Your 2026 guide to complying with the Essential Eight Maturity Model (E8MM)

As Australian government entities and their suppliers face sustained targeting of internet-connected networks, the Australian Signals Directorate's Essential Eight Maturity Model has become the reference standard for how deeply a security control has actually been implemented, not merely whether it exists. Drawn from ASD's Strategies to Mitigate Cyber Security Incidents, the model spans application control, application and operating system patching, Microsoft Office macro settings, user application hardening, restriction of administrative privileges, multi-factor authentication, and regular backups, each assessed across four defined maturity levels.

Maturity Level Two has been mandatory for non-corporate Commonwealth entities under the Protective Security Policy Framework since 1 July 2022, and is the baseline for Defence Industry Security Program membership. Yet Commonwealth reporting shows fewer than a quarter of entities reach it, because an organisation's overall rating is capped by its least-mature strategy. This guide breaks down the model level by level, outlines what your organisation must implement at each one, and shows how ManageEngine solutions help you operationalise and strengthen compliance.

What you’ll learn

• Understand what the Essential Eight covers, which Australian entities are bound by it, and why internet-connected IT networks sit inside its scope while operational technology does not.
• See how the four maturity levels are defined by adversary tradecraft and targeting rather than organisational size, and why a single unmet requirement caps your entire rating.
• Explore the requirements behind multi-factor authentication, restriction of administrative privileges, application control, user application hardening, central event logging, and regular backups at every level.
• Compare what changes between Maturity Levels One, Two, and Three — patching windows of two weeks and 48 hours, phishing-resistant MFA, and centralised logs protected from deletion.
• Learn how identity governance and security monitoring across ManageEngine AD360 and Log360 support privileged access validation, MFA enforcement, tamper-evident log retention, and incident response.