The Essential Eight maturity model applies one blunt rule to your cyber hygiene: the weakest of eight mitigation strategies sets the result for the entire assessed environment.
The model measures controls such as application control, patching, multi-factor authentication and backups across Maturity Levels Zero to Three.
A checklist can show where the gaps are, but only a scoped, evidence-based assessment can support a maturity claim.
Use this article to understand the levels, complete Redscale’s free self-assessment and decide what to fix before a formal assessment.
You will also see how the same evidence supports your answer when an Australian tender, customer or insurer asks about your controls.
What Is the Essential Eight Maturity Model?
The Essential Eight maturity model is ASD’s four-level scale for measuring how well an organisation has implemented the Essential Eight within a defined IT environment.
ASD’s Australian Cyber Security Centre publishes the model, so you may also see it called the ACSC Essential 8 maturity model. The four levels are:
| Level | What it means | interpretation |
|---|---|---|
| Maturity Level Zero | At least one Level One requirement has not been met. | Basic weaknesses remain and the organisation cannot claim Level One. |
| Maturity Level One | All Level One requirements are effective, or suitably compensated, across all eight strategies. | The environment has a baseline against common, opportunistic attacks. |
| Maturity Level Two | All Level Two requirements are met across all eight strategies, including the Level One requirements carried forward. | Controls cover more systems and are designed for attackers willing to target the organisation more deliberately. |
| Maturity Level Three | All Level Three requirements are met across all eight strategies, including the lower-level requirements. | Controls address more adaptive attackers through wider coverage, stricter settings and stronger monitoring. |
Of course, the technical requirements increase with each level, but ASD calculates every result in the same way. Keep three rules in mind when reading the model:
- Your result is not an average: The least mature strategy sets the overall level.
- Your current and target levels are different: Evidence sets your current level. Risk, contracts, tenders or government directions set the target.
- Scope changes the answer: An assessment must name the users, devices, servers, cloud services and locations it covers.
Together, these rules make a defined assessment boundary essential. The model focuses on internet-connected IT networks and does not cover every cyber risk.
How to Check Your Essential Eight Maturity Level
You can check your Essential Eight maturity level in six steps:
- Define the scope
- Complete all eight checklist sections
- Read the readiness score
- Interpret the results
- Record the gaps
- Confirm the level through evidence testing.
The sequence matters: steps one to four show readiness, step five improves it, and step six determines whether you can support a maturity claim.
Step 1: Open the Free Essential 8 Self-Assessment Checklist
Open Redscale’s free Essential 8 self-assessment checklist to check your Essential Eight maturity level and define the environment it covers before you answer a single question.
Use the checklist in six steps:
- Define the scope
- Complete all eight checklist sections
- Read the readiness score
- Interpret the results
- Record the gaps
- Confirm the level through evidence testing
Scope comes first because every tick must apply to the same users, devices, services and locations.
Without that boundary, an unreviewed laptop fleet, cloud application or office can disappear from the result.
The sequence matters: step one locks the scope, steps two to four establish readiness, step five turns gaps into tasks, and step six confirms whether the evidence supports your result.
Step 2: Work Through the Eight Control Sections
With the scope set, work through all eight sections and tick a statement only when the control operates across it.
Use the table to match each checklist area with the evidence that should support your answer:
| Checklist section | Evidence to look for |
|---|---|
| Application control | Approved application list, central rules and blocked-event logs |
| Patch applications and operating systems | Asset inventory, vulnerability scans, patch reports and end-of-life system list |
| Microsoft Office macros and user application hardening | Centrally applied macro, browser, Office and PDF security policies |
| Restrict administrative privileges | Privileged account register, approval records, access reviews and activity logs |
| Multi-factor authentication | Enforcement and authentication-method reports for users, administrators and remote access |
| Regular backups | Backup job reports, access settings, restore test results and recovery procedures |
The evidence is what separates an operating control from a policy, licence or planned project.
If you cannot find it, mark the item for validation rather than assuming it passes.
Once each section has a supported answer, the readiness score can show which gaps to investigate first.
Step 3: Read Your Readiness Score
Now, read the overall percentage alongside each control score. The percentage shows how many checklist practices appear to be in place, while the individual results show where an assessment is most likely to find gaps.
An overall score can therefore hide weak application control or untested backups.
For instance, a business with an 80 per cent result could still fall below Maturity Level One or Two when one strategy falls short, even if the other controls score well.
Because the percentage can hide that imbalance, use it as a readiness signal, not as a maturity level.
An 80 per cent result does not equal Level Two, and 100 per cent does not confirm Level Three. Instead, use the readiness band to gauge the scale of work ahead.
Step 4: Interpret the Readiness Band You Landed In
Use your readiness band to judge the scale of your next job. It is a Redscale readiness rating, so it helps you plan remediation rather than claim an ASD maturity level:
| Readiness score | Rating | What to do next |
|---|---|---|
| 0–25% | Needs Improvement | Identify the missing foundations, name an owner and set the first remediation priorities. |
| 26–50% | Developing | Find where controls are missing, optional or applied to only part of the environment. |
| 51–75% | Well Protected | Validate the remaining gaps and test whether the stronger controls cover the full scope. |
| 76–100% | Advanced | Gather technical evidence and test the controls before making a maturity claim. |
The band sizes the job; the unsupported items identify its starting point. However, please be aware; an Advanced result still does not mean Maturity Level Three, because a maturity claim needs evidence and testing.
Step 5: Close the Gaps the Checklist Exposed
Turn every unchecked or unsupported item into a remediation task with a named owner, deadline and evidence of completion.
Give each task the details your team needs to make, review and verify the change:
- Requirement: Which Essential Eight strategy and checklist item is not met?
- Scope: Which users, devices or services are affected?
- Fix: What setting, process or technology must change?
- Owner: Who will complete and approve the work?
- Deadline: When must it be ready for testing?
- Evidence: Which report, configuration or test will prove the fix?
Once each gap is recorded, start with the requirements that block your target level. Some work will address more than one strategy.
Asset discovery supports both patching strategies, while central logging supports MFA, administrative privileges, application control and user application hardening.
If a requirement cannot be implemented as written, record the exception and the proposed compensating control.
ASD expects the alternative to provide equivalent protection, so simple risk acceptance does not close the gap. Once the fixes and evidence are ready, move from self-assessment to formal validation.
Step 6: Move From a Readiness Score to a Confirmed Maturity Level
Use a scoped, evidence-based assessment to confirm your maturity level.
Redscale’s checklist identifies the areas to investigate, while The ASD Essential Eight assessment process guide sets out how to test the result and confirm the maturity level.
That process turns your checklist answers into tested findings through four stages:
| Assessment stage | What happens |
|---|---|
| 1. Plan and prepare | Agree on the target, access, people, evidence and testing arrangements. |
| 2. Set scope and approach | Define the assessment boundary and confirm which maturity level will be tested. |
| 3. Assess the controls | Review configurations, test controls and sample the relevant devices, accounts and systems. |
| 4. Report the result | Record each strategy’s level, the overall level, gaps, exceptions and remediation priorities. |
The stages move from planning to tested evidence and a defensible result. Direct testing carries more weight than a policy, interview or screenshot alone.
The assessment also builds level by level: confirm Level One before Level Two, then Level Two before Level Three.
Essential Eight Maturity Level Requirements in Australia
To meet an Essential Eight maturity level in Australia, all eight strategies must meet the requirements for that level within the agreed scope.
And be aware; the least mature strategy sets the overall result.
ASD carries lower-level requirements forward as maturity rises, so the work expands at each level.
Use this summary to understand that progression, then refer to the ASD Essential Eight maturity model for the exact settings, timeframes and testing rules:
| Control area | Level One establishes | Levels Two and Three add |
|---|---|---|
| Application and operating-system patching | Regular scanning, timely fixes for critical or exploited vulnerabilities, and removal of unsupported software. | Wider coverage of applications and systems, more stringent treatment of critical or exploited vulnerabilities, plus drivers and firmware at Level Three. |
| MFA and administrative privileges | MFA for relevant sensitive services, controlled privileged access and dedicated admin accounts. | Phishing-resistant MFA, broader coverage, stronger admin environments, just-in-time access, logging and analysis. |
| Application control, macros and hardening | Approved applications, restricted macros and baseline browser, Office and PDF protections. | Broader coverage, tighter trusted paths, stronger behaviour restrictions, central logging and analysis. |
| Regular backups | Protected backups of data, applications and settings, supported by restore testing. | Stronger separation between backup users, administrators and the ability to access or change backup data. |
Once you know the requirements, identify who is setting the target.
For instance, Maturity Level Two is mandatory for non-corporate Commonwealth entities.
Private businesses commonly face a target through tenders, customer contracts, supply-chain reviews or internal risk decisions.
These requirements become evidence requests in tenders and insurance proposals:
- Tender: Current overall and per-strategy level, scope, assessment date, exceptions and remediation dates.
- Insurance: Evidence of MFA, patching, supported systems, application allowlisting, backup isolation, restore testing and incident response.
An assessed Level Two tender requires a current Level Two result. Seven strategies at Level Two and backups at Level One produce an overall Level One result.
Report the backup gap and remediation date so procurement can assess the position.
Also, consider that insurers commonly ask about individual controls rather than an Essential Eight level.
Use your assessment evidence to answer those questions, then check how cyber insurance controls and declarations affect Australian SMBs before you sign.
Assess Your Essential Eight Maturity Level with Redscale
If your checklist has exposed gaps or your evidence is hard to keep current, the next task is to turn the assessment into ongoing control ownership.
That matters when a tender, client or insurer asks what is operating today. A past readiness result carries little weight without current evidence.
Without clear ownership, patch reports go stale. MFA coverage drifts. Restore tests slide past their due date. A project or renewal can then slow down while your team rebuilds the evidence.
Redscale managed security services give your team ongoing support to monitor controls, address gaps and maintain the records a buyer expects.
Each tender response or client review starts from maintained controls and available evidence.
If the buyer accepts SMB1001, our SMB1001 support service can carry that same work into a tiered certification pathway.
Book a free discussion session and send the Redscale team your checklist result and the next security request you need to answer. Build the control plan before it slows the opportunity.
