When a customer asks about the Essential Eight, answer per strategy with a maturity level, an assessment date and a pointer to evidence. Say "not assessed" where that is true. Maturity Level Zero is a real answer, and it is better than an inflated Level Two that falls apart on the first follow-up.
What are they really asking?
The Essential Eight is a set of mitigation strategies published by the Australian Signals Directorate through its Cyber Security Centre. A maturity model scores each strategy from Level Zero to Level Three, where Zero captures cases that do not meet Level One. A questionnaire that names it wants to know where you stand on each of the eight, not whether you "follow" it.
Our research found several versions of the model on cyber.gov.au (2022, 2023 and 2024 documents) with different wording. The November 2023 update, for example, changed the trigger for the 48 hour patching timeframe to a vendor critical rating or a working exploit. Ask the customer which version they use and state yours.
How should you structure an answer?
Use one line per strategy. The strategies are application control, patching applications, configuring Microsoft Office macro settings, user application hardening, restricting administrative privileges, patching operating systems, multi-factor authentication and regular backups.
| Strategy | Level | Assessed on | Evidence |
|---|---|---|---|
| Patch applications | ML1 | 2026-09-15 | Fortnightly scan reports, patch ticket sample |
| Multi-factor authentication | ML2 | 2026-09-15 | Identity provider policy export |
| Regular backups | Not assessed | n/a | Planned for next quarter |
The two columns that matter most are "Assessed on" and "Evidence." They turn a claim into something a reader can verify, and they stop you from drifting into marketing.
Who should assess the level?
The Cyber Security Centre publishes an assessment process guide, and its FAQ covers assessing the model. If the questionnaire is for a government supplier, ask whether self-assessment is acceptable or whether an independent assessor is expected. Do not describe a self-assessment as an independent one.
Where does software supply chain evidence fit?
Several strategies depend on knowing what software you run and whether it is current. Safeguard's Essential Eight framework page describes six requirements a scan checks against the software inventory: a list of components backing application control, installed versions recorded so applications can be patched on time, exact versions instead of floating specifiers, standard identifiers such as PURL or CPE so components match advisories, integrity hashes, and a named system for the inventory. It also lists 18 catalog controls across the strategies, including application control, patching, macros, user application hardening, administrative privileges, operating system patching, MFA and backups, which you evidence yourself with tests, uploads, policies or an attestation. The page notes that no automated tests map to this framework directly.
An inventory helps "patch applications" and "application control" answers. It says nothing about macros, MFA or backups, so do not stretch it.
What should you avoid saying?
- "We are Essential Eight compliant." The model has levels, and compliance with it is not a pass or fail certificate.
- "Level Three" without evidence for every control at Levels One and Two for that strategy.
- "Fully automated." Some controls need a human, such as reviewing privileged access.
- Anything that implies a tool or scan result is a certification. A readiness score is not an audit opinion.
What to do
- Ask which version of the maturity model the customer uses.
- Assess each of the eight strategies, and record the level and the date.
- For each level you claim, attach one piece of evidence a stranger could read.
- Mark gaps as "not assessed" or "Level Zero" and add a plan with a date.
- Reuse the same table for every customer so answers stay consistent.
Quick check
Is Maturity Level Zero a failure?
It means the Level One requirements are not met. It is an honest answer and a starting point, not a reason to avoid the question.
Can a scan prove Essential Eight maturity?
Only parts of it, such as component inventory and version visibility. Controls like MFA, macros and backups need your own evidence.
Sources
- Australian Cyber Security Centre, Essential Eight
- Essential Eight assessment process guide
- Essential Eight maturity model changes
- Safeguard docs, Australia Essential Eight framework
Last reviewed: 18 October 2026.
