ASD Essential Eight Maturity Model compliance software
Self-assess the eight mitigation strategies against the Essential Eight Maturity Model, set a target maturity level, and carry the result into ASD Essentials when you move.
- PublisherAustralian Signals Directorate (ASD's ACSC)
- EditionEssential Eight Maturity Model, November 2023 update
- StrategiesEight mitigation strategies, assessed one by one
- Maturity levelsZero to Three, each building on the one below
- Catalogue in GRCLens173 test procedures (67 at ML1, 52 at ML2, 54 at ML3); requirements mapped to 126 ISM controls
- SuccessorASD Essentials, published 15 October 2026
What the Essential Eight requires
Who it applies to
- Non-corporate Commonwealth entities, required by the PSPF to reach Maturity Level Two
- Defence industry suppliers working to Maturity Level Two for the Defence Industry Security Program
- Critical infrastructure responsible entities that nominate the Essential Eight in their SOCI CIRMP
- State agencies with their own targets: Maturity Level One in NSW and Western Australia, agency-set in Queensland
- Businesses asked for an Essential Eight self-assessment by a customer, a tender or a cyber insurer
The Essential Eight is the Australian Signals Directorate's set of eight mitigation strategies: application control, patch applications, restrict Microsoft Office macros, user application hardening, restrict administrative privileges, patch operating systems, multi-factor authentication and regular backups. The Essential Eight Maturity Model grades each strategy from Maturity Level Zero to Maturity Level Three, each level building on the one below, and ties the levels to the adversary they are meant to stop: from actors content to use commodity tradecraft at Level One to adaptive actors much less reliant on public tools at Level Three. The current edition is the November 2023 update, which tightened patching timeframes for critical vulnerabilities and made phishing-resistant multi-factor authentication and centralised event logging Maturity Level Two requirements.
The Essential Eight is not a legal requirement for every business. Non-corporate Commonwealth entities must implement it to Maturity Level Two under the Protective Security Policy Framework, Defence Industry Security Program members work to Maturity Level Two, and it is one of the cyber frameworks a responsible entity can nominate in its SOCI critical infrastructure risk management program. Other organisations usually meet it through a contract, a tender or a cyber insurance questionnaire that names a level.
On 15 October 2026 ASD published ASD Essentials, the framework that evolves the Essential Eight, with chapters for enterprise IT, operational technology and cloud. ASD Essentials rates actions per domain rather than giving one maturity level, and Essential Eight maturity levels do not automatically convert into its ratings. The Essential Eight stays on ASD's website during the transition, ASD has told organisations to keep meeting their existing regulatory obligations until regulators announce changes, and iTnews reported that government agencies will be assessed against both frameworks in 2027. This page covers Essential Eight assessments; the ASD Essentials page covers the new framework.
Related reading: ASD Essentials, the Essential Eight's successor; Enhanced CIRMP rules 2026: what to do and when
How GRCLens supports Essential Eight
Essential Eight runs on the same shared control model as every other framework in GRCLens, so evidence captured once can satisfy several obligations at the same time.
All eight strategies, level by level
Each strategy carries the requirements of every maturity level with the ISM controls behind them, and test procedures tagged ML1, ML2 or ML3 that the assessor records one by one as effective, alternate control, ineffective, no visibility, not implemented or not applicable.
A target maturity level
Set the target at Maturity Level One, Two or Three for the assessment. The dashboard shows current against target for every strategy, how many strategies are at target, the spread across levels and the ISM controls in force at each strategy's current level.
The weakest link, shown
The assessment report states the weakest-link level, the lowest across the eight strategies, beside the headline score, and a scoring preview applies the cumulative rule to the test outcomes: a level counts only when every test at that level and every level below it passes.
Evidence with a human decision
Upload evidence against any requirement. Baseerah gives an opinion on its relevance, a reviewer accepts or rejects it, the person who uploaded a file can never approve it, and the AI opinion stays beside the human decision for the auditor.
Owners, effectiveness and treatment
An assurance register records the owner of each strategy, whether the control is working this quarter as well as how mature it is, and the last and next review. A treatment plan turns each gap into actions with owners, dates, cost and a risk decision where a gap will not be closed.
Indicators that trace to requirements
Derived indicators (requirements not met, claimed but unevidenced, unanswered, stale) are computed from the answers. Measured key risk indicators name the requirements they measure, and one outside appetite while every linked requirement is answered as met is flagged as a contradiction.
Into ASD Essentials without starting again
Import the per-strategy levels from an Essential Eight assessment into an ASD Essentials assessment, and a transition view shows which Essentials principles and actions each strategy contributes to. The levels inform the work but do not become ratings, because ASD says they do not automatically convert.
Reports and history
Assessment reports in Word and PDF, a Baseerah summary on the dashboard, and a trend line across successive assessments, so the board sees whether the programme is moving.
Essential Eight frequently asked questions
What is the Essential Eight Maturity Model?
It is the Australian Signals Directorate's model for implementing eight mitigation strategies against cyber threats: application control, patch applications, restrict Microsoft Office macros, user application hardening, restrict administrative privileges, patch operating systems, multi-factor authentication and regular backups. Each strategy is graded from Maturity Level Zero to Maturity Level Three. The current edition is the November 2023 update.
Is the Essential Eight mandatory?
Not for every organisation. Non-corporate Commonwealth entities must implement it to Maturity Level Two under the Protective Security Policy Framework, Defence Industry Security Program members work to Maturity Level Two, and it is one of the frameworks a SOCI responsible entity can nominate in its critical infrastructure risk management program. Elsewhere it usually arrives through a contract, a tender or an insurer.
What does Maturity Level Two require?
Every Maturity Level One requirement, plus the Level Two requirements for each of the eight strategies. The November 2023 update added, among other things, phishing-resistant multi-factor authentication for online services, Microsoft's recommended application blocklist, annual validation of application control rules, centralised and protected event logs with monitoring of internet-facing servers, and reporting cyber security incidents to the CISO and to ASD.
How does the Essential Eight relate to ASD Essentials?
ASD Essentials, published on 15 October 2026, evolves the Essential Eight into chapters for enterprise IT, operational technology and cloud, and reports posture per domain rather than as one maturity level. The Essential Eight stays available during the transition, and ASD has told organisations to keep meeting existing obligations until regulators announce changes. Essential Eight levels do not automatically convert into ASD Essentials ratings, so each action is still assessed.
Which maturity level should we target?
ASD advises choosing a target that suits your environment and the threats you face, and reaching it across all eight strategies before moving higher. Where a regulator, contract or insurer names a level, start there: Maturity Level Two is what the PSPF and the Defence Industry Security Program ask for.
Can we self-assess the Essential Eight in GRCLens?
Yes. GRCLens holds the strategies, the requirements for each level, 173 test procedures and the ISM controls behind them, with evidence, owners and remediation in the same record. It supports a self-assessment or an assessor's work; it does not certify a maturity level, and ASD runs no certification scheme for the Essential Eight.
Can our Essential Eight results move into an ASD Essentials assessment?
Yes. GRCLens imports your per-strategy Essential Eight levels into an ASD Essentials assessment and shows which principles and actions each strategy contributes to, so you can see where existing investment carries forward and where new work is needed.
One platform, many obligations
See all supported frameworks → Every framework that applies in Australia →
Talk to us about Essential Eight
Security Solution Consultants provides Essential Eight compliance assessment alongside the platform, so you can combine tooling with hands-on expertise.