Essential Eight Maturity Level One is the first target level in the Australian Signals Directorate's (ASD) maturity model, built to stop opportunistic attackers who use widely available tools. It asks you to patch on fixed timeframes (48 hours for critical fixes on anything facing the internet), remove unsupported software, use multi-factor authentication on services that hold sensitive data, keep administrator accounts separate, restrict Microsoft Office macros, control what runs on workstations, harden web browsers and keep tested backups. This guide takes each requirement in turn and says who in a small office usually does the work.
For the eight strategies themselves, see our earlier guide, the Essential Eight explained for small business.
The four maturity levels and where Level One sits
ASD's Essential Eight maturity model defines four levels, Maturity Level Zero through to Maturity Level Three. Apart from Level Zero, each is designed around a higher level of tradecraft, ASD's word for an attacker's tools, tactics, techniques and procedures.
| Level | What ASD describes |
|---|---|
| Maturity Level Zero | Weaknesses in the organisation's overall cyber security posture |
| Maturity Level One | Attackers content to use commodity tradecraft that is widely available, looking for any victim: an unpatched online service, a stolen or guessed password |
| Maturity Level Two | Attackers with a modest step-up in capability, willing to invest more time in a target and in their tools |
| Maturity Level Three | Attackers who are more adaptive and much less reliant on public tools and techniques |
Even Maturity Level Three will not stop attackers who are willing and able to invest enough time, money and effort. The Essential Eight is a minimum set of preventative measures: it can help to mitigate the majority of cyber threats, not all of them.
How to choose a target level
ASD says to identify and plan for a target maturity level that suits your environment, then implement each level in turn until you reach it. Two questions help:
- How desirable are you to an attacker? ASD says this influences how likely you are to be targeted.
- What would an incident cost you? ASD ties the consequences to how much you depend on your data staying confidential, and on your systems and data staying available and accurate.
Our view is that Level One is a sensible first target for a small office, because it is written for attackers who look for common weaknesses in many targets.
ASD also advises bringing all eight strategies to the same level before pushing any of them higher.
ASD says there is no requirement to have your Essential Eight implementation certified by an independent party. An independent assessment may be needed where a government directive or policy, a regulatory authority or a contract requires it.
Maturity Level One patching timeframes
A patch is a vendor's fix for a security hole, which the model calls a vulnerability. Internet-facing means reachable from the internet, such as the firewall at the edge of your network. A working exploit is a method of attack that already works against the vulnerability.
| What is patched | Scan for missing patches | Apply the patch within |
|---|---|---|
| Online services | At least daily | 48 hours of release if the vendor rates the vulnerability critical or a working exploit exists; otherwise two weeks |
| Operating systems of internet-facing servers and network devices | At least daily | 48 hours of release if critical or a working exploit exists; otherwise two weeks |
| Office productivity suites, web browsers and their extensions, email clients, PDF software and security products | At least weekly | Two weeks of release |
| Operating systems of workstations, and of servers and network devices that are not internet-facing | At least fortnightly | One month of release |
The clock starts when the vendor releases the patch, not when someone in the office notices it. Level One asks for a vulnerability scanner (a tool that checks devices and software for missing patches) with an up-to-date vulnerability database, and for an automated method of asset discovery, run at least fortnightly, so the scanner knows what exists. Ask your IT provider which tool does each job.
Software the vendor has stopped supporting
At Level One, online services that vendors no longer support are removed. So are unsupported office suites, web browsers and extensions, email clients, PDF software, Adobe Flash Player and security products. Unsupported operating systems are replaced.
That turns end-of-support dates into a planning item. Microsoft's lifecycle page, for example, gives 14 October 2025 as the end of support date for Windows 10 Home and Pro.
The other Level One requirements, and who does them
The first column summarises ASD's requirement; the other two are our suggestions, not ASD's wording. A privileged account is one with administrator rights: it can install software and change settings. A macro is a small program stored inside an Office file.
| Level One requirement | In a small office | Who usually does it |
|---|---|---|
| Multi-factor authentication for staff on your own and third-party online services that process, store or communicate sensitive data | Turn it on for email, accounting, payroll and file storage | The owner lists the services; the IT provider switches it on |
| Multi-factor authentication for customers signing in to online customer services that hold sensitive customer data | Check that your client portal or app asks customers for a second factor | Whoever builds or supplies the portal |
| Privileged access is validated when first requested; privileged users get a dedicated account used solely for privileged duties and kept off the internet, email and web services unless explicitly authorised for online services | Nobody reads email or browses on an admin login; each administrator has a separate, approved admin account | The owner approves; the IT provider sets it up |
| Application control on workstations limits executables, scripts, installers and similar files to an organisation-approved set | Staff computers run software from an approved list and block everything else | The IT provider, with the owner approving the list |
| Macros are disabled for users without a demonstrated business requirement and blocked in files from the internet; users cannot change macro security settings | Ask who needs macros, switch them off for everyone else and lock the setting | A manager names who needs them; the IT provider applies it |
| Internet Explorer 11 is disabled or removed; browsers do not process Java or web advertisements from the internet; users cannot change browser security settings | One managed browser set-up for all staff, with advertisements blocked | The IT provider |
| Backups of data, applications and settings are performed and retained to suit business criticality and continuity needs, kept secure and resilient, and tested by restoring them | Decide what the business cannot lose, then run a restore test | The owner sets priorities; the IT provider runs and tests |
Level One also says what counts as multi-factor: something users have plus something users know, or something users have that is unlocked by something users know or are. A password with a code from a device you hold fits that pattern.
The backup requirement also reaches into account permissions. Unprivileged accounts, meaning ordinary staff logins, must be prevented from modifying and deleting backups. ASD notes that Level One attackers may destroy data, backups included. Our guide to cloud backup and the 3-2-1 rule for small business covers how to set the copies up.
The version on cyber.gov.au when we checked was last reviewed on 27 November 2023. Its Appendix A lists every Level One requirement in full.
Exceptions are allowed, on paper
You may not be able to meet every line straight away. ASD expects a risk-based approach, and it sets out how exceptions should be handled:
- keep exceptions and their scope to a minimum, for example with compensating controls (another safeguard that reduces the same risk);
- document each exception and have it approved through an appropriate process;
- monitor and review the exception, and its compensating controls, on a regular basis.
If a workshop machine runs software that cannot be patched within a month, record why, what you did instead, who approved it and when you will look again.
A working order for a small office
- List what you have: devices, operating systems, applications, online services and who holds administrator rights.
- Mark anything the vendor no longer supports and set a date to remove or replace it.
- Turn on automatic security updates, then agree with your IT provider how the 48-hour, two-week and one-month timeframes will be met and reported to you.
- Turn on multi-factor authentication for every online service that holds sensitive data.
- Give each administrator a separate admin account and remove administrator rights from everyday logins.
- Apply the macro, browser and application control settings to every workstation.
- Run a restore test, and write down every exception with its approval and a review date.
Common mistakes
- Treating Level One as something you buy. No single product delivers it. The requirements cover settings, accounts, timeframes and tested backups.
- Mixing levels. Pushing one strategy to Level Two while multi-factor authentication is still missing elsewhere goes against ASD's advice.
- Forgetting network devices. The operating system of an internet-facing firewall or router falls under the 48-hour timeframe for critical vulnerabilities.
- Unwritten exceptions. An old machine that nobody has documented or approved is a gap, not an exception.
Where Comingwave fits
We are a technology company that works with small and medium businesses, and helping clients apply the Essential Eight is part of our cyber security work. Patching, monitoring and backups run day to day through managed IT support, and choosing a target level and a plan to reach it is an IT consulting job.
To go through where your office stands, ask us for a free first consultation. You receive a written quote before any work starts.
Frequently asked questions
Does a small business need to be certified at Maturity Level One?
No. ASD says there is no requirement to have an Essential Eight implementation certified by an independent party. An independent assessment may be needed if a government directive or policy, a regulatory authority or a contract requires one.
How quickly must patches be applied at Maturity Level One?
Within 48 hours of release for online services and internet-facing operating systems when the vendor rates the vulnerability critical or a working exploit exists, and within two weeks otherwise. Office applications and browsers have two weeks; workstation operating systems have one month.
Can we reach Level One on some strategies and leave the others for later?
You can work through them in stages, but ASD advises achieving the same maturity level across all eight strategies before moving to a higher level.
Does an exception mean we have not met Maturity Level One?
Not by itself. ASD says the appropriate use of exceptions should not preclude an organisation from being assessed as meeting a maturity level. The exception has to be documented, approved, kept as small as possible and reviewed regularly.
Is Maturity Level One enough protection for a small business?
It depends on how attractive you are to attackers and what an incident would cost you. ASD says the Essential Eight is a minimum set of measures and will not mitigate every cyber threat.
Key takeaways
- Maturity Level One is designed for opportunistic attackers who use widely available tools.
- The patching timeframes are 48 hours, two weeks and one month, counted from the release of the patch.
- Unsupported software is removed and unsupported operating systems are replaced.
- Reach the same level across all eight strategies before aiming higher.
- Exceptions are acceptable when they are minimised, documented, approved and reviewed.