Essential Eight, end-to-end.
Eight mitigations, four maturity levels, one auditor with a checklist. We cover every control, evidence ask, and report your assessor expects — without you having to read the 90-page guide.
Australia's cyber baseline.
A practical floor for cyber hygiene — recommended for every AU organisation, mandated for federal entities, and increasingly expected by APRA, ASIC, and state regulators.
The Essential Eight is a set of eight prioritised mitigation strategies published by the Australian Cyber Security Centre (ACSC). Each addresses a real, common attack path — phishing, ransomware, lateral movement, data theft — and the bundle was deliberately chosen because, implemented together, it stops the majority of intrusions AU businesses actually see.
Maturity is reported on a 0–3 scale. ML0 means a strategy is absent or ad-hoc; ML3 means it's tuned to active adversaries. The level your auditor expects depends on who you are: a small not-for-profit can rest at ML1, an APRA-regulated lender will be pushed to ML2 or ML3.
Four rungs. Pick the one your auditor expects.
The ACSC defines four maturity levels for each of the eight mitigations. Cybereen reports your level per strategy and overall — and shows you the exact next move to climb a rung.
Not started.
The strategy isn't implemented, or you can't prove it is. Common starting point for orgs new to cyber compliance.
- No documented evidence
- Ad-hoc / inherited tools
- Audit risk: high
Baseline.
Mitigates opportunistic attackers using publicly-known techniques. Reasonable floor for small AU orgs.
- Basic tooling in place
- Mostly point-in-time evidence
- Suits small non-regulated orgs
Comprehensive.
Mitigates attackers willing to invest more time and effort. The level most regulated AU organisations should target.
- Continuous monitoring
- Documented + tested policies
- APRA / ASIC comfortable
Adversary-aware.
Mitigates well-resourced adversaries who tailor their tradecraft. Required for highest-risk federal and critical-infrastructure entities.
- Active threat modelling
- Adversarial testing
- SOC 24/7 expected
The eight mitigations.
What each strategy covers, and where Cybereen asks you for evidence or hands you a policy template.
Only approved apps run. Blocks malware delivered through unknown executables.
Patch internet-facing apps within 48 hours of a critical CVE.
Block macros from the internet, allow only signed macros for trusted users.
Disable web ads, Java in browsers, untrusted Office add-ins by policy.
Time-bound, just-in-time admin access. Reviewed quarterly.
Critical OS patches within 48 hours. Internet-facing OSes treated separately.
MFA for all users, all internet-facing services, and privileged access.
Daily, tested, offline / immutable. Restore exercise quarterly.
Eight strategies. One radar.
Your current maturity, your target, and the criteria still to close — on one screen, exportable to PDF, sharable to your auditor as a live link.
- Radar by strategy — current vs target maturity, per mitigation.
- Criteria progress bars — every sub-check, completed vs remaining.
- One-click PDF — board-ready, dated, audit-trail attached.
- Auditor live link — read-only, time-boxed, revocable.
- Cross-framework reuse — your E8 evidence pre-fills ISO 27001 + NIST CSF.
Three places AU teams trip on E8.
Patterns we see weekly. Each has a one-line fix.
Reporting an overall ML number.
"We're ML2" is meaningless to an auditor — your maturity is per-strategy. Backups can be ML3 while admin privs are ML0, and the auditor only cares about the weakest one.
Treating policies as evidence.
A signed policy that says "we patch in 48 hours" is not evidence you patched in 48 hours. Auditors increasingly want the artefact, not the intent.
Skipping the restore test.
You have backups. Have you actually restored one this quarter, end-to-end, with timing logged? If not, you're at ML0 for Mitigation 08 — no matter how many TB you back up nightly.
Questions auditors ask before signing.
If yours isn't here, the trial form has a free-text field — answers go in the next page revision.
Is the Essential Eight mandatory for my organisation?
How long does Cybereen take to reach ML2?
Which auditors accept Cybereen's reports?
What if I'm already at ML2 — what do I get?
Does Cybereen replace my MDM / EDR / backup tool?
How does Essential Eight relate to ISO 27001 or NIST CSF?
Get your first ML map in 60 minutes.
Connect your identity provider and endpoint manager — Cybereen produces your per-strategy maturity scorecard while you grab a coffee. Free trial, no card.