A 12 week calendar to reach Essential Eight Maturity Level One runs like this: weeks 1 and 2 scope and inventory, weeks 3 to 10 implement the eight strategies in pairs, weeks 11 and 12 test and report. The sequence is our planning template, not an official ASD timeline, and the exact requirements come from the current maturity model.
Read this first
ASD's assessment guide says the Essential Eight is implemented and assessed as a package, and that you should show Maturity Level One before aiming at Level Two. The cyber.gov.au pages blocked our fetch, so we used the 2022 assessment guide as reproduced by the Western Australian Cyber Security Unit. The maturity model has been revised since, so take control wording and timeframes, such as patching windows, from the current model. We give none here.
Weeks 1 and 2: scope, inventory, baseline
Write the boundary statement and exclusions with reasons. Build an inventory of workstations, servers and network devices, with operating system and owner. Run a baseline check of each strategy against the current Level One text and record the gaps. Pick the evidence method for each strategy: ASD ranks scripted testing and live configuration review above screenshots, and policy statements as poor evidence.
Weeks 3 and 4: patching, both kinds
Patch applications and patch operating systems share the same machinery: inventory, a scanner that finds missing patches, a process to apply them and a rule for unsupported software. Set up scanning, define timeframes from the current model, and remove or isolate products no longer supported. Record first scan results and the plan for each exception.
Weeks 5 and 6: multi-factor authentication and administrative privileges
Enforce MFA for the services the model names, such as remote access and important data repositories. Review who has administrative rights, remove what is not needed, create separate admin accounts used only for admin tasks, and stop admins browsing the web or reading email from privileged accounts. Keep before and after lists of privileged accounts.
Weeks 7 and 8: application control and user application hardening
Define the rules for what may execute on workstations, and begin in audit mode so you can see what would be blocked before you enforce. Then harden user applications: configure browsers and document readers to restrict risky features per the current text. Test with a harmless simulated activity, which ASD counts as excellent evidence.
Weeks 9 and 10: Office macro settings and regular backups
Configure Microsoft Office macro settings through central policy and verify with a test macro. Set up backups of important data, software and configuration, protect them from modification by ordinary accounts, and perform a restore test. Record the restore results.
Week 11: test like an assessor
Pick a representative sample of workstations, servers and network devices. Use scripts or tools to check settings across many machines. Record outcomes using ASD's terms: effective, ineffective, alternate control and others in the guide. Raise tickets for each failure.
Week 12: report and decide
Write the assessment report: scope and exclusions, method and sample sizes, findings per strategy, exceptions with approvals and compensating controls, and next steps. Decide whether to pursue an external assessment or aim at Level Two later.
Realism checks
Twelve weeks assumes a few hundred machines, one identity platform and a team that can dedicate time. Large estates, unmanaged devices and legacy systems extend it. Run the calendar as a template and move work between weeks, but keep the order of scope first and testing last.
What to do
- Assign one owner per strategy and a programme lead.
- Fill the calendar with real dates.
- Hold a weekly 30 minute checkpoint and track exceptions.
- Keep dated evidence for each strategy as you go.
- Re-read the current maturity model at the start of week 3.
- Reserve week 11 for testing, even if implementation slips.
Quick check
Is 12 weeks guaranteed?
No. It is a planning template. Your estate size and starting point decide the real timing.
Can I do the strategies in any order?
Yes, but all eight are assessed together for the target level. Scoping and inventory come first.
How Safeguard helps automate this
The calendar's weak point is evidence that must be refreshed after each change. Safeguard's compliance suite covers frameworks, controls, evidence, continuous monitoring, automated tests and questionnaires, so evidence is collected from connected systems and code instead of by screenshot, and monitoring runs continuously after week 12, which saves your team time for other work. For application patching, technical evidence comes from your real code and dependencies: scans, SBOMs and reachability. Autonomous remediation can open tested fix pull requests for vulnerable dependencies; it is off by default, every category starts on Manual, and you choose which categories run automatically and the approval level. Safeguard does not assess you or guarantee a maturity level. Book a call.
Sources
- Essential Eight Assessment Process Guide 2022, reproduced by the WA Cyber Security Unit
- ASD Essential Eight Maturity Model: blocked for our fetch; check current requirements here.
Last reviewed: 18 October 2026.
