No. Maturity Level One of the Essential Eight does not require phishing simulation testing — the framework's eight strategies are technical controls (patching, multi-factor authentication, application control and the like), and user education is not one of them. But ML1's own threat model assumes users get tricked, so phishing simulations are how an Australian business evidences the human layer that ML1 assessors, insurers and enterprise customers keep asking about.
TL;DR
- No — the Essential Eight's eight strategies are technical controls; phishing simulation testing is not written into any maturity level, including ML1.
- ML1 targets commodity tradecraft: attackers using common social engineering to trick users into weakening security. Simulations measure whether staff resist exactly that.
- Australian insurers, enterprise customers and audit processes increasingly ask for human-layer evidence alongside Essential Eight maturity.
- A monthly simulation programme with click-and-report reporting gives you that evidence — Cyber Aware reports an average 80% reduction in clicked links within the first eight months.
Does Essential Eight ML1 require phishing simulation testing?
Read the Essential Eight as written and the answer is plainly no. The Australian Signals Directorate's framework has eight mitigation strategies: application control, patch applications, patch operating systems, multi-factor authentication, restricting administrative privileges, restricting Microsoft Office macros, user application hardening and regular backups. The Essential Eight maturity model defines what each maturity level requires for each of those strategies, and none of the Maturity Level One requirements mention phishing simulations, awareness testing or any user-education measurement.
That surprises people because phishing feels like it must be in there. It is not — the Essential Eight deliberately covers technical hardening, and ASD treats awareness and training through its broader guidance rather than as one of the eight.
Why the human layer still sits inside the ML1 conversation
The Maturity Level One definition is worth quoting in spirit: it targets malicious actors using commodity tradecraft widely available to anyone — publicly-known exploits against unpatched services, stolen or guessed credentials, and common social engineering to trick users into weakening a system's security. In other words, ML1 is built around the assumption that attackers will try to fool your staff, and that some of the time they will succeed unless something else stops them.
That is exactly the scenario a phishing simulation tests. A programme of safe fake attacks shows whether staff click lures, whether they report suspicious emails, and whether click rates fall after training — measurements that connect the framework's social-engineering assumption to a number you can show.
What ML1 actually requires, strategy by strategy
For businesses assessing at ML1, the requirements are operational and technical:
- Patching. Vulnerability scanning of online services at least daily, and of office suites, browsers, email clients and PDF software at least weekly; critical patches within 48 hours when exploits exist.
- Multi-factor authentication. MFA on online services that process, store or communicate sensitive data — for staff and, where relevant, customers.
- Restrict administrative privileges. Dedicated accounts for privileged duties, validated access requests and no internet/email access from privileged accounts.
- Application control. Execution restricted to an approved set on workstations, covering user profiles and temporary folders.
- Office macros. Disabled for users without a demonstrated business need; internet-origin macros blocked.
- User application hardening. Web browsers hardened so security settings cannot be changed by users.
- Regular backups. Tested restoration to a common point in time, with backups users cannot modify or delete.
There is no certification requirement either — ASD states there is no requirement to have an Essential Eight implementation certified by an independent party, though government directives, regulators or contracts can require independent assessment.
Where phishing simulations fit in an Essential Eight programme
If simulations are not required, why run them? Four reasons that come up in Australian assessment and procurement conversations:
- They close the gap the framework leaves open. The Essential Eight hardens systems; it does not train people. Attackers at the ML1 level rely on staff mistakes, so the unmeasured layer is the one attackers exploit.
- Insurers and enterprise customers ask for it. Australian cyber insurers and larger clients assessing vendors increasingly want evidence of awareness training and phishing performance alongside maturity statements.
- It gives the maturity work a before-and-after. Maturity improvements are technical and slow; a click-rate trend is a visible, board-friendly number that shows the programme working month over month.
- It is cheap relative to a breach. ASD received more than 84,700 cybercrime reports in FY2024-25 — one every six minutes — with a self-reported average cost of $56,600 for small businesses (ASD Annual Cyber Threat Report 2024-25).
How to run the human layer alongside ML1
A workable pattern for a small Australian business already working through the Essential Eight:
- Run a baseline simulation. One campaign, easy-to-spot template, before any training. The click rate is your before number.
- Assign short monthly training. Story-driven lessons beat an annual compliance video; awareness training on a monthly cadence is what moves the number.
- Auto-coach every click. A click should open a branded explainer and enrol the person in a follow-up course the same day — remediation without the awkward email. Cyber Aware's phishing simulations run this loop and keep the results.
- Report on a score, not on people. A per-learner Human Risk Score built from overdue courses, failed quizzes and phishing results gives you one trend line — without turning the programme into a blame exercise.
- Keep the evidence exportable. When an assessor, insurer or enterprise customer asks how you handle social engineering, the answer is a report, not a story.
FAQ
Does Essential Eight Maturity Level One require phishing simulation testing? No. The eight strategies are technical controls and the maturity model does not include phishing simulations, awareness testing or user-education measurement at any level, including ML1.
Is security awareness training one of the Essential Eight strategies? No. The eight are application control, patch applications, patch operating systems, MFA, restricting admin privileges, restricting Office macros, user application hardening and regular backups.
Why run phishing simulations if they are not required? Because ML1's threat model assumes attackers trick users with social engineering. Simulations measure whether staff resist that and give you evidence for insurers, auditors and enterprise customers.
Do I need independent certification for the Essential Eight? No — ASD states there is no requirement for independent certification, though a government directive, regulator or contract can require an independent assessment.
What is Maturity Level One aimed at? Commodity tradecraft: opportunistically exploited unpatched vulnerabilities, stolen or guessed credentials, and common social engineering against any victim rather than a specific target.
What evidence proves the human layer to an auditor? A simulation click-and-report history with a per-learner risk trend, plus training completion records — exportable reports rather than verbal assurances.
One last thing
If you are mapping your programme to the Essential Eight, do not leave the human layer as an unstated assumption. One baseline simulation and a monthly cadence turns "our staff are aware" into a number — and numbers are what survive an audit.