Passing an Essential Eight assessment shows where you stood on one day. To stay at your target maturity level, monitor each of the eight strategies against the model's own measures: patch timing, MFA coverage, admin accounts, application control rules, macro settings, hardening, and restore tests. Review exceptions on a schedule.
Why does maturity slip?
The model is a set of measurable statements, such as how often a scanner runs or how fast a patch lands. New laptops, new SaaS tools, staff changes and software updates each push a measure out of line quietly. The assessor sees the result of one sample. You live with the drift for the other fifty one weeks.
The model also changes. ASD says it is updated regularly, so a plan built on a two year old copy can miss new requirements. The copy I could read was an archived one, because the live site blocked automated access. Check the current publication for exact wording before you set thresholds.
What should you measure for each strategy?
Patch applications and operating systems. In the copy I read, asset discovery runs at least fortnightly, scanners run on set schedules (daily for online services), and critical or actively exploited vulnerabilities in online services are patched within 48 hours. Track time from vendor release to patch, per asset group, and count what is overdue.
Multi-factor authentication. Count which online services holding sensitive data enforce it, including third party services. New SaaS tools are the usual leak.
Restrict administrative privileges. At the second maturity level, the copy I read has privileged access disabled after 12 months unless revalidated, and after 45 days of inactivity. A monthly export of admin accounts with last login date makes both easy to check.
Application control. The same level asks for rulesets to be validated at least annually and for allowed and blocked events to be centrally logged. Watch the rate of new exceptions and rule changes.
Restrict Office macros and user application hardening. Check policy settings against a baseline and alert on change.
Regular backups. The copy asks for restoration tests as part of disaster recovery exercises, and for ordinary accounts to be unable to modify or delete backups. Schedule restore tests and keep the result.
How do you handle exceptions?
ASD says organisations should minimise exceptions and their scope, use compensating controls, document and approve each one through a proper process, and review the need for them regularly. It also says appropriate exceptions need not stop you being assessed as meeting a level. Keep an exceptions register with owner, reason, compensating control, approval and expiry date. Review it monthly.
What rhythm works?
Daily and weekly: automated reports for patch status and scan coverage. Monthly: admin account export, MFA coverage check, exceptions review, new SaaS tools list. Quarterly: backup restore test, a sample check of application control rules. Yearly: full self assessment against the current model, ahead of any independent assessment.
ASD says there is no requirement to have an Essential Eight implementation certified by an independent party, but a government directive, regulator or contract may demand an assessment. Know which applies to you.
What to do
- Pick your target maturity level and write it down.
- List each measure in the model and pair it with a data source.
- Automate the reports that can be automated and set alert thresholds.
- Create the exceptions register with expiry dates.
- Put the monthly and quarterly checks in the calendar with named owners.
- Add new tools, hires and leavers to the checks, so changes trigger them.
- Re-read the current model every year and update your measures.
Quick check
Do I have to be independently assessed?
ASD says there is no general requirement, but a government policy, regulator or contract may require it.
Should I move to a higher level as soon as I pass?
ASD says to implement the same level across all eight strategies before moving on. Hold the level first, then raise the target on purpose.
How Safeguard helps automate this
Staying at a level is a monitoring problem. Safeguard's compliance suite covers frameworks, controls, evidence, continuous monitoring, automated tests and questionnaires, so evidence is collected from connected systems and code instead of by screenshot, and monitoring runs continuously between assessments. For the patching strategies, technical evidence comes from your real code and dependencies, using scans, SBOMs and reachability, so you can see which vulnerable packages matter. Safeguard's agent can open tested fix pull requests for vulnerable dependencies. It is off by default, every category starts on Manual, and you choose which categories run automatically and at what approval level. An independent assessor still performs any formal assessment.
Try the framework mapping demo full screen.
Sources
Last reviewed: 18 October 2026.
