Essential Eight Maturity Model.
Three levels of implementation maturity for each Essential 8 strategy. Your overall maturity equals the lowest level across all eight.
Reviewed 16 September 2026 · Current to the ASD Essential Eight Maturity Model, November 2023 · four maturity levels
On ASD launched the ASD Essentials and describes its enterprise IT chapter as an evolution of the Essential Eight. ASD says it will continue to maintain both frameworks on cyber.gov.au during the transition period.
What is the ASD Essentials?Transitioning from the Essential Eight
The four levels
- ML0
Not aligned
The strategy is not implemented or only partially in place.
- ML1
Partly aligned
Basic implementation targeting commodity threats and opportunistic adversaries.
- ML2
Mostly aligned
Standard implementation that extends coverage to more capable adversaries.
- ML3
Fully aligned
Advanced implementation targeting sophisticated adversaries including nation-state actors.
Requirements by strategy
Each strategy has specific requirements at each maturity level. For full control-level detail, use the Essential 8 control library.
| Strategy | ML1 | ML2 | ML3 |
|---|---|---|---|
| Application Control | Block unapproved executables on workstations | Extend to internet-facing servers; implement Microsoft's recommended blocklist | Cover all servers and workstations; restrict drivers; validate rulesets annually |
| Patch Applications | Patch internet-facing apps within two weeks; use vulnerability scanner | Apply critical patches within 48 hours for exploited vulnerabilities | Patch all applications within 48 hours for critical vulnerabilities; remove unsupported software |
| Configure Office Macro Settings | Disable macros for users who do not need them; block macros from the internet | Block macros from making Win32 API calls; enforce AV scanning of macros | Only allow vetted, trusted macros with valid digital signatures from trusted publishers |
| User Application Hardening | Block web ads, Java from the internet, and IE11; lock down browser settings | Harden Office and PDF software using ASD guidance; log PowerShell events | Disable .NET 3.5; constrain PowerShell language mode; remove legacy runtimes |
| Restrict Administrative Privileges | Separate privileged and unprivileged accounts; block privileged accounts from internet access | Use jump servers; enforce strong passphrases; disable inactive accounts after 45 days | Just-in-time administration; secure admin workstations; enable Credential Guard |
| Patch Operating Systems | Patch internet-facing OS within two weeks; replace unsupported operating systems | Apply critical patches within 48 hours for exploited vulnerabilities | Patch all operating systems within 48 hours for critical vulnerabilities; use latest or previous release |
| Multi-Factor Authentication | Require MFA for internet-facing services and third-party providers | MFA for all users including privileged accounts; log MFA events centrally | Phishing-resistant MFA for all users; disable legacy authentication protocols |
| Regular Backups | Backup important data; test restoration; prevent unprivileged modification | Prevent privileged accounts from modifying or deleting backups | Prevent all accounts (including backup admins) from modifying backups during retention period |
How to determine your maturity level
Start by self-assessing against ML1 for all eight strategies. Use the Essential 8 control library to review each control's requirements. Filter by ML1, ML2, or ML3.
For formal reporting, engage an IRAP-certified professional. Most organisations should target ML2 minimum. Government agencies handling sensitive data should aim for ML3.
Refer to ASD's official Essential Eight Maturity Model documentation.
Maturity model vs certification
Unlike ISO 27001, the Essential 8 Maturity Model is a self-assessment and reporting tool: there is no formal "Essential 8 certification" issued by ASD.
Government agencies report maturity levels through internal assessments. Private sector organisations may have maturity assessed by IRAP assessors as part of broader security reviews.
Frequently asked questions
What is the Essential Eight Maturity Model?
The Essential Eight Maturity Model is a framework published by the Australian Signals Directorate (ASD) that defines three levels of implementation maturity for each of the eight cyber security mitigation strategies.
What are the Essential Eight maturity levels?
Three formal levels: ML1 (partly aligned, basic implementation), ML2 (mostly aligned, standard implementation), and ML3 (fully aligned, advanced implementation targeting sophisticated adversaries).
How do I assess my Essential Eight maturity?
Start with a self-assessment against ML1 for all eight strategies. For formal reporting, engage an IRAP-certified professional.
Check your Essential 8 controls.
Review every control at your target maturity level with plain-English guidance and cross-framework mappings.
Mindset Cyber offers PECB-accredited ISO 27001 training.