Essential Eight Maturity Level 2: What It Takes
Essential Eight Maturity Level 2 is the level aimed at attackers willing to invest real time and effort in a target, rather than those running commodity attacks against anyone who leaves a door open. Moving from Level One to Level Two is mostly about three things: extending controls past your internet-facing systems to the rest of the environment, separating privileged access from everyday use, and keeping logs of both. For a small Australian business, the lift usually takes three to nine months.
The work is less about buying tools and more about finishing things that were started at the edge and never carried through to the inside.
What is Essential Eight Maturity Level 2?
Essential Eight Maturity Level 2 is the second of three target maturity levels in the Australian Signals Directorate’s Essential Eight Maturity Model. Each level is defined by the sophistication of the attacker it is designed to frustrate, not by a count of controls implemented.
The model describes four levels:
- Maturity Level Zero. There are weaknesses that mean the requirements of Level One are not met.
- Maturity Level One. Aimed at attackers using widely available tradecraft, looking for any victim rather than a specific one.
- Maturity Level Two. Aimed at attackers prepared to invest more time and more capable tooling in a target, and more selective about who they pursue.
- Maturity Level Three. Aimed at adaptive attackers who have chosen your organisation specifically and are less reliant on publicly available tools.
The full requirements for each strategy at each level are published by ASD in the Essential Eight Maturity Model, and that document is the authority. This article explains the shape of the lift from Level One to Level Two rather than reproducing the requirements.
How is Essential Eight maturity scored?
Essential Eight maturity is scored as the lowest level achieved across all eight mitigation strategies, not as an average. An organisation that meets Level Three for application control but Level One for backups is at Level One overall.
This single rule explains most of the frustration organisations feel partway through an uplift. Months of work on patching does not move the overall rating if macro settings remain unmanaged. ASD’s guidance is that organisations should implement all eight strategies to a target level before climbing to the next, because the strategies are designed to complement one another and a strong control does not compensate for an absent one.
It also means the planning question is not which strategies are easiest, but which are furthest behind. Our Essential 8 audit checklist and the ASD Essential 8 requirements cover the strategies individually.
What changes when you move from Level One to Level Two?
Moving from Essential Eight Maturity Level One to Level Two extends each strategy beyond the internet-facing edge, adds separation between privileged and everyday access, and introduces logging of security-relevant events.
| Strategy | The shape of the lift to Level Two |
|---|---|
| Patch applications | Patching extends from internet-facing services to the wider application estate, including office suites, browsers, email clients and PDF readers, on a monthly cycle with regular scanning |
| Patch operating systems | Patching extends to workstations, servers and network devices on a monthly cycle, and operating systems no longer supported by the vendor are replaced |
| Multi-factor authentication | MFA extends to privileged users of systems, and MFA events are logged |
| Restrict administrative privileges | Privileged users operate from separate privileged and unprivileged environments, privileged access is revalidated and removed when unused, and privileged activity is logged |
| Application control | Application control extends from workstation user folders to internet-facing servers, with allowed and blocked execution events logged |
| Configure Microsoft Office macros | Users can no longer change macro security settings, and allowed and blocked macro events are logged |
| User application hardening | Office and PDF software are blocked from creating child processes, and blocked PowerShell activity is logged |
| Regular backups | Privileged accounts other than backup administrators are prevented from modifying or deleting backups |
Read the table as a pattern rather than a specification. Level One asks you to protect what faces the internet. Level Two asks you to protect what sits behind it, and to be able to show what happened.
Which strategies cause the most trouble at Level Two?
Three strategies account for most of the time and cost in an Essential Eight uplift from Level One to Level Two, and none of them is primarily a licensing problem.
- Application control on servers. Extending application control beyond workstations to internet-facing servers requires knowing what legitimately runs on those servers. Most organisations discover they do not, and the discovery work takes longer than the implementation.
- Separating privileged access. Giving administrators separate accounts and separate environments changes daily habits across the IT function. The technical change is modest; the behavioural change is where it stalls.
- Patching the whole estate monthly. Patching internet-facing services is a well-defined job. Patching every application on every workstation within a month requires an accurate inventory, a deployment mechanism and a way to handle the machines that are offline when the window closes.
Logging sits underneath all three. Several Level Two requirements expect events to be captured and retained, which for many small businesses means setting up central logging for the first time.
How long does the lift from Level One to Level Two take?
For an Australian business of 20 to 200 staff that genuinely meets Level One, reaching Level Two usually takes three to nine months of deliberate work. For an organisation starting from Level Zero, allow longer, because Level One has to be completed first.
The variables that move that range are predictable:
- Whether you have a current asset inventory, because every patching and application control requirement depends on knowing what you run
- Whether endpoints are centrally managed, since enforcing settings across unmanaged devices is slow and unreliable
- How many legacy or unsupported systems exist, because replacing them is a project in its own right
- Whether anyone owns the work, as uplifts that are nobody’s explicit responsibility tend to stop at the first awkward strategy
A sensible sequence is to assess honestly, fix the strategies furthest from Level Two first, and reassess at the halfway point rather than at the end.
How do you track maturity scoring and the evidence behind it?
Essential Eight maturity is assessed strategy by strategy, so the tracking problem is keeping a current score against each of the eight along with the evidence that supports it. For eight strategies, a spreadsheet handles this perfectly well, and most Australian small businesses use one.
The alternatives are worth knowing. A consultant-led assessment produces a scored report and a remediation plan without you maintaining anything between assessments. An enterprise compliance platform collects evidence automatically through integrations with your systems. A self-service tool such as CertAssist sits between the two: it scores Essential Eight across maturity levels one to three and stores evidence against each control, publishes a list price of US$375 per month, and connects to no systems at all, which trades automated evidence collection for granting no access. Which of the three suits you depends on how often you need a current score and how much system access you are willing to give a third party.
Whichever you choose, an external assessment is what gives the score credibility with a customer or a government buyer who asks. Our Essential 8 maturity assessment guide covers how a formal assessment runs.
Do you need Level Two, or is Level One enough?
Most Australian small and medium businesses with no specific obligation should target Level One first and treat Level Two as the next step, not the starting point. Organisations handling government data, bidding for government work, or holding large volumes of personal information are the ones for whom Level Two is usually the right target.
Reasons the choice may already be made for you:
- A government contract or tender that specifies a maturity level as a condition
- A parent organisation or a major customer setting a minimum standard across its supply chain
- Defence sector work, where Essential Eight sits alongside other obligations covered in how DISP relates to ISO 27001 and other frameworks
- A cyber insurance policy with control requirements that happen to map to Level Two
If none of these applies, there is no regulatory default that pushes a private Australian business to Level Two. Whether the Essential Eight is mandatory at all depends on who you are, which is covered in is ASD Essential 8 mandatory in Australia. For businesses also pursuing certification, ISO 27001 versus the Essential Eight sets out how the two fit together.
Common questions
What is Essential Eight Maturity Level 2?
Maturity Level 2 is the middle of the three target levels in ASD’s Essential Eight Maturity Model. It is aimed at attackers who are prepared to invest more time and more capable tools in a target and are more selective about who they go after. In practice it extends each of the eight strategies beyond internet-facing systems, separates privileged from everyday access, and requires security-relevant events to be logged.
What are the Essential Eight Maturity Level 2 requirements?
The requirements are defined per strategy by ASD and cover patching timeframes across the whole estate, multi-factor authentication extended to privileged users, separated privileged environments with revalidation, application control on internet-facing servers, enforced macro settings, hardened Office and PDF software, and backups that privileged accounts cannot alter or delete. ASD’s maturity model document is the authoritative source for the current wording.
Can you achieve Level 3 without Level 2?
Not as an overall rating. Maturity is scored as the lowest level reached across all eight strategies, so an organisation cannot be rated at Level Three while any strategy sits below it. Individual strategies can exceed the target level, and ASD’s position is that organisations should not be penalised for implementing stronger controls than their target requires, but the overall rating still follows the weakest strategy.
What are maturity levels in the Essential Eight?
Maturity levels are a scale from Zero to Three describing how well an organisation has implemented the eight mitigation strategies, graded against the sophistication of the attacker each level is designed to stop. Level Zero means Level One is not yet met. Levels One, Two and Three correspond to increasing attacker capability and persistence, and organisations pick a target level based on the threat they realistically face.
Are the Essential Eight maturity levels the same as a compliance certification?
No. There is no certificate issued for an Essential Eight maturity level. An assessment produces a rating against each strategy and an overall level, usually documented in a report. That report is what organisations present to customers, government buyers or insurers. Unlike ISO 27001, there is no accredited certification body and no certificate with an expiry date.
Planning the lift
Start with an honest assessment of where each of the eight strategies actually sits, not where you intended them to sit. The gap between those two is where every uplift timeline goes wrong. Then sequence the work by distance from target rather than by ease, because the lowest strategy sets your rating regardless of how far the others have travelled.
Siege Cyber runs Essential Eight assessments and uplift programmes for Australian organisations. See the Essential Eight service for how an assessment works, or get in touch to discuss your target level. General guidance for small business is also published at business.gov.au.