If a tender document has just asked you to state your Essential Eight maturity level, and you are not sure what that means, you are in a very common position. This explains what is being asked, what the levels mean, and what closing the gap actually involves.
What the Essential Eight is
The Essential Eight is a set of eight mitigation strategies published by the Australian Cyber Security Centre. It is deliberately practical: eight controls, each measured across four maturity levels from zero to three.
- Application control so only approved software runs
- Patch applications to close known vulnerabilities
- Configure Microsoft Office macro settings to block a common malware path
- User application hardening to disable risky browser and application features
- Restrict administrative privileges so one compromised account cannot own the network
- Patch operating systems on a defined schedule
- Multi-factor authentication across email and key systems
- Regular backups that are taken, tested and kept recoverable
Who it actually applies to
Maturity Level 2 is mandatory for Australian non-corporate Commonwealth entities under the Protective Security Policy Framework. If you are a private business, the Essential Eight is not law. What has changed is that it now arrives contractually.
| Where the requirement comes from | What it usually looks like |
|---|---|
| Government tenders | A direct question asking you to state your current maturity level, sometimes with evidence |
| Prime contractors | Flow-down clauses requiring suppliers to demonstrate maturity as a condition of subcontracting |
| Cyber insurers | Questions about MFA, patching and backups at renewal, which are Essential Eight controls under another name |
| Enterprise clients | Vendor risk assessments and security questionnaires before onboarding |
The levels, in plain terms
Maturity Level 1
Protects against common, opportunistic attacks using widely available tooling. This is the realistic starting point for most SMBs and is achievable relatively quickly.
Maturity Level 2
Protects against more capable adversaries willing to invest time in a specific target. This is what most government-adjacent tenders ask for. It requires meaningfully tighter controls, particularly around administrative privileges and patch timeframes.
Maturity Level 3
Protects against adaptive, persistent adversaries. Required only for the most security-sensitive contracts, and demanding to sustain.
An important nuance: maturity is assessed per strategy, not as one overall score. You can be Level 2 on MFA and Level 0 on application control. Tenders usually want the level you meet across all eight, which means the weakest control sets your answer.
What closing the gap involves
Realistically, three to six months for an SMB starting from a standard Microsoft 365 environment. The sequence that tends to work:
- Assess honestly. Benchmark current maturity against all eight strategies. Overstating this in a tender response is a serious risk, not a shortcut.
- Fix the quick wins. MFA, patching cadence and backup testing usually move fastest.
- Tackle the hard ones. Application control and macro hardening take longest because they must be tested against how people actually work.
- Document the evidence. This is the part most businesses skip and then scramble for. Auditors and insurers want proof, not assertions.
- Maintain it. Maturity decays. New applications, new staff and configuration drift all pull it backwards.
A warning about self-assessment
Stating a maturity level you cannot evidence is worse than stating a lower one honestly. If a contract is awarded partly on that answer and an incident or audit later contradicts it, the exposure is contractual as well as technical. Where you genuinely sit at Level 1, saying so alongside a dated plan to reach Level 2 is usually received better than an inflated claim.
How we work on this
Xen IT delivers Essential Eight uplift as assess, remediate, evidence and maintain. We benchmark your current maturity across all eight strategies, implement the controls needed to reach your target level, document the evidence auditors and insurers ask for, and maintain it as your environment changes. The same approach covers ISO 27001 readiness and SMB1001.
Ready to stop fighting your IT?
Book a free, no-obligation IT assessment. We'll identify your biggest vulnerabilities and opportunities, and give you a clear roadmap, whether you engage us or not.