaire says Essential Eight, because it is the first level that demands phishing-resistant sign-in and central logging. Level 3 is for firms that hold information worth a targeted effort, or that supply those who do.
- An organisation is rated at the level of its weakest strategy, so the first pass is every strategy to Level 1 before any strategy goes higher.
- The fastest patch clock applies at every level; what the level changes is how much of the estate it covers.
- Every requirement is read back from the system that enforces it, with its mode and its assignment. A policy document on its own rates Level 0.
Whitepaper
The figures
The patch clock, in days from release
What to do
For a firm working toward a target level, the order that costs least and stops most:
- Rate every strategy at its current level from the enforcing system, with the exceptions listed and dated, and fix the lowest first.
- Put phishing-resistant multi-factor authentication on every account, starting with administrators and email, and block the sign-ins that bypass it.
- Lock the backup copy so no ordinary or privileged account can delete it, and time a restore of real data.
- Give every administrator a separate privileged account and a separate environment to use it from, then make privileged roles something they activate for a task.
- Write the patch process down: who learns of a critical release, who holds the standing approval, how the change is applied inside the window on a weekend. Then set the scanner to the model’s cadence.
- Block macros from the internet, harden the browser, office suite and PDF reader to vendor guidance, and turn on central logging of script and command line events.
- Run application control in audit, read what it would have blocked, admit the publishers you trust and the software you build, and enforce when the audit is quiet.
- Give every control a check that runs every day and tells someone when its state changes.
We assess clients against the same edition: all eight strategies rated at the level they reach, read from the live systems, with a written report and an uplift plan sequenced in the order above and priced by strategy. The uplift is delivered in that order, and each control is read back at the end. Our free Essential Eight check at blackshard.com.au/tools/essential-eight-check gives a first reading in the browser, with nothing sent to us. Scope and price for the assessment are at blackshard.com.au/essential-eight-assessment.
Method
The source is the November 2023 edition of the maturity model on cyber.gov.au, published on 27 November 2023 and read on 17 March 2026: the level descriptions, the three appendices that list the requirements for Level 1, Level 2 and Level 3, and the companion page that explains what changed in that edition. Every requirement below is the model’s wording, condensed; every window and count printed is the figure the page gives, and nothing is read in from any other edition or guide.
A requirement in the model is a state a system is in. ‘Microsoft Office macros in files originating from the internet are blocked’ is a policy setting with a scope, and an assessor wants three things for it: the policy as the enforcing console shows it, the mode it runs in, and the users or devices it is assigned to, with a sample of devices showing the setting applied. The method a reader applies in their own estate is the same for all eight. Name the system that enforces the strategy. Export its configuration from that system, never from the design document. List every exception with the date it was granted and the date it closes. Then give the control a check that runs every day and tells someone when the state changes.
The order of attack follows cost and damage. Multi-factor authentication and backups come first: both are policy applied to accounts and storage a firm already has, and between them they stop the stolen password and the ransom. Administrative privileges come next, because every later control is undone by an administrator account that signs in from a daily workstation. The patch clock follows, as a process before a product: who learns of a critical release, who approves the change, and how it is applied inside the window on a weekend. Macro settings and application hardening are a week of policy work. Application control is last, because an allowlist has to admit every legitimate program before it can block the rest, and that takes a period of watching before enforcing.
The levels are cumulative, and an organisation holds the level of its weakest strategy. A firm that reaches Level 3 on seven strategies and Level 1 on the eighth holds Level 1. That rule sets the order of work: every strategy to the target level before any strategy goes beyond it.
BS-RPT-07, published 17 Mar 2026, revised 29 Oct 2026
The full whitepaper, as a PDF
PDF, 9 pages, 318 KB. Model of Nov 2023, read 17 Mar 2026.
More reports
Report
Security events by hour: what our monitoring sees
Measured 26 Oct 2026, 00:45 AEST · PDF, 6 pages, 213 KB
