The Essential Eight is a baseline of eight cyber security mitigation strategies published by the Australian Signals Directorate through its Cyber Security Centre. It is measured with a maturity model from level zero to three. Independent certification is not required, though a government directive, regulator or contract may demand an assessment.
What is the maturity model?
The model has four levels, Maturity Level Zero through Maturity Level Three. Level zero signals weaknesses in an organisation's overall cyber security posture. Each higher level is designed against more capable adversaries, measured by their tools, tactics and techniques and by how precisely they target you.
The Cyber Security Centre says to pick a target level that fits your environment and work toward it. It also says to reach the same level across all eight strategies before moving up. That rule is easy to miss. A team that is excellent at one strategy and weak at another is still held to its weakest result.
Who needs it?
The short answer is that it is a recommendation unless someone with authority makes it a requirement. The Centre states that there is no requirement for organisations to have their implementation certified by an independent party. An assessment can still be required by a government directive, a regulator or a contract.
So the practical test is a question to ask your own stakeholders: does a customer contract, a procurement rule or a regulator name the Essential Eight or a maturity level? If yes, ask who assesses and against which version of the model. If no, treat it as a well regarded checklist you can borrow.
If you sell to Australian government or to organisations that supply it, expect questionnaires that ask which level you have reached.
What are the limits?
The Centre is direct about this. Maturity Level Three will not stop malicious actors that are willing and able to invest enough time, money and effort. The Essential Eight also does not cover every threat. The wider guidance on strategies to mitigate cyber security incidents and the Information Security Manual still apply.
The strategy names and the level by level requirements are in the maturity model document on the Cyber Security Centre site. We did not reproduce them here, and you should work from the current edition because the model is updated over time.
Where does software supply chain work fit?
Several of the strategies are about reducing what an attacker can exploit on the endpoints and servers you run, which includes keeping software patched. For teams that build software, that has a second face: the libraries in your own products need the same discipline. An inventory of components and a record of when fixes were applied is the evidence an assessor will ask for on the patching side. Safeguard can generate that inventory and track vulnerability findings, but the assessment itself belongs to your assessor.
What to do
- Find out whether a contract, regulator or directive names the Essential Eight for you.
- Download the current maturity model and note its edition date.
- Choose a target level and write down why.
- Score each of the eight strategies against that level, honestly, using the assessment guidance.
- Plan work so that all eight reach the target together.
- Keep evidence with dates, because assessors ask for proof, not statements.
Quick check
Is the Essential Eight mandatory?
Not as a general rule. The Cyber Security Centre says certification is not required, but a directive, regulator or contract can require an assessment.
Does reaching level three make us safe?
No. The Centre says level three will not stop determined actors with enough resources, and the model does not cover every threat.
Sources
Last reviewed: 18 October 2026.
