Essential Eight Maturity Model: A Practical Implementation Guide

The Australian Cyber Security Centre's Essential Eight is a prioritised list of mitigation strategies that organisations should implement to protect against cyber threats. Unlike broad frameworks like NIST CSF, the Essential Eight is prescriptive — it tells you exactly what to do and defines maturity levels for each strategy.

The 8 Strategies

Prevent Malware Delivery and Execution

1. Application Control — restrict execution to an approved set of applications
2. Patch Applications — patch applications within defined timeframes based on criticality
3. Configure Microsoft Office Macro Settings — block macros from the internet, only allow vetted macros
4. User Application Hardening — disable unneeded features in web browsers, Office, PDF readers

Limit the Extent of Cyber Security Incidents

1. Restrict Administrative Privileges — limit admin access to those who need it, validate regularly
2. Patch Operating Systems — patch OS within defined timeframes
3. Multi-Factor Authentication — MFA for all users, especially for privileged and remote access

Recover Data and System Availability

1. Regular Backups — backup critical data and test restoration

Maturity Levels

Each strategy has 4 maturity levels:

• ML0 — Not implemented or poorly implemented
• ML1 — Partly aligned with the intent of the mitigation strategy
• ML2 — Mostly aligned with the intent of the mitigation strategy
• ML3 — Fully aligned with the intent of the mitigation strategy

Assessing Your Maturity

For each strategy, evaluate your current implementation against the ACSC's published criteria. For example, Application Control at ML2 requires:

• Application control on workstations AND internet-facing servers
• Restriction of executables, libraries, scripts, installers, compiled HTML, and HTML applications
• Microsoft's recommended blocklist implemented
• Rulesets validated annually

Building Your Roadmap

1. Assess current state — benchmark your evidence against the ML criteria for each strategy
2. Identify the gaps — each strategy will have a current ML and a target ML
3. Prioritise by impact — strategies that prevent initial compromise (application control, patching) typically deliver the highest ROI
4. Implement incrementally — move from ML1 to ML2 across all strategies before pursuing ML3 in any single strategy
5. Evidence everything — configurations, scan results, and policy documents are the evidence a maturity assessment reads

Essential Eight maturity is determined by an assessor against the ACSC maturity model; Netallion assesses your readiness against it and issues no certification. See how Netallion assesses Essential Eight readiness — often paired with APRA CPS 234 — or read the assessment methodology.