The Essential Eight Maturity Model: A Practical Guide for Australian Small Businesses

If you have applied for cyber insurance, bid on a government contract, or received a security questionnaire from a larger customer recently, you have almost certainly been asked about the Essential Eight. For most small businesses, the question arrives before any real understanding of what the framework involves. This guide explains what it is, what the maturity levels demand, and how to implement it without overspending or drifting into checkbox compliance.

What the Essential Eight is

The Essential Eight is a set of mitigation strategies published by the Australian Cyber Security Centre (ACSC), part of the Australian Signals Directorate. It distils the much larger Information Security Manual down to the eight controls ACSC considers most effective at preventing and limiting the impact of the most common attacks on Australian organisations — phishing, malicious macros, credential theft, and ransomware.

The eight strategies are:

Strategy	What it means in plain English
Application control	Only approved software is allowed to run; everything else is blocked by default
Patch applications	Keep browsers, Office, PDF readers and other apps up to date within set timeframes
Configure Microsoft Office macro settings	Block macros from the internet and restrict who can run them
User application hardening	Turn off risky features in browsers and Office, such as Flash, ads and Java from the web
Restrict administrative privileges	Limit who has admin rights, review them regularly, and never browse the web as an admin
Patch operating systems	Keep Windows, macOS and server OS versions supported and patched within set timeframes
Multi-factor authentication	Require a second factor for remote access, privileged actions and sensitive data
Regular backups	Back up important data, software and settings, and test that restores actually work

A critical point many businesses miss: the Essential Eight is not a menu. The eight strategies work as a package, and you are assessed at a single maturity level across all eight — your overall level is only as high as your weakest strategy. Implementing seven controls to Maturity Level 2 and ignoring application control leaves you at Level 0 for the framework as a whole.

The four maturity levels explained

Each strategy is assessed at Maturity Level 0 through 3. The levels are not about which tools you have bought — they are about which class of attacker the controls can defeat.

Maturity Level 0 — Significant weaknesses exist

Level 0 means the strategy is not implemented, or is implemented in a way that has obvious gaps an attacker can walk through. Shared admin accounts, patching "when we get to it", backups nobody has ever restored from. Most small businesses that have never done structured security work sit here, even if they have antivirus and a firewall.

Maturity Level 1 — Opportunistic attackers

Level 1 aims to stop attackers using commodity tools and publicly known exploits — the automated scanning and spray-and-pray phishing that makes up the bulk of attacks on small businesses. In practice this means patching internet-facing applications within two weeks (48 hours if exploited in the wild), MFA on remote access and important online services, macros from the internet blocked, and admin privileges restricted to those who genuinely need them.

Maturity Level 2 — More capable attackers

Level 2 targets attackers willing to put in modest, targeted effort: crafting phishing for your specific organisation, chaining exploits, and actively hunting for privilege escalation. Requirements tighten considerably — application control becomes mandatory rather than optional, patching timeframes shorten, MFA must use phishing-resistant methods where possible, admin accounts are separated from everyday accounts and cannot read email or browse the web, and backups must be protected from modification and deletion.

Maturity Level 3 — Adaptive adversaries

Level 3 assumes attackers who will tailor tradecraft to defeat your specific controls, and focuses on limiting how far they can get once inside. It is aimed at government agencies and organisations facing state-sponsored threats; very few small businesses need Level 3, and chasing it is usually a poor use of a limited budget.

What to prioritise first

For a small business starting from Level 0, the pragmatic order is:

Multi-factor authentication. Highest impact for the least effort. Start with email, remote access and any system holding customer or financial data.
Regular backups with tested restores. Ransomware is the existential threat for most SMBs. A backup you have restored from in a test is your insurance policy. Keep at least one copy offline or immutable.
Patching applications and operating systems. Establish an asset list and a routine. Modern cloud-managed endpoint tools make this far easier than it used to be.
Restrict administrative privileges. Remove standing admin rights from everyday accounts. This alone breaks a huge number of attack chains.
Macro restrictions and application hardening. Mostly configuration, often achievable through group policy or your endpoint management platform.
Application control. The hardest and most disruptive to implement, which is why it is also the most commonly skipped. Budget real time for discovery, testing and handling exceptions.

Common implementation mistakes

Treating it as a checklist. Buying a tool that claims "Essential Eight compliance" and filing the receipt does not make you compliant. Assessors look at how controls operate in practice, not what you have purchased.
Ignoring application control. It is the control businesses most often leave out because it is inconvenient. It is also one of the most effective. Skipping it caps you at Level 0.
MFA in name only. Approving push notifications with no number matching, or excluding the finance team's personal devices, leaves gaps attackers specifically look for.
Backups that cannot be restored. Untested backups, backups connected to the network and encrypted along with everything else, or backups of the wrong things. Test restores quarterly at a minimum.
No evidence. Government tenders and insurers increasingly want proof: screenshots, policy documents, patch reports, restore test records. If you cannot evidence it, it did not happen.
Set and forget. Maturity degrades. New staff get admin rights, exceptions to application control accumulate, patching slips. The Essential Eight requires ongoing maintenance, not a one-off project.

Insurance, tenders and government contracts

Cyber insurers have made Essential Eight alignment a de facto underwriting requirement. Questionnaires routinely ask about MFA, backups, patching cadence and admin privilege management, and claims have been denied where declared controls were not actually in place. Answer from evidence, not aspiration — a misrepresentation can void the policy exactly when you need it.

On the government side, Commonwealth entities must achieve Maturity Level 2 under the Protective Security Policy Framework, and that expectation flows down the supply chain. Defence contracts in particular push Essential Eight requirements onto subcontractors through DISP membership prerequisites, and state government and enterprise customers increasingly mirror them. Even if nobody has asked you yet, someone will.

A common question at this point is how the Essential Eight compares with ISO 27001, the other framework Australian businesses are routinely asked about. They serve different purposes:

Criteria	Essential Eight	ISO 27001
Governing body	Australian Cyber Security Centre (ASD)	ISO/IEC
Primary focus	Eight technical mitigation strategies against common attacks	Organisation-wide information security management system (ISMS)
Scope	8 technical controls, assessed at Maturity Levels 0–3	93 Annex A controls across organisational, people, physical and technological themes
Geographic recognition	Australia — government, insurers and supply chains	Global
Formal certification	No certification — a maturity assessment, self or third party	Yes, via JAS-ANZ accredited certification bodies
Best for	Cyber insurance, government tenders, baseline technical hygiene	Enterprise procurement, international customers, regulated industries
Typical timeline	3–6 months to Level 1; 9–12 months to Level 2	6–12 months to certification
Typical cost (AUD)	Tens of thousands for a 20–50 person business	Roughly $25k–$80k including certification audits
Do you need both?	Increasingly a baseline expectation within Australia	Expected by enterprise and overseas buyers — the two overlap heavily, and many businesses pursue both

Realistic timeline and cost for a 20–50 person business

For a typical business of 20 to 50 staff with a standard Microsoft 365 environment, a sensible pathway is:

Months 1–2: Baseline assessment against the eight strategies, asset inventory, quick wins (MFA everywhere, macro blocking, removing standing admin rights).
Months 3–6: Patching regime operational, backup architecture fixed and restore-tested, application hardening rolled out.
Months 6–12: Application control designed, piloted and deployed; documentation and evidence collection formalised.

Reaching solid Maturity Level 1 is realistic within three to six months. A credible Level 2 usually takes nine to twelve months, mostly because of application control and the process maturity needed to sustain patching timeframes. Costs vary widely, but a business this size should expect to invest in the tens of thousands of dollars across licensing, internal effort and external help — with application control and legacy system remediation driving most of the spend. The ongoing cost is discipline: someone must own patching reports, access reviews and restore tests every month.

Where to start

The right first move is an honest baseline. A structured cybersecurity gap analysis maps your current state against each of the eight strategies, identifies which gaps matter most, and sequences remediation so budget goes to the controls that reduce the most risk first. That gives you a defensible position for insurers, tenders and — most importantly — the attacks that are actually coming.