The Essential Eight maturity model has four levels - Maturity Level Zero through Three - and the benchmark most Australian organisations are measured against is Maturity Level Two, the level that mitigates actors willing to invest time in phishing and bypassing controls. Level Zero means weaknesses in your overall posture; each level above it describes a more capable class of attacker, not more paperwork.
TL;DR
- The Essential Eight uses four maturity levels: Level 0 (weaknesses), 1, 2 and 3 (increasing attacker tradecraft).
- ASD's model expects the same maturity level across all eight strategies before moving up - one strong strategy does not lift your score.
- The patching timelines are the most measurable benchmark: 48 hours for critical vulnerabilities in online services, two weeks for non-critical, one month for workstations at Level 1.
- No independent certification is required unless a government directive, regulator or contract demands one.
- Benchmark your own position with a structured assessment before planning the next level.
What are the Essential Eight maturity levels?
Four levels, published by the Australian Signals Directorate (ASD) and updated regularly since the model first appeared in June 2017 (ASD, Essential Eight maturity model). The levels are based on the tradecraft and targeting they are designed to mitigate - not on how many controls you have ticked:
| Maturity level | Who it mitigates | Practical read |
|---|---|---|
| Level 0 | - | Weaknesses exist in overall posture that could enable compromise. This is where unassessed organisations sit. |
| Level 1 | Commodity actors using widely available tradecraft; any victim, opportunistic | Stolen or reused credentials, unpatched public exploits, common social engineering. Most SMEs should target this as the floor. |
| Level 2 | A modest step-up: actors who invest more time in tools and phishing | Actors actively targeting credentials with phishing and circumventing weak multi-factor authentication. Common target for organisations with client data. |
| Level 3 | Adaptive actors, less reliant on public tools | Exploiting older software and weak logging, stealing authentication tokens, pivoting and covering tracks. Enterprise and high-value targets. |
ASD frames the choice in terms of tradecraft and targeting rather than named threat actors: decide what class of attacker your data justifies defending against, and set that as the target maturity level.
The benchmark rule most organisations miss
Organisations should achieve the same maturity level across all eight strategies before moving to a higher level. That single rule changes how programs are budgeted: an organisation with Level 3 backups and Level 0 patching is not "between levels" - it is at Level 0, because the model treats the strategies as a set that complements each other.
The eight strategies are: patch applications, patch operating systems, multi-factor authentication, restrict administrative privileges, application control, restrict Microsoft Office macros, user application hardening and regular backups.
The measurable benchmarks inside each level
The requirements carry specific, auditable timelines. At Maturity Level 1:
| Benchmark (Level 1) | Requirement |
|---|---|
| Patching - online services | Critical vulnerabilities or working exploits: 48 hours. Non-critical, no working exploit: two weeks. |
| Patching - office suites, browsers, email clients, PDF software, security products | Two weeks. |
| Patching - workstations and non-internet-facing servers | One month. |
| Vulnerability scanning | At least daily for internet-facing servers and devices; weekly for office software; fortnightly asset discovery. |
| MFA | Used on online services processing sensitive data, with either something you have plus something you know, or a possession factor unlocked by knowledge or biometrics. |
| Backups | Performed and retained per business criticality, synchronised, secure, tested in disaster recovery, protected from unprivileged modification. |
Level 2 tightens the same controls: MFA becomes phishing-resistant, event logs must be centrally collected and analysed, administrative access is disabled after 45 days of inactivity and revalidated every 12 months, and application control extends to internet-facing servers. Level 3 extends patching timelines to drivers and firmware and pushes workstation patching to 48 hours for critical vulnerabilities.
Where organisations typically sit
ASD does not publish an Australia-wide distribution of maturity levels, so a live benchmark across the market does not exist. What the 2024-25 Annual Cyber Threat Report does show is why the lower levels matter: ASD's ACSC responded to over 1,200 incidents (up 11%) and received over 84,700 cybercrime reports, with the average self-reported cost to businesses rising 50% overall to $80,850 (ASD, Annual Cyber Threat Report 2024-25, October 2025). The tradecraft described at Maturity Level 1 - stolen credentials, unpatched services, basic social engineering - is the tradecraft behind the bulk of those incidents.
Method and limitations
This page summarises ASD's Essential Eight maturity model as published on cyber.gov.au, accessed October 2026. It compresses the full requirement tables - the model itself runs to hundreds of requirements across appendices A to C - so use it for orientation, not as an audit reference. One limitation is unavoidable in any summary: an organisation's actual maturity is assessed per requirement, per system, and exceptions change the result.
How to use these benchmarks
- Establish your current level with a structured assessment rather than self-assessing memory - a guided gap assessment maps findings to frameworks including Essential 8 and produces a report you can show an auditor or insurer.
- Fix the lowest strategy first. Because the model requires a uniform level across all eight, your weakest strategy is your maturity level. Lift it before polishing your strongest.
- Read the patching timelines as your operational baseline. They are the most frequently tested requirements in the model and the ones a breach investigation examines first.
- Document exceptions. ASD expects exceptions to be minimised, documented and approved through a process - an undocumented exception is the difference between a level and a false claim.
FAQ
How many Essential Eight maturity levels are there? Four: Maturity Level Zero through Three. Level 0 signals weaknesses in overall posture; Levels 1-3 mitigate progressively more capable attacker tradecraft.
Which maturity level should a small business target? Level 1 as the floor, Level 2 where client data justifies it. ASD frames the target level as a risk decision about tradecraft and consequences, not a fixed number.
Is Essential Eight certification mandatory? No independent certification is required by the model itself. Assessments by an independent party are only needed where a government directive, regulatory authority or contract requires one.
Can you be Level 2 in some strategies and Level 1 in others? You can, but ASD's implementation guidance says to reach the same level across all eight before moving higher - your effective maturity is your lowest strategy.
What is the patching deadline for a critical vulnerability? At every level, critical vulnerabilities or working exploits in online services must be patched within 48 hours of release. Workstation timelines vary by level.
Where does staff training fit into Essential Eight? Awareness is not one of the eight strategies, but phishing-resistant MFA, macro restrictions and administrative-privilege controls all depend on staff behaviour - which is where programs like Cyber Aware's awareness training close the gap.
One last thing
The model's own framing is the most useful benchmark: decide the class of attacker worth defending against, then work the eight strategies to a uniform level. Most organisations that fail an assessment did not underinvest - they unevenly invested.