The Essential Eight maturity model (often written Essential 8) is the Australian Signals Directorate's scale for measuring how well an organisation has implemented the eight mitigation strategies, from Maturity Level Zero to Maturity Level Three. Your overall level is the lowest level you reach on any one of the eight, so a single weak control sets the score.
If you need to know your current level, an Essential Eight assessment gives you one, backed by evidence and with a date attached.
Ask an organisation where they stand on the Essential Eight and you will usually get one of two answers: a maturity level quoted with suspicious confidence, or "we're doing the Essential Eight", which does not answer the question. The maturity model is the part of the framework that turns eight good ideas into a score someone can hold you to, and it is the part most often misread.
The model runs from Maturity Level Zero to Maturity Level Three. Each level is calibrated to the tradecraft of the adversary it is meant to frustrate.
Maturity Level Zero is a finding, and nobody declares it as a starting point. It means there are weaknesses in your overall posture significant enough that the strategies, as implemented, would not withstand even commodity attacks.
Level One is designed to frustrate attackers using widely available tools and techniques, the opportunistic intrusions that make up the bulk of what arrives at most organisations: phishing kits, public exploits for unpatched systems, credential stuffing.
Level Two targets adversaries willing to invest time and effort in you specifically: better phishing, some target research, and a willingness to work around basic controls when they could have moved on to an easier victim.
Level Three is built for adversaries who are well resourced, adaptive, and undeterred by the controls that stop everyone else. Very few commercial organisations face this threat profile, and pursuing Level Three without it spends money on the wrong risks.
This is the rule that catches people. Your overall maturity level is the minimum you achieve across all eight strategies. Seven strategies at Level Two and one at Level One scores as Level One. Partial progress, however real, does not move the headline number.
The Commonwealth's own results show how much this matters. In the 2025 reporting, individual strategies sat between 46 and 70 per cent at Maturity Level 2 or above, yet only 22 per cent of entities reached Level 2 overall. These are organisations with a mandate, a budget and an audit function. The gap between per-strategy performance and the overall score is the minimum rule at work, and it is usually one or two stubborn strategies, most often application control or privileged access, holding the number down.
Each strategy has specific requirements at each level, and they escalate in kind as well as degree. Multi-factor authentication at Level One is about coverage of internet-facing services. By Level Three the model is asking about phishing-resistant methods and the paths that bypass MFA entirely. Backups at Level One means they exist and are tested. Higher levels care about how quickly privileged access to backups can be misused and whether an attacker who owns your environment can reach them at all.
The practical consequence: you cannot read your level off a product list. Owning an MFA product, a patching tool and a backup platform says nothing about coverage, cadence and tested restoration, which is what assessment measures. Our post on what insurers and auditors expect covers the same shift: the questions have moved from "do you have it" to "show us it operating". For the evidence to hold per control, see our Essential Eight checklist.
Level One is the sensible floor for most commercial organisations without a specific threat profile or contractual driver. Level Two is increasingly the expectation for organisations holding sensitive data at scale, operating in critical sectors, or selling into government supply chains, where the requirement often arrives in a contract with a date attached. Level Three is for organisations that have concluded, on evidence, that they face well-resourced and persistent adversaries.
It is legitimate to hold different levels across the eight strategies for a period, provided the gaps are chosen and documented. Choosing a target because a customer questionnaire has a dropdown, then reverse-engineering the paperwork, does not work.
In June 2026 ASD opened consultation on replacing the Essential Eight with a new Essentials series over about two years, beginning with Essentials for enterprise IT. Consultation closed on 12 July 2026. The stated direction includes stronger connections between threats, controls and evidence, which means more of what the maturity model already rewards and less tolerance for maturity claims that rest on policy documents. Work that hardens the environment carries across to the new series.
There are four: Maturity Level Zero to Maturity Level Three. Level One defends against opportunistic attackers using common tools, Level Two against attackers who target you specifically, and Level Three against well-resourced, adaptive adversaries. Level Zero is a finding that the controls would not stop even commodity attacks.
It is the lowest level you reach across the eight strategies. Seven strategies at Level Two and one at Level One gives an overall Level One.
Level One for most commercial organisations. Level Two if you hold sensitive data at scale, operate in a critical sector or sell into government supply chains. Level Three only if you have evidence of well-resourced, persistent adversaries.
ASD consulted in June and July 2026 on replacing it with an Essentials series over about two years. Controls you harden now carry across.
Through an assessment that tests each strategy against evidence of the control operating, and gives no credit for a policy alone. Our Essential Eight assessment does this and gives you a dated result.
We cover the full picture, including sequencing an uplift and the evidence that survives assessment, in our Essential Eight uplift guide. If you need a maturity level with a date attached, book an Essential Eight assessment with our cyber security practice. It scores the controls running in your environment, and a practitioner replies within one business day.