Essential Eight Compliance for Australian Businesses: How a Cost-Optimised MSSP Can Help You Achieve Maturity Level 2

Primary Guard · July 12, 2026 · 5 min read

The ASD Essential Eight is now Australia's de facto cybersecurity baseline. This guide covers what ML2 requires and how a cost-optimised MSSP closes the gap at 40-60% below local MSSP pricing.

Last updated: 28 October 2026

Many Australian organisations now face one question in tenders and supplier checks. It is: "What is your Essential Eight maturity level?" Maturity Level Two (ML2) is a common target. This guide explains what ML2 involves, where small IT teams get stuck, and how a managed provider can help.

What the Essential Eight is

The Essential Eight is a set of eight mitigation strategies from the Australian Signals Directorate (ASD). ASD scores each strategy from Maturity Level Zero to Three. Higher levels mean stricter controls and stronger proof that they work. The eight strategies are:

  • Application control
  • Patch applications
  • Configure Microsoft Office macro settings
  • User application hardening
  • Restrict administrative privileges
  • Patch operating systems
  • Multi-factor authentication (MFA)
  • Regular backups

What Essential Eight Maturity Level Two asks for

ML2 raises the bar on speed and evidence. The examples below come from ASD's mapping of the Essential Eight to the Information Security Manual (ISM).

Patching. Patches for office suites, browsers, email clients, PDF software and security products go on within two weeks of release. Other applications go on within one month. Patches for online services go on within 48 hours when the vendor rates the flaw as critical or a working exploit exists.

Multi-factor authentication. MFA used by people who sign in to online services and systems must be phishing-resistant.

Administrator access. Privileged access is disabled after 12 months unless someone revalidates it. It is also disabled after 45 days of inactivity. Administrative work is done through jump servers, which act as a controlled entry point for admin tasks.

Application control. It must run on workstations and internet-facing servers. The rules must be validated at least once a year.

Backups. Restores of data, applications and settings must be tested as part of disaster recovery exercises. Regular user accounts cannot change or delete backups. Admin accounts cannot either, apart from dedicated backup administrators.

Where mid-sized teams get stuck

Most gaps come from time and proof, not from missing tools. A small IT team may struggle to meet two-week and 48-hour patch windows every month. Evidence is often spread across several tools, so nobody can show scan reports and patch records in one place.

Admin accounts also grow over time, and nobody reviews them. Backups run every night, but restores are never tested. An assessor will ask for evidence, so a missing record counts as a gap even when the work was done.

A simple way to start

You do not need to fix all eight strategies at once. Begin by listing your systems, including internet-facing services and admin accounts. Then check each strategy against ML2 and mark the gaps.

We suggest starting with patching and MFA, because they cover your most exposed systems. Next, keep scan reports, patch records and restore test results in one place. Review progress every quarter against ASD's latest guidance.

What is changing in 2026

ASD last updated the Essential Eight maturity model in November 2023. In June 2026, ASD consulted on a broader "Essentials" series, and the consultation closed on 12 July 2026. ASD also told iTnews that it expects to start deprecating the Essential Eight in about 12 months and retire it in about 24 months.

Industry reports say ASD published the first Essentials chapters on 15 October 2026. The Essential Eight stays in use during the transition, so ML2 work still counts. Check your controls against the new Essentials rather than assuming a one-to-one match.

How Primary Guard helps

Primary Guard supports Australian businesses from Malaysia with a cost-optimised managed service model. We can run a gap assessment against ML2, so you know where you stand first. We can also monitor your environment through our managed SOC service and tighten admin access and MFA with JumpCloud.

Incident reporting rules matter too. See our guide on ransomware payment reporting in Australia, or read more about our work with Australian organisations. Not sure where your gaps are? Request your complimentary gap assessment to start the conversation.

Frequently asked questions

What does "phishing-resistant" MFA mean?

It means the sign-in cannot easily be tricked by a fake login page or by someone persuading you to share a code. Hardware security keys and passkeys are common examples. Codes sent by SMS are weaker.

How long does it take to reach ML2?

It depends on your starting point and the size of your IT team. A gap assessment shows which of the eight strategies need the most work, and that sets a realistic timeline.

Can an offshore managed provider help with Essential Eight?

Yes, for monitoring, patch reporting, identity controls and evidence collection. Some tasks still need your own staff, because they happen on your own systems.

Key takeaway

ML2 is mostly a question of speed and proof. Start with a gap assessment, fix the patching and MFA gaps first, and keep your evidence in one place.

Sources

ASD, Essential Eight maturity model and ISM mapping (Oct 2026) | ASD, Consultation on evolution of Essential Eight (Jun 2026) | iTnews, ASD to retire Essential Eight (Jun 2026) | Microsoft Learn, Essential Eight patch applications (2024) | ITWire, Essential Eight: what applies now (2026)

This article is general information, not legal or compliance advice. Check ASD's current Essential Eight guidance before you plan your scope.