Lesson 6 of 10 · Track B · · Updated
Choosing an Essential Eight maturity target
The Essential Eight maturity model lets an organisation state how far it has implemented each of the eight strategies. ASD first published it in June 2017 and updates it regularly, most recently with changes in the November 2023 release. You choose a target level based on the threats you face, then implement all eight strategies to that level.
What does the maturity model measure?
The model describes increasing levels of implementation for each strategy, so an organisation can state how far it has gone rather than simply whether a strategy exists. Check the current level definitions on cyber.gov.au before you set a target, because ASD updates the model. The point is to implement the eight strategies together to a chosen level rather than one strategy very well and the rest not at all.
Why does the version matter?
Because the model changes. ASD updates it regularly, and the page we reviewed lists changes from the November 2023 release. When a customer asks about your maturity level, say which version of the model you assessed against. When a vendor says it supports the Essential Eight, ask which version its templates follow.
How do you choose a target?
Start from who asks and why. An Australian customer may state a level in a contract or questionnaire. If none is stated, pick the level that matches the threats relevant to your business and your customers' expectations, and write the decision down with the reasoning, much as you would record a risk acceptance in an ISMS.
How is a level assessed?
ASD publishes an Essential Eight assessment process guide that assessors use to test each strategy. Assessment is about evidence that controls are in place and effective across the environment, so sampling matters. A single well-configured laptop proves little; a report covering the fleet proves more.
How does this connect to ISO 27001?
In an ISO 27001 ISMS, a maturity target is a security goal under clause 6, and the gap to reach it is a set of risk treatments. Recording it that way lets one management system carry both: the ISMS decides and reviews, and the Essential Eight gives the technical baseline and the measure of progress.
What should you tell customers?
Say which maturity level you target, which version of the model you assessed against, when the last assessment took place, and which strategies are below target with a date to close the gap. Customers usually accept an honest gap with a plan more readily than a vague claim of alignment. Keep the answer consistent across questionnaires by writing it once, approving it, and reusing it. A trust center or questionnaire tool helps here, and most vendors on this site describe one.