Essential Eight Framework
Essential Eight implementation that holds up to an audit, not just a checklist.
Affinity MSP assesses where your business sits against the ACSC Essential Eight, builds a maturity roadmap suited to your industry, and manages the ongoing work of getting — and staying — compliant across Melbourne, Sydney, Brisbane, Perth and Auckland.
Book a free maturity assessment
No obligation. We'll tell you your current maturity level before you commit to anything.
You may need Essential Eight help if...
Most businesses do not start because they want another framework. They start because someone has asked them to prove their cyber posture.
Your insurer is asking questions
Cyber insurance renewals increasingly ask for MFA, backups, patching and access controls.
A tender needs evidence
Procurement teams want proof that controls are implemented, monitored and documented.
Your IT team is stretched
The roadmap is clear, but implementation, reporting and maintenance need extra hands.
We help translate Essential Eight requirements into real work across Microsoft 365, endpoints, identity, patching, admin access and backups.
ML0
Not aligned
ML1
Baseline
ML2
Targeted
ML3
Advanced
Most Australian SMBs sit at ML0 or ML1 without realising it. That's often enough to trigger higher cyber insurance premiums or knock you out of a government tender. We'll show you exactly where you stand and what it takes to move up.
What is the Essential Eight framework?
The Essential Eight is a set of eight cyber security mitigation strategies developed by the Australian Signals Directorate (ASD) and promoted by the Australian Cyber Security Centre (ACSC) as part of the broader Strategies to Mitigate Cyber Security Incidents. It's the closest thing Australia has to a national cyber security baseline.
Rather than a vague set of best practices, the Essential Eight gives businesses eight specific, technical controls to implement — each mapped against a maturity model from Level Zero (not aligned) through to Level Three (advanced). The ACSC expects organisations to reach a consistent maturity level across all eight strategies before moving up, rather than excelling at one and neglecting another.
It's mandatory at Maturity Level Two for Australian non-corporate Commonwealth entities. For private businesses — particularly those in finance, healthcare, legal, and any business supplying government or handling sensitive client data — it's fast becoming the reference point cyber insurers, auditors, and procurement teams ask about by name.
8
mitigation strategies, each with its own maturity target
2017
the year ASD first published the framework
4
maturity levels, from ML0 to ML3
3
core objectives: prevent, limit, recover
The eight strategies, in plain English
Each strategy targets a different stage of an attack — stopping malware getting in, limiting the damage if it does, and making sure you can recover fast.
Application control
Only approved, trusted applications are allowed to run — blocking unknown executables before they get a foothold.
PREVENT
Patch applications
Known vulnerabilities in browsers, PDF readers, and office software get closed fast, before attackers can exploit them.
PREVENT
Configure Office macros
Macros are one of the most common malware delivery methods. We lock down settings so only vetted macros can run.
PREVENT
User application hardening
Web browsers and everyday apps are configured to block the tricks attackers rely on, like malicious ads and Flash content.
PREVENT
Restrict admin privileges
Admin access is limited to what people actually need, so a single compromised account can't take down the whole network.
LIMIT IMPACT
Patch operating systems
Operating system vulnerabilities are patched on a defined schedule, closing the gaps attackers scan for first.
LIMIT IMPACT
Multi-factor authentication
A password alone is never enough. MFA is enforced across email, remote access, and privileged accounts.
LIMIT IMPACT
Regular backups
Backups are automated, tested, and stored so you can recover data and get operational again without paying a ransom.
RECOVER
From assessment to audit-ready, step by step
We don't just implement controls and walk away. Essential Eight maturity is maintained, monitored, and reported on for as long as you need it.
Maturity assessment
We benchmark your current environment against all eight strategies and tell you exactly where you sit — ML0 through ML3.
Gap analysis & roadmap
We map the gaps to your target maturity level and industry requirements, then build a staged, budgeted roadmap.
Implementation
We configure, deploy, and document each control, with minimal disruption to your team's day-to-day work.
Monitoring & reporting
Ongoing monitoring keeps every control at its target level, with reporting you can hand straight to a board or auditor.
Review & uplift
As your risk profile or compliance obligations grow, we reassess and uplift your target maturity level with you.
Not sure what maturity level your business needs?
Most businesses guess. We assess. A short conversation is enough to tell you where you stand and what's actually worth prioritising first.
Which maturity level does your business actually need?
The ACSC defines four maturity levels. Higher isn't automatically better — it's about matching the level to the sophistication of the threats you actually face.
| Maturity level | Protects against | Typical business |
|---|---|---|
| ML0 | Not aligned with the framework's intent. Weaknesses that any opportunistic attacker could exploit. | Businesses with no formal cyber controls in place |
| ML1 | Opportunistic attackers using commodity tools, mass phishing, and unpatched software | Most small businesses, as a practical starting point |
| ML2 | More focused adversaries willing to invest time bypassing basic controls | Government suppliers, finance, healthcare, legal, and other compliance-sensitive businesses |
| ML3 | Sophisticated, well-resourced adversaries prepared to adapt to your specific defences | Critical infrastructure, Defence-adjacent, and high-value targets |
The ACSC recommends reaching the same maturity level across all eight strategies before moving to the next level — strength in one area doesn't offset a gap in another.
Essential Eight support backed by real-world IT delivery
Supporting $1.5B+ in client revenue
5,000+ endpoints actively managed and monitored
99.7% client retention
8+ years delivering managed IT and cyber security in ANZ
100% Australian-owned
One Australian partner, full accountability
Frequently Asked Questions
The Essential Eight is a set of eight cyber security mitigation strategies developed by the Australian Cyber Security Centre (ACSC) to help organisations defend against common cyberattacks. It's the baseline cyber security standard referenced across government, insurance, and procurement requirements in Australia. Affinity MSP maps every strategy to a business's actual environment rather than treating it as a generic checklist.
Essential Eight compliance is mandatory for non-corporate Commonwealth entities but voluntary for private businesses, though it's fast becoming the reference point cyber insurers, auditors, and procurement teams ask about. Affinity MSP helps businesses across Melbourne, Sydney, Brisbane, Perth, and Auckland get audit-ready even when there's no legal obligation to do so.
The Essential Eight has four maturity levels, ML0 through ML3, each reflecting how sophisticated the threats a business is protected against are. ML0 means not aligned, ML1 covers baseline protection against opportunistic attackers, ML2 targets more focused adversaries, and ML3 defends against sophisticated, well-resourced attacks. Most Australian SMBs sit at ML0 or ML1 without realising it.
The maturity level a business needs depends on the sophistication of the threats it actually faces, not a one-size-fits-all target. Businesses handling sensitive client data, government contracts, or compliance-heavy work (finance, healthcare, legal) typically need ML2 or above, while smaller operations may only need ML1. Affinity MSP assesses this for businesses in Melbourne, Sydney, Brisbane, Perth, and Auckland with a free maturity assessment.
Essential Eight implementation timelines vary depending on a business's current maturity level and the gap to its target level, but most engagements follow a staged roadmap covering assessment, gap analysis, implementation, and ongoing monitoring. Affinity MSP builds this into a scheduled, budgeted plan rather than a rushed rollout.
Essential Eight maturity is increasingly used by cyber insurers to assess risk before offering cover, and gaps in controls like MFA, patching, or backups can trigger higher premiums or knock a business out of a policy altogether. Affinity MSP shows businesses exactly where they stand against these expectations before an insurer asks.
The ACSC recommends reaching the same maturity level across all eight strategies before progressing to the next level, since strength in one area doesn't offset a gap in another. Affinity MSP audits all eight strategies together so businesses aren't left exposed in the one area they overlooked.
Affinity MSP provides Essential Eight maturity assessments and implementation support for businesses in Melbourne, Sydney, Brisbane, Perth, and Auckland, backed by 14 years of managed IT and cyber security delivery. Every strategy is implemented, monitored, and reported on for as long as a business needs it, with one Australian partner accountable for the whole roadmap.
Find out your
Essential Eight maturity level.
A clear picture of where your business stands and what to prioritise first — across Melbourne, Sydney, Brisbane, Perth and Auckland.
