Choosing Your Essential Eight Target Maturity Level

The Essential Eight's maturity levels aren't a ladder you must climb to the top. Each one targets a different adversary, and the right target depends on who is likely to come after you.

ASD's Essential Eight Maturity Model sets out three levels for each of the eight mitigation strategies. A common mistake is to treat them as grades, with Level Three as the goal for everyone. They're not grades. Each level is designed to stop a different kind of adversary, and the right target depends on your threat environment.

What each level is for

Level One stops adversaries using commodity tradecraft opportunistically: widely available exploits, stolen credentials, malicious documents sent to anyone.
Level Two stops adversaries willing to invest more time and effort, and to target an organisation, but still relying largely on known techniques.
Level Three stops adaptive adversaries who are less reliant on public tools, quickly exploit new vulnerabilities and work to evade detection.

The requirements tighten at each level: shorter patching deadlines, MFA for more users and systems and phishing-resistant methods, application control on more systems and file types, stronger restrictions on administrative privileges and backups.

How to choose

Start from threat. Who would want what you hold? Government data, critical infrastructure, financial services and high-value intellectual property attract more capable adversaries.
Check obligations. Australian Government non-corporate Commonwealth entities are expected to reach Maturity Level Two. Customers, regulators and insurers may set their own expectations.
Be realistic about capability. Level Three requires engineering effort and operational discipline that a small IT team may not sustain.
Pick one target for all eight. ASD recommends reaching the same level across every strategy before raising any of them. A Level Three patching programme with Level Zero application control still leaves the door open.

Photograph of a worn wooden stepladder in an empty freshly painted room with a paint tin and brush beside it — Progress one level at a time, across all eight strategies together.

Typical paths

Most organisations: Level One across all eight, then Level Two.
Organisations handling sensitive government or critical data: Level Two as the baseline, with selected Level Three requirements on the highest-risk systems.
High-threat environments: Level Three, usually reached system by system.

Recording the decision

If you run an ISO 27001 ISMS, record the chosen level and its reasoning in your risk assessment and Statement of Applicability. That gives auditors and assessors the justification, and turns the Essential Eight into the implementation standard for the matching Annex A controls, as our Essential Eight vs ISO 27001 analysis explains.

Common mistakes when setting a target

Chasing Level Three on one strategy while others sit at Level Zero. Attackers use the weakest strategy, not the strongest.
Counting coverage, not effectiveness. Application control deployed on half the workstations isn't Level One; every requirement must be met across the systems in scope.
Ignoring exceptions. Every exception (an unpatched legacy system, a user exempt from macro blocking) needs an owner, compensating controls and an end date, or the maturity level is fiction.
Assessing by interview. ASD's assessment guidance ranks evidence: testing a control directly is strongest, documentation and interviews are weakest. Self-assessments based on what people say overstate maturity.
Setting a target once. Threats change, and so does the maturity model; ASD updates it periodically. Review the target annually alongside your risk assessment.

Key takeaways

Each maturity level targets a different adversary; choose by threat and obligation.
Reach the same level across all eight strategies before raising any.
Level Two is the usual first target.

Measuring progress

Assess each strategy against ASD's Essential Eight Assessment Process Guide, using system testing where you can; a strategy reaches a level only when every requirement at that level and below is met. Track the lowest level achieved across the eight as your headline number.

Each strategy's page lists its ISM controls by maturity level, for example Patch applications and Multi-factor authentication. The Essential Eight guide covers assessment in more detail.

Questions

Which Essential Eight maturity level should we target?

Choose by threat: Level One for opportunistic attackers using commodity tools, Level Two for adversaries willing to invest more effort, Level Three for adaptive adversaries. Level Two is the usual first target and the expectation for Australian Government non-corporate Commonwealth entities.

Can different strategies be at different maturity levels?

They can be assessed separately, but ASD recommends reaching the same level across all eight before moving any of them higher.

How long does it take to reach Maturity Level Two?

It depends on starting point and environment size. Organisations already at Level One across all eight strategies often reach Level Two in months; those starting from scratch should plan for longer, strategy by strategy.

Data as of 2026-10-27: numbers in this post are computed from the current crosswalk and update when it changes. Crosswalk a published crosswalk (NIST, ENISA, CIS, PCI SSC) makes the link · Editorial ControlMapping's judgement where no crosswalk exists; the reason is shown · only shares a CSF 2.0 outcome: worth checking, not a mapping · No mapping in our data nothing mapped in our data; often new work, but check the coverage notes. Not compliance advice.

Choosing your Essential Eight target maturity level