Essential Eight maturity: a practical starting point for NZ & AU teams
The Australian Signals Directorate’s Essential Eight is a focused baseline of eight mitigation strategies. Teams still stall on it when they treat it as a feature checklist instead of a model of consistent implementation. It was designed for Microsoft Windows-based internet-connected networks, so confirm that scope before applying it elsewhere.
Maturity is your weakest link, not your average
The model defines four maturity levels (ML0–ML3), with each level expressed across all eight strategies. For planning, use the lowest consistently evidenced strategy as the honest indicator of your overall position. Strong MFA does not compensate for weak application control, because an attacker can work through the less mature control. Record the highest level you can evidence for each strategy, then prioritise the lowest results.
The eight, grouped by what they actually stop
- Prevent execution: application control, restrict admin privileges, user application hardening.
- Close the patch window: patch applications and operating systems. At the relevant maturity levels, vendor-critical vulnerabilities and vulnerabilities with working exploits can require action within 48 hours for applicable systems.
- Limit macro and email-borne delivery: configure Microsoft Office macro settings.
- Contain account compromise: multi-factor authentication.
- Recover: regular, tested, isolated backups.
Reading them this way helps you sequence: if you have no application control and admins browse the web from privileged accounts, an attacker who lands a single payload has a clear path. Those gaps usually outrank, say, a missing BIMI record.
Where NZ and AU teams diverge
Australian government entities may have specific Essential Eight direction, while APRA-regulated organisations must consider the operational-risk requirements in CPS 230 alongside the information-security requirements in CPS 234. New Zealand government organisations may work from the NZISM, and organisations in both countries have privacy obligations that depend on context. For a cross-border environment, use the Essential Eight as an engineering baseline where it fits, then map evidence to each obligation separately. A control mapping is not proof of compliance.
A 90-day sequence that works
- Weeks 1–2: honest ML0–ML3 self-assessment across all eight; identify the weakest link.
- Weeks 3–6: raise the lowest strategy to a consistent ML1, prioritising patch timeframes and MFA coverage on internet-facing and privileged accounts.
- Weeks 7–10: turn on logging for the controls you have (application control, macro execution, command-line process creation) so ML2 evidence exists.
- Weeks 11–13: test a backup restore end-to-end and capture the evidence; close the loop with a re-assessment.
None of this requires new tooling first — it requires operating discipline and evidence. That is deliberately the order: maturity is demonstrated by consistent, logged, tested controls, not by the number of products you own.
You can get a rough read in a few minutes with the free Essential Eight self-assessment on this site, then use the weakest-link result to drive the sequence above.