ASD Essential Eight Guide (2026): Maturity Levels and the Move to ASD Essentials

Who it applies to

ASD writes for "businesses, government agencies, and IT professionals". Australian government entities, critical-infrastructure operators, government suppliers and many private organizations use the Essential Eight as their baseline. It was designed for enterprise IT networks. ASD notes that its principles "may be applied to enterprise mobility and operational technology networks", but it "was not designed for such purposes" (ASD).

Maturity levels

ASD's advice is to pick a target level based on how attractive you are to attackers and how bad a compromise would be. ML3 "will not stop malicious actors that are willing and able to invest enough time, money and effort".

Key requirements at Maturity Level One (examples)

From Appendix A of the maturity model:

• Patch applications.
• Run automated asset discovery at least fortnightly.
• Scan online services daily, and office suites, browsers, email clients, PDF readers and security products weekly.
• Patch online services within 48 hours if a vulnerability is critical or has a working exploit, and within two weeks otherwise.
• Patch office suites, browsers and similar applications within two weeks.
• Remove unsupported software.
• Patch operating systems.
• Patch internet-facing servers and network devices within 48 hours for critical or exploited vulnerabilities, and within two weeks otherwise.
• Patch workstations and internal servers within one month.
• Replace unsupported operating systems.
• MFA. Required for your own and third-party online services that handle sensitive data, and for customer services that handle sensitive customer data.
• Restrict admin privileges. Validate privileged access requests, use dedicated privileged accounts, block internet and email for privileged accounts, and keep privileged and unprivileged environments separate.
• Application control. Applies on workstations, including user profiles and temp folders. Only an approved set of executables, libraries, scripts and installers may run.
• Office macros. Disable them for users without a business need, block macros in files from the internet, and stop users changing the settings.
• User application hardening. Disable or remove Internet Explorer 11, and stop browsers processing Java and web ads from the internet.
• Regular backups.
• Synchronize backups to a common point in time, and test restoration during DR exercises.
• Stop unprivileged users from accessing other users' backups, or from changing or deleting backups.

Higher levels tighten these timeframes and extend the controls. For example, at higher levels, drivers and firmware must be patched within 48 hours for critical vulnerabilities.

Assessment process

You can self-assess using ASD's Essential Eight assessment process guide and tools. Independent assessment is needed only where "required by a government directive or policy, by a regulatory authority, or as part of contractual arrangements" (ASD). Exceptions should be kept to a minimum, documented, approved and offset with compensating controls. If you use exceptions appropriately, you can still be assessed as meeting a level.

The 2026 transition to ASD Essentials

According to iTnews' report of the 15 October 2026 launch:

• No single rating. ASD Essentials reports security area by area, for example identity services and internet-facing systems, and backs each rating with evidence such as independent testing and exercises.
• Outcomes, not prescribed controls. ASD's examples are still specific, such as phishing-resistant MFA.
• Priorities. Identity services and edge devices come before business systems and laptops. Priority phases describe "implementation scope, not how secure the organisation is".
• Wider coverage. It covers cloud and operational technology as well as enterprise IT, and it calls for defined executive and board accountability.
• Timing. The transition timeframe is still being set with policy agencies over "the next year or two". Government agencies will be assessed against both frameworks next year.
• Continuity. Existing Essential Eight work counts towards the new framework, but ASD advises checking controls against Essentials "rather than assume they are equivalent". ASD has published a transition guide.

Penalties

The Essential Eight carries no fines. Consequences come from government policy, regulators or contracts that require a particular maturity level.

Mapping to related frameworks

• ASD Information Security Manual (ISM): ASD publishes an Essential Eight-to-ISM mapping. IRAP assessments use the ISM.
• UK Cyber Essentials: both cover patching, MFA, admin rights and malware or application control.
• ISO/IEC 27001 Annex A and NIST CSF PROTECT: these are broader frameworks that the eight strategies feed into.
• APRA CPS 234: regulated entities often use the Essential Eight as evidence of information-security capability.

Readiness checklist

1. Choose a target maturity level based on your threat profile and the impact of a compromise.
2. Inventory assets with automated discovery at least fortnightly.
3. Set up daily and weekly vulnerability scanning, and track patch timeframes against the 48-hour, two-week and one-month thresholds.
4. Enforce MFA on all online services that handle sensitive data.
5. Separate privileged accounts and environments.
6. Deploy application control on workstations.
7. Lock down macro and browser settings.
8. Back up to a common point in time, protect the backups, and test restores.
9. Reach the same level across all eight strategies before aiming higher.
10. Run a gap analysis against ASD Essentials and plan the transition.

Common pitfalls

• Uneven maturity, such as ML3 for MFA but ML1 for backups.
• Undocumented exceptions.
• Applying the model to OT without other mitigations.
• Assuming Essential Eight ratings map directly onto ASD Essentials.
• Treating ML3 as complete protection.

How AssureCore helps

AssureCore's Controls Register can hold the Essential Eight strategies with evidence and expiry alerts, such as scan reports and restore tests. The Risk Register records exceptions, action plans track maturity uplift, and Cross-framework Mapping links the work to ISO 27001 and NIST CSF.

Frequently asked questions

Official references

• ASD – Essential Eight maturity model
• ASD – Essential Eight overview
• ASD – Transitioning from the Essential Eight
• iTnews – ASD's Essential Eight replacement moves away from maturity ladder (15 Oct 2026)

Related frameworks

• ISO 27001 guide
• SOC 2 guide
• NIST CSF guide
• NIST 800-171 guide