Essential Eight Maturity Levels: Choosing a Sensible Target

A level describes implementation, not a product

The Essential Eight maturity model sets out progressively more demanding requirements across eight mitigation strategies. Buying a security bundle does not automatically put an organisation at a particular level. Assessment considers how the controls operate within the defined scope.

Understand the scale

The model uses levels zero through three. Higher levels address more capable threats and introduce additional requirements. Read the current model in full before interpreting a level; an abbreviated comparison can hide an important condition or exception.

A useful discussion separates your current evidenced position from your target. A business might have strong controls in some areas and gaps elsewhere. Do not turn that mixed result into a blanket claim that the whole environment has achieved a level.

Choose the target deliberately

• Identify the systems and users in scope.
• Consider the information you hold, business interruption risks and contractual expectations.
• Check whether a customer or regulator specifies an assessment or target.
• Understand the operational effort and support needed to maintain the controls.
• Record the reasoning and obtain management agreement.

Ask for evidence that you can understand

For patching, ask to see missed updates and how they are handled. For privileged access, ask who has elevated permissions and when they were reviewed. For recovery, ask for the result of a restore exercise. These questions help establish a routine without pretending to be a complete technical assessment.

Avoid fixed cost or completion promises before the environment has been assessed. Older applications, unusual equipment and inconsistent identity systems can affect the work required.

Use our Essential Eight checklist to prepare, then discuss a scoped assessment with NOX.

Official reference: Current ASD Essential Eight maturity model.