Essential Eight Maturity Levels Explained
The ASD model defines four maturity levels to help organisations select and assess a defensible cyber security target.
Maturity is assessed across the Essential Eight as a package. The appropriate target depends on the organisation, system, threats, information and obligations—not a universal requirement to reach the highest level.
What Is the Essential Eight Maturity Model?
The Essential Eight Maturity Model supports implementation of eight prioritised mitigation strategies. With the exception of Level Zero, its levels address increasing tradecraft and targeting by malicious actors. Higher levels build on the lower-level requirements.
The Four Maturity Levels
Maturity Level Zero
Level Zero indicates weaknesses in the organisation's overall cyber security posture because the requirements of Maturity Level One are not met.
Maturity Level One
Level One focuses on malicious actors using widely available commodity tradecraft to gain access to and likely control a system.
Maturity Level Two
Level Two addresses malicious actors willing to invest more effort in targeting and use more effective tradecraft to bypass controls and evade detection.
Maturity Level Three
Level Three addresses malicious actors using more advanced tradecraft and targeted techniques. It materially raises resistance but does not eliminate cyber risk.
Which Essential Eight Maturity Level Do You Need?
Select the target using risk, the likely tradecraft and targeting, consequences of compromise, data confidentiality, system availability and integrity, and any legislative, policy, regulatory or contractual requirements. Different systems within one organisation may have different requirements.
How Is Essential Eight Maturity Assessed?
An assessment defines the boundary and target, gathers evidence, tests the controls associated with each mitigation strategy and records whether the requirements are met. Read our Essential Eight assessment process guide for the practical stages.
Essential Eight Assessment Services
CCircle provides Essential Eight maturity assessments and uplift planning across Australia and Essential Eight consulting in Canberra.