If your board or a customer asks about your Essential Eight maturity, start with evidence of how each mitigation strategy is implemented. Record the gaps against the current ASD requirements before claiming a maturity level.
What an essential eight maturity assessment actually measures
The Australian Signals Directorate’s Essential Eight covers eight mitigation strategies for internet-connected IT networks:
- Patch applications
- Patch operating systems
- Multi-factor authentication
- Restrict administrative privileges
- Application control
- Restrict Microsoft Office macros
- User application hardening
- Regular backups
It is not a general IT health check. Each strategy exists because it closes off a specific step an intruder relies on — an unpatched vulnerability, a stolen credential with no second factor, a macro that launches a payload. That focus is also its limit: an organisation can meet its Essential Eight target and still be exposed to risks the framework was never built to cover, such as physical security or third-party data handling.
Do not present a target level as achieved maturity in a tender, insurance questionnaire or board report. State what was assessed, the supporting evidence, unresolved gaps and the date. Score evidence, not intent.
Maturity depends on the requirements, scope and evidence
The Essential Eight Maturity Model does not ask “have you deployed multi-factor authentication?” as a yes/no question. It asks how consistently and how well each strategy is implemented, on a maturity scale that runs from Maturity Level Zero (weaknesses in the organisation’s overall cyber security posture) up through Levels One, Two and Three, each level defined against the sophistication of tradecraft it is expected to resist.
Two things trip people up here. First, maturity is normally assessed one strategy at a time, and an organisation’s overall maturity is realistically no higher than its weakest strategy — a business with excellent patch management but no application control is not “mostly at Level Two.” Second, ASD reviews and updates the maturity model’s detail from time to time, so treat the specific wording of each level as something to confirm against the current published guidance rather than something to assume you remember correctly from a past assessment.
How to run a self-assessment without kidding yourself
A credible self-assessment follows a discipline, not a gut feel:
- Assign one accountable owner per strategy. The same person may own several strategies in a small organisation. Record the evidence and contributors for each strategy separately so none is assumed to have been checked.
- Score from evidence, not intent. A policy that says “administrative privileges are reviewed quarterly” is not evidence a review happened. Pull the actual log, ticket or export.
- Record the highest level for which the required evidence is complete, not the level you believe is probably true. If you cannot produce evidence for Level Two, you are at Level One or Zero for that strategy, regardless of what the architecture diagram implies.
- Record exceptions and compensating controls separately from the score itself, so the gap is visible rather than quietly averaged away.
- Set a re-assessment date. A self-assessment with no review cycle is a snapshot that goes stale the day a system is added or a control lapses.
This discipline matters more than the scoring template you use. Two organisations can use the exact same spreadsheet and produce very different quality assessments, because the difference lives in whether someone actually went and pulled the evidence, not in how the columns are labelled.
A worked example: scoring one strategy properly
Take a fictional regional university, Bindarra University, assessing the internet-facing applications used by admissions, teaching support and research administration.
| Element | What was claimed | What the evidence showed | Level supportable |
|---|---|---|---|
| Patch timeframe for internet-facing apps | “Patched within 48 hours of a vendor advisory” | Ticketing data showed a median of 11 days over the last quarter, with two systems unpatched at 40+ days | Below the claimed level |
| Vulnerability scanning | “Weekly automated scans” | Scans ran weekly, but results were not reviewed or actioned for one of three university divisions | Partial — scanning exists, response process does not |
| Coverage | “All internet-facing applications in scope” | The contractor-managed admissions portal and research grants system were missing from the scan inventory | Gap in scope, not just in speed |
The honest score for this strategy at Bindarra University was lower than IT’s initial self-rating, and the gap was in process and scope, not tooling. That is a common pattern: the technology exists, but the operating discipline around it does not.
The same exercise, repeated across all eight strategies, typically surfaces one or two that are genuinely strong, several that are adequate but undocumented, and at least one with a scope gap nobody had flagged — often something outside the core IT estate, like a contractor-managed system or a legacy application nobody wants to own. Recording the score without recording the reason for it wastes the most useful part of the exercise: knowing exactly what to fix first.
Common mistakes in Essential Eight self-assessment
- Scoring intent instead of evidence. “We have a policy for this” is not the same claim as “we can show this happened last month.”
- Letting one enthusiastic strategy hide a weak one. A strong backup regime does not offset unreviewed admin privileges; maturity does not average.
- Assessing once and never again. A new SaaS platform, a merger, or a change of IT provider can quietly drop maturity a level without anyone deciding that on purpose.
- No independent review. Self-scoring by the same team that implements the controls tends to be optimistic; a second reviewer can help challenge unsupported conclusions.
- Treating “documented” as “done.” This is the mistake that shows up across almost every control framework, not just this one: a control that is written down is not the same as a control that is operating.
Free working resource
Record the evidence and the gaps
The SRMBOK ASD Essential 8 Assessment Tool is an Excel workbook for recording an assessment across the eight strategies. Check its criteria against the current ASD model above; record missing evidence and exceptions rather than treating the workbook as certification.
Download the free Essential Eight Excel tool
Opens the SRMBOK product page. Add the free item to your cart and complete the $0 order to receive the download. Check the newsletter choice at checkout.