Essential Eight Maturity Level 1 Guide
Understand Australia's Essential Eight security baseline, the controls required at Maturity Level One, and how to start improving your organisation's cyber resilience.
Cyberattacks do not only affect large organisations. Small and medium-sized businesses can also be exposed through outdated software, compromised passwords, unsafe applications and untested backups. The Australian Signals Directorate (ASD) developed the Essential Eight to help organisations reduce common cyber risks.
This guide explains what Essential Eight Maturity Level 1 means, highlights key technical requirements and provides a practical implementation roadmap for Sydney businesses.
What is the Essential Eight?
The Essential Eight is a set of eight cybersecurity mitigation strategies recommended by ASD. It is primarily designed for internet-connected IT networks. The eight strategies work together: a strong password policy alone cannot compensate for unpatched systems or inadequate backup protection.
| Essential Eight strategy | Primary objective |
|---|---|
| 1. Patch applications | Reduce exposure to known software vulnerabilities |
| 2. Patch operating systems | Protect devices and infrastructure from OS vulnerabilities |
| 3. Multi-factor authentication | Reduce misuse of stolen or guessed credentials |
| 4. Restrict administrative privileges | Limit damage from privileged account compromise |
| 5. Application control | Allow only approved code to execute |
| 6. Restrict Microsoft Office macros | Limit malicious macro execution |
| 7. User application hardening | Reduce risky application features and attack surfaces |
| 8. Regular backups | Support secure recovery of data, applications and settings |
What does Maturity Level 1 mean?
ASD describes Level One as protection against opportunistic attackers using widely available techniques, such as exploiting known vulnerabilities or using stolen credentials. It is a useful starting point for many small and medium-sized businesses, although the appropriate target maturity level depends on risk, systems, contracts and regulatory obligations.
The model has four levels: Level Zero means Level One requirements are not met; Levels One, Two and Three represent progressively stronger protections. ASD recommends implementing all eight strategies to the same target level before progressing further.
The eight Maturity Level 1 strategies explained
1 Patch applications
Attackers often exploit vulnerable internet-facing software, browsers and office applications. Level One includes automated asset discovery at least fortnightly and vulnerability scanning with current vulnerability data.
- Scan online services at least daily; apply critical-vulnerability or working-exploit mitigations within 48 hours, and other relevant online-service vulnerability mitigations within two weeks.
- Scan office suites, browsers and extensions, email clients, PDF software and security products at least weekly; apply patches or vendor mitigations for vulnerabilities within two weeks.
- Remove specified unsupported online services and high-risk application categories.
Practical step: Maintain a software inventory and a tracked patching schedule with escalation for urgent exposures.
2 Patch operating systems
Keep operating systems supported and current across endpoints, servers and network infrastructure.
- Scan internet-facing servers and network-device operating systems daily; mitigate critical or exploited vulnerabilities within 48 hours, and other applicable vulnerabilities within two weeks.
- Scan workstations and non-internet-facing server/network operating systems at least fortnightly; apply relevant OS patches within one month.
- Replace operating systems no longer supported by vendors.
Practical step: Record device ownership, OS version, support status and remediation deadlines.
3 Multi-factor authentication (MFA)
Level One requires MFA for specified organisational and third-party online services handling sensitive organisational data, relevant customer services, and certain non-sensitive third-party services where MFA is available.
Accepted combinations include something the user has plus something they know, or something they have unlocked by something they know or are. Not every login prompt described as “two-step verification” necessarily meets these criteria.
Practical step: Inventory Microsoft 365, remote access, cloud platforms, financial systems and customer portals, then confirm the required users and customers are protected.
4 Restrict administrative privileges
Administrative access should be approved when requested and used only for tasks that genuinely require elevated rights. Level One calls for dedicated privileged accounts, restrictions on their internet/email/web access, and separation between privileged and ordinary operating environments.
Practical step: Review who holds admin rights, issue separate administrative identities, and remove unnecessary privilege.
5 Application control
Application control must be implemented on workstations and cover user-profile and temporary directories. It must restrict execution of executables, software libraries, scripts, installers, compiled HTML, HTML applications and control-panel applets to an organisation-approved set.
Practical step: Pilot an allowlisting policy with business-critical software before broad rollout.
6 Restrict Microsoft Office macros
Disable Office macros for users without a demonstrated business need; block macros in files originating from the internet; enable macro antivirus scanning; and prevent users from changing macro security settings.
Practical step: Identify legitimate macro-dependent workflows and replace or manage them under controlled exceptions.
7 User application hardening
Level One includes disabling or removing Internet Explorer 11, preventing web browsers from processing Java and web advertisements from the internet, and preventing users from changing browser security settings.
Practical step: Apply managed browser policies and verify their enforcement on representative devices.
8 Regular backups
Back up data, applications and settings based on business criticality and continuity requirements. Backups should be synchronised to a common recovery point, stored securely and resiliently, and tested through disaster recovery exercises. Unprivileged users must not be able to modify or delete backups or access other users' backups.
Practical step: Test full restoration—not only whether the backup job completed—and document recovery outcomes.
Quick reference: Level 1 patching timeframes
| System or software | Scanning | Patch / mitigation |
|---|---|---|
| Online services | Daily | 48 hours for vendor-critical or exploited vulnerabilities; otherwise 2 weeks |
| Office apps, browsers/extensions, email, PDF and security products | Weekly | Within 2 weeks |
| Internet-facing server/network operating systems | Daily | 48 hours for vendor-critical or exploited vulnerabilities; otherwise 2 weeks |
| Workstation and non-internet-facing server/network operating systems | Fortnightly | Within 1 month |
Summary of selected Appendix A requirements, not a substitute for the complete ASD model. Asset discovery is also required at least fortnightly for the patching strategies.
A practical implementation roadmap for Sydney businesses
- Define the scope: Identify networks, devices, cloud services, user accounts and business-critical data.
- Assess current controls: Compare actual configurations against every requirement in ASD Appendix A; collect evidence, not just policy statements.
- Address urgent risks: Prioritise exposed unpatched systems, missing MFA, excessive admin access and backup weaknesses.
- Deploy and test: Implement application control, browser hardening and macro restrictions carefully to avoid interrupting business workflows.
- Document exceptions: Seek appropriate approval, record compensating controls and review exceptions regularly.
- Verify and maintain: Reassess controls after changes and on a regular schedule, using ASD's assessment process guidance.
Essential Eight Level 1 readiness checklist
Use these questions to begin a gap review. A “yes” is not by itself evidence of full compliance.
- Do we maintain a reliable inventory of supported software, systems and devices?
- Do vulnerability scanning and patch deadlines meet the appropriate Level One requirements?
- Is MFA implemented for every online service and user/customer scenario covered by the model?
- Are privileged accounts dedicated, approved and properly separated?
- Does workstation application control restrict all specified executable content types?
- Are internet-origin macros blocked and user macro settings enforced?
- Are browser hardening policies centrally enforced?
- Are backups protected, aligned to business requirements and restoration-tested?
- Can we produce configuration records, scan results, tests and exception approvals?
Common implementation mistakes
- Assuming MFA alone equals Level One: All eight strategies and their individual requirements matter.
- Confusing a backup with recovery readiness: Restoration must be tested.
- Applying one patch deadline to every system: Requirements vary by software, exposure and vulnerability status.
- Ignoring cloud and third-party services: Relevant online services are in scope for MFA requirements.
- Declaring compliance without evidence: Assessment requires validation of how controls work in practice.
Frequently asked questions
Is Essential Eight Maturity Level 1 suitable for small businesses?
ASD notes that Level One may generally be suitable for small and medium-sized enterprises, but the appropriate target depends on each organisation's threat exposure, risk and obligations.
Is Essential Eight mandatory for every Australian business?
No. The Essential Eight is ASD-recommended cybersecurity guidance, not a universal legal mandate for every business. Particular organisations may have government, regulatory or contractual requirements to meet specified levels.
Does Microsoft 365 automatically satisfy Level One?
No. Microsoft 365 may provide tools for MFA, device management and security controls, but the organisation must configure, enforce and assess applicable controls across its entire environment.
Does passing a vulnerability scan mean we are compliant?
No. Scanning is only part of patch management; the maturity model also includes deadlines, configuration controls, identity security, backups and other requirements.
Can we move straight to Level Two?
ASD recommends progressively implementing and assessing each maturity level until the target level is achieved. Some stronger controls can be introduced earlier where practical.
Do we need an Essential Eight certificate?
ASD does not generally require independent certification of Essential Eight implementation, although independent assessments may be required under specific directives, regulations or contracts.
Need help strengthening your business cybersecurity?
ITNetFix Australia supports Sydney businesses with managed IT services, Microsoft 365 security, patch management, backup and recovery, and practical security improvements. Talk to our team about reviewing your current IT environment and planning next steps.
Talk to ITNetFix 1300 009 387
Official guidance and further reading
- ASD: Essential Eight Maturity Model (Appendix A)
- ASD: Essential Eight FAQ
- ASD: Essential Eight Assessment Process Guide
Editorial note: Technical detail references the ASD Essential Eight Maturity Model last reviewed 27 November 2023. Always confirm the latest official requirements before conducting an assessment.