Essential Eight maturity, strategy by strategy.
Assess the eight mitigation strategies against the Australian Signals Directorate's November 2023 maturity model, requirement by requirement, see the level each strategy truly reaches, and work the gaps through remediation, patch windows and recurring checks until the next assessment.
Supported in
- Book with Perth (WhatsApp)
Australia · Whitesec AU, Perth
Essential Eight uplift following ACSC guidance, with Whitesec AU in Perth.
About the standard
The Essential Eight is the Australian Signals Directorate's baseline of eight mitigation strategies, assessed against a maturity model from Level Zero to Level Three. Each level is built to withstand a more capable adversary, and the ASD advises reaching a level across all eight strategies before moving to the next.
Whitesec One holds the ASD's requirements for each level and records an outcome for every one. A strategy's level is the highest at which it and every level below are fully met, and the organisation's level is the lowest across the eight, never an average.
What the workspace does
Scope and targets
A scope statement in the ASD's wording, an organisation target from Level One to Level Three with a date and justification, and a target per strategy that needs its own justification when it differs.
Requirement-level assessments
Each requirement is recorded as effective, alternate control, ineffective, no visibility, not implemented or not applicable, with evidence quality and test method, against a named version of the criteria.
Maturity that cannot be rounded up
A level is met only when every requirement at it is effective or covered by an alternate control, and multi-factor authentication, administrative privileges, application control and user application hardening are held at Level One until an incident response plan is linked.
From gap to remediation
Requirements not yet met are prioritised by the size of the gap and turned into remediation actions with owners and dates, which can raise corrective actions on the shared ISO 27001 register.
Patch windows from the release date
Each window is worked out from the date the fix was released: 48 hours, two weeks or one month, depending on the asset, the severity and your target level, and accepting the risk on a patch needs a second person.
Evidence and recurring checks
Evidence by strategy with expiry tracking, a compliance calendar for recurring patching, scans, reviews, tests, backup verification and access reviews, and five exportable reports.
How the workspace runs it
Group by group, in the order the application presents them, with the pages each group contains.
- 01
Maturity
Scope and targets, the eight strategies with their recorded and assessed levels, the versioned criteria, assessments that move from draft to review to complete, gap analysis and the remediation plan.
- Scope and targets
- Mitigation strategies
- Maturity criteria
- Maturity assessments
- Gap analysis
- Remediation plan
- 02
Operations
The patch register with its window rules, evidence with expiry dates, and the compliance calendar of recurring activities.
- Patch register
- Evidence
- Compliance calendar
- 03
Reporting
Maturity by strategy, assessment history, evidence coverage, strategies below target and patching against the ASD windows, each exportable.
- Reports
The eight mitigation strategies
- 1
Patch applications
Apply security updates to applications and drivers within set timeframes, and remove applications that are no longer supported.
- 2
Patch operating systems
Apply security updates to operating systems and firmware within set timeframes, and replace versions that are no longer supported.
- 3
Multi-factor authentication
Require stronger sign-in for users and administrators of online services and important data repositories.
- 4
Restrict administrative privileges
Validate, limit and review privileged access, and keep privileged accounts away from email and web browsing.
- 5
Application control
Allow only approved programs, scripts and libraries to run on workstations and servers.
- 6
Restrict Microsoft Office macros
Block macros from the internet and allow only trusted, vetted macros to run.
- 7
User application hardening
Harden web browsers, office and PDF software, and turn off features that are not needed.
- 8
Regular backups
Back up important data, software and configuration settings, and test that they can be restored.
Controls built into the workspace
Rules the application enforces, so the records stand up when an auditor tests them.
- Completing an assessment, approving an exception, accepting the risk on a patch and deferring a remediation action each need a second person.
- An assessment can be completed only when every requirement in scope has an outcome.
- Exceptions expire within 365 days and are flagged 30 days before they lapse.
- A completed assessment and its results are frozen.
What you hand the auditor
- Maturity assessment by strategy and requirement
- Gap analysis with priorities
- Remediation plan
- Patch register against the ASD windows
- Evidence by strategy
- Five exportable reports
Shared with the other workspaces
The Essential Eight keeps its own evidence and patch register. It reads your incident response plan from the shared document library, links assets and risks from the ISO 27001 registers, and raises corrective actions on the shared register.
Questions about Essential Eight
Which version of the maturity model does it use?
The ASD Essential Eight Maturity Model of November 2023, and each assessment records the version of the criteria it was made against.
Is overall maturity an average of the eight strategies?
No. Your overall level is the lowest level reached across the eight strategies, in line with the ASD's advice to reach a level across all eight before moving up.
Does it scan our systems?
No. Whitesec One records assessments, evidence and patch status; it does not connect to or scan your environment.
See your own registers in Whitesec One.
We walk through the workspaces for the frameworks you need, with the team in Jakarta or Perth.