As of 5 October 2026, the latest published Essential Eight Maturity Model identified by the Australian Signals Directorate (ASD) is the version updated in November 2023. ASD announced a consultation in June 2026 on a proposed broader “Essentials” series, with the evolution of Essential Eight guidance intended as its first chapter. That announcement does not, by itself, establish that new guidance has been finalised, replaced the model or set a transition date.
What is the current Essential Eight Maturity Model?
The Essential Eight are ASD’s prioritised mitigation strategies for helping organisations protect against cyber threats. The maturity model describes how thoroughly an organisation implements the strategies against increasing levels of malicious actors’ tradecraft and targeting. ASD’s model page identifies its published version as last updated in November 2023; the Commonwealth Cyber Security Posture in 2025 report says the model was not updated in 2024–25.
As an Amazon Associate I earn from qualifying purchases.
The model is designed for internet-connected information technology (IT) networks. ASD says its principles can be applied to enterprise mobility and operational technology (OT), but the model was not designed for those environments. Their distinct threats may call for other mitigations.
Quick wins for a faster PC:
Clear out junk files and repair common Windows errorsFree Scan →Scan for outdated or missing drivers - takes under a minuteDriver Scan →Repair Windows errors before they cause bigger problemsFix Now →What the maturity levels mean
| Level | Meaning |
|---|---|
| Zero | Captures weaknesses where an organisation does not meet Level One requirements. |
| One | The first defined maturity level; ASD says it may suit small and medium enterprises as a broad example. |
| Two | A higher level of tradecraft and targeting; ASD gives large enterprises as a broad example. |
| Three | The highest level in the model, for more capable and targeted threats; ASD gives critical infrastructure providers and other high-threat organisations as broad examples. |
These are not tiers assigned to named adversaries, and reaching Level Three does not guarantee that an organisation cannot be compromised. ASD notes that sufficiently resourced actors may still succeed if they invest enough time, money and effort.
#1 Best Overall
How should an organisation choose a target level?
Use the levels as a risk-based implementation path, not as a universal ranking of organisations. ASD advises selecting a target appropriate to the organisation’s environment, implementing the levels progressively, and reaching the same maturity level across all eight strategies before moving to the next level.
- Threat: What level of adversary tradecraft and targeting should the organisation be prepared to mitigate?
- Attractiveness: How desirable might the organisation be as a target?
- Impact: What would compromise mean for the confidentiality, integrity or availability of its systems and information?
- Coverage: Are all eight strategies being brought to the same level, rather than advancing a few while leaving others behind?
ASD’s examples—Level One for some small and medium enterprises, Level Two for large enterprises, and Level Three for critical infrastructure providers and other high-threat organisations—are starting points, not substitutes for assessing risk. Organisations should also account for the limits of applying an IT-focused model to mobility and OT.
What changed in the November 2023 update?
The update rebalanced patching timeframes, strengthened multi-factor authentication (MFA), added controls for privileged access and application control, and expanded expectations for detecting and responding to incidents on internet-facing infrastructure. The points below describe the changes ASD identified; implementation decisions should be checked against the model’s exact control wording.
The Tool Desk
Outbyte PC Repair FREERepair Windows errors before they cause bigger problemsFix Now →Outbyte Driver Updater FREEScan for outdated or missing drivers - takes under a minuteDriver Scan →Patching applications, operating systems and firmware
- ASD added emphasis on promptly addressing vulnerabilities vendors assess as critical, including specified cases involving privileged authentication bypass or unauthenticated remote code execution. The change publication specifies mitigation within 48 hours for the covered critical or exploited cases.
- For high-risk applications that routinely interact with untrusted internet content, the Level One patching timeframe changed from one month to two weeks, and scanning moved from at least fortnightly to at least weekly.
- Some lower-priority operating-system patching and scanning timeframes were rebalanced rather than universally shortened.
- At Level Three, the update added patching or mitigation for driver and firmware vulnerabilities.
MFA and phishing resistance
At Level One, MFA must include “something users have” alongside “something users know,” or something users have that is unlocked using something users know or are. The update also tightened customer MFA requirements for online services handling sensitive data, introduced phishing-resistant MFA at a lower maturity level, and added workstation phishing-resistant MFA requirements at Levels Two and Three. ASD cites FIDO2 and WebAuthn as examples of standards associated with phishing-resistant MFA; the applicable model requirement, rather than the name of a technology alone, determines whether a control meets it.
Privileged access and application control
- The update added governance requirements for granting, controlling and rescinding privileged access to data repositories. It also limits internet access by privileged accounts through explicit authorisation and restrictions tied to duties.
- Break-glass credentials are addressed at higher maturity levels. Level Three also adds secure administrative workstation and Windows hardening requirements.
- At Level Two, organisations must implement Microsoft’s recommended application blocklist and validate application-control rulesets at least annually.
Logging, response, macros and other controls
- At Level Two, cross-cutting requirements cover centralised collection, protection and analysis of event logs, incident reporting and response. ASD says analysis at that level should focus on internet-facing infrastructure.
- The update removed a requirement to collect and analyse Microsoft Office macro execution events, while adding a Level Three requirement to use newer V3 digital signatures for macros.
- It requires disabling or uninstalling Internet Explorer 11 and implementing ASD and vendor hardening guidance where available.
- Backup prioritisation should consider business criticality, not only whether data is labelled “important.”
Is ASD replacing the Essential Eight with Essentials for enterprise IT?
ASD’s consultation notice, dated 15 June 2026, proposed a broader “Essentials” series grounded in the Information Security Manual. ASD described the proposed series as prioritised, threat-informed mitigations for contemporary technology environments, supported by practical tools and implementation guidance. The evolution of current Essential Eight guidance was proposed as the first chapter, “Essentials for enterprise IT,” with further chapters to follow. ASD said existing Essential Eight users could expect strong alignment with their current controls and investments.
The notice said consultation would run until 12 July 2026. It establishes that ASD proposed the series and invited feedback; it does not state that a final chapter has been published, that the Essential Eight has been replaced, or when any change would take effect. The model and posture-report information cited here do not establish a post-consultation publication or transition timetable.
Rank #4
What do the latest published adoption figures show?
ASD’s 2026 Commonwealth Cyber Security Posture in 2025 report covers surveyed entities, not every Australian organisation. Its figures should be read in that scope.
| Measure | Reported result | Scope and period |
|---|---|---|
| Entities at Level 2 or higher across all eight strategies | 22% in 2025, compared with 15% in 2024 | ASD report measure for surveyed entities |
| Entities reporting legacy technology affected implementation | 59% in 2025, compared with 71% in 2024 | ASD report measure for surveyed entities |
| Model updates | No updates in 2024–25 | ASD’s report on the Commonwealth cyber security posture |
The same report gives the following FY 2024–25 rates for entities achieving Level 2 or higher in each strategy. These are ASD report figures, not rates for all Australian organisations.
| Strategy | At Level 2 or higher |
|---|---|
| Patch applications | 56% |
| Patch operating systems | 62% |
| Multi-factor authentication | 34% |
| Restrict administrative privileges | 46% |
| Application control | 48% |
| Restrict Microsoft Office macros | 81% |
| User application hardening | 49% |
| Regular backups | 67% |
How should an organisation assess its implementation?
ASD’s assessment process guide, updated in October 2024, addresses both whether controls have been implemented and whether they are effective against the November 2023 model. It says independent certification is not generally required. A government directive or policy, regulator or contract may nevertheless require an independent assessment.
Assessors should consider whether compensating controls provide equivalent protection. ASD also notes that vendor products mentioned in the guide are illustrative, not endorsements. Assessment is therefore about evidence of protection against the relevant requirement, not simply a product list or a count of controls.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
Do these 3 things before closing this tab:
1Repair Windows errors before they cause bigger problems2Scan for outdated or missing drivers - takes under a minute3Clear out junk files and repair common Windows errors
