Most Australian organisations reach Essential Eight Maturity Level One in about 3-9 months, and Maturity Level Two in about 9-18 months, working part-time on the controls alongside day-to-day operations. The spread is wide because the timeline depends far less on company size than on three things: which controls you already have, whether you run Microsoft 365 or a mixed estate, and whether the person driving it can actually change configurations - not just write policy. Here is what the timeline actually looks like.
TL;DR
- 3-9 months to Maturity Level One for most SMBs; 9-18 months to Level Two.
- The two slowest controls are always application control and patching - they touch every machine.
- Cloud-only on Microsoft 365 is the fast path; legacy servers and Mac fleets stretch the timeline.
- Staff awareness training and phishing simulations are among the quickest controls to stand up.
What the eight controls actually involve
The Essential Eight is ASD's set of eight mitigation strategies, assessed against maturity levels: application control, patch applications, patch operating systems, multi-factor authentication, restrict administrative privileges, harden user applications, restrict Microsoft Office macros, and regular backups. Each has a Maturity Level 1, 2 and 3 definition; most small businesses target Level One first, and Level Two where procurement or insurance demands it.
A realistic timeline, stage by stage
| Stage | Typical time | What happens |
|---|---|---|
| Gap assessment | 2-4 weeks | Score each of the eight controls against the target maturity level and list the gaps. |
| Quick wins | Month 1-2 | MFA everywhere, backup schedule and restore testing, macro settings - controls you can turn on centrally. |
| The grind | Month 2-6 | Application control rule sets, admin privilege reduction, hardening user applications - per-device work. |
| Patching discipline | Ongoing | Patch applications and operating systems on the assessment cycle; the controls are never "done". |
| Self-assessment | Month 3-9 | Score yourself against the maturity model with evidence, fix what fails. |
| Formal assessment | Optional, 4-8 weeks | An external assessor tests the controls - usually only where a buyer or regulator requires it. |
What makes it faster or slower
- Cloud-only Microsoft 365 estate: fastest path - most controls configure centrally, so a 20-person business can reach Level One in 3-4 months.
- Servers, legacy apps or a Mac fleet: each adds months, because patching and application control need per-platform tooling.
- An admin who can change configurations: weeks saved everywhere; an IT provider blocked by change-approval gates stretches everything.
- Starting posture: if MFA and backups already exist, you are 30-40% of the way to Level One on day one.
- Scope: the eight controls apply to workstations, servers and mobile devices - deciding scope (say, excluding an isolated OT network) legitimately shortens the project.
The two controls that always take longest
Application control and patching dominate the timeline on almost every project. Application control means building and testing rule sets on every machine - done badly, it breaks software; done properly, it takes months of phased rollout. Patching never finishes: assessments test whether you patch on the assessment cycle, which is a process you maintain, not a milestone you reach.
The quick wins most businesses miss
Two controls are close to free and often ignored: staff awareness training and phishing simulations support the human side of several strategies (hardening user applications, restricting administrative privileges in practice), and backup restore testing - having a backup is not the control; proving it restores is. A monthly security awareness training cadence with phishing simulation runs in about 10-15 minutes per person per month, and human risk reporting produces the evidence file for your assessment.
After Level One
Maintain, then climb. Self-assess quarterly, keep evidence dated, and target Level Two when a buyer, insurer or regulator names it. Our Essential Eight maturity levels benchmark shows what good looks like at each level, and a cyber security gap assessment is the right first move before any of it.
FAQ
Is Essential Eight compliance mandatory? For most private businesses it is voluntary - but it is referenced in Australian Government procurement, and many tenders and insurance questionnaires now ask for an Essential Eight maturity level.
What is the fastest realistic path to Level One? A cloud-only Microsoft 365 estate with an engaged admin: MFA and backups in month one, application control and privilege reduction phased over the following quarter, self-assessment with evidence at the end of month three to four.
How often do I need to re-assess? The maturity model expects annual assessment at minimum, with quarterly self-assessment recommended so the evidence stays current.
Does company size determine the timeline? Less than you would think. A 100-seat cloud-only estate moves faster than a 20-seat business with five servers and old line-of-business software - estate complexity drives the timeline, not headcount.
Can we self-assess or do we need an auditor? Self-assessment is normal for SMBs and satisfies most procurement questions. A formal external assessment is usually only needed where a buyer or regulator explicitly requires an independent level.
Related guides
- What is the Essential Eight?
- Essential Eight compliance for small business
- Does Essential Eight compliance require security awareness training?