Automate Essential Eight readiness with adaptive compliance

The Australian Signals Directorate (ASD), through its Australian Cyber Security Centre. ASD first published the Essential Eight Maturity Model in June 2017 and updates it periodically — the most recent substantial revision was November 2023.

The Essential Eight sits within ASD's broader Strategies to Mitigate Cyber Security Incidents, and ASD also publishes a mapping between the Maturity Model and the Information Security Manual.

The eight strategies defined by this framework are:

• Application control — only approved applications can execute
• Patch applications — apply vendor patches for application vulnerabilities
• Configure Microsoft Office macro settings — block macros that aren't needed
• User application hardening — reduce the attack surface in browsers and other user software
• Restrict administrative privileges — limit who holds admin rights, and how they're used
• Patch operating systems — apply vendor patches for OS vulnerabilities
• Multi-factor authentication — verify users with more than a password
• Regular backups — maintain and test backups you can actually restore from

There are four maturity levels, from Maturity Level Zero to Maturity Level Three. Zero means significant weaknesses. One, Two and Three describe increasingly complete implementation, calibrated against adversaries of increasing capability.

The important part is how they interact. ASD's guidance is to reach the same level across all eight strategies before moving up. Being at Level Three on patching while sitting at Level One on application control doesn't make you a Level Three organisation — it makes you a Level One organisation with strong patching.

ASD expects organisations to be assessed against the current version of the model. Thusly, maturity is not a thing you achieve once, because a model revision can move your rating without you changing anything.

For non-corporate Commonwealth entities, yes. Under PSPF Policy 10, they've been required since 1 July 2022 to implement all eight strategies to Maturity Level Two, and to consider whether their threat environment warrants Maturity Level Three.

For everyone else it's voluntary — but increasingly it's a commercial requirement. If you sell to government, or into a supply chain that does, expect to be asked what maturity level you're at.

Where a strategy can't be fully implemented, compensating controls may be used to manage the residual risk, provided they give equivalent protection to the requirement they're standing in for.

No. ASD doesn't run a certification scheme for the Essential Eight, and nobody can issue you a certificate for it.

What exists is assessment. ASD publishes guidance on how Essential Eight assessments should be conducted, and the output is a maturity level rating rather than a credential. Assessments can be run internally or by a third party.

If a supplier tells you they're "Essential Eight certified", ask which maturity level, assessed by whom, against which version of the model, and when. 

Maturity Level Two is the practical answer for most organisations. It's what PSPF Policy 10 requires of non-corporate Commonwealth entities, which makes it the de facto benchmark in Australian procurement even for organisations the PSPF doesn't reach.

Maturity Level Three is for organisations whose threat environment warrants it — ASD asks Commonwealth entities to consider whether theirs does.

Set the target across all eight strategies at once rather than optimising the ones that are easy.

They answer different questions. The Essential Eight is a prescriptive set of eight technical mitigations with defined maturity levels. ISO 27001 and SOC 2 assess whether you run a management system or meet control criteria — broader in scope, far less specific about what you actually deploy.

They overlap heavily in evidence. Patching, MFA, admin privilege restriction and application control all appear in each. What the Essential Eight gives you that the others don't is a number a buyer immediately understands.

Iru supports seven of the eight strategies directly. The exception is regular backups — Iru has no backup product, and you'll need a separate solution for that strategy.

That distinction matters more here than it would elsewhere. Because ASD's guidance is to reach the same maturity level across all eight, your backup posture will cap your overall rating regardless of how strong the other seven are.

For those seven it takes the platform rather than the compliance product alone. Iru Endpoint Management handles application control, user application hardening, macro configuration and operating system patching. Iru Vulnerability Management covers application patching. Iru Workforce Identity handles multi-factor authentication and administrative privilege restriction. Iru Compliance Automation collects the evidence continuously, so your maturity assessment reflects current state rather than a point in time.