The Australian Signals Directorate (ASD) Essential Eight Maturity Model is a set of eight prioritized mitigation strategies that protect internet-connected IT networks against cyber threats. It is mandatory for Non-Corporate Commonwealth Entities (NCCEs).
The Essential Eight is ASD's list of eight mitigation strategies for protecting internet-connected IT networks, with a maturity model to measure how well each is in place. It is mandatory for Non-Corporate Commonwealth Entities (NCCEs).
It is recommended for all Australian organizations. There are three maturity levels: Level 1 (partly aligned), Level 2 (mostly aligned), and Level 3 (fully aligned).
The eight strategies are application control, patching applications, macro settings, user application hardening, restricting admin privileges, patching operating systems, MFA, and regular backups.
Official source: https://www.cyber.gov.au/resources-business-and-government/essential-cyber-security/essential-eight
ThreeShield's CISSP- and CISA-certified assessors run the Australian Essential Eight engagement, and Lavawall® collects the technical evidence continuously, so your posture is current the day an auditor, insurer, or client asks for it, not just at renewal.
| Level | What it covers | Builds on the level below |
|---|---|---|
| Maturity Level 1 | Partly aligned with the intent of the mitigation strategy. Focuses on adversaries using commodity tools and techniques. | — |
| Maturity Level 2 | Mostly aligned. Focuses on adversaries who are more adaptive and willing to invest more effort. Target for most organizations. | Yes |
| Maturity Level 3 | Fully aligned. Focuses on adversaries who are more adaptive and much less reliant on publicly available tools. Target for critical infrastructure. | Yes |
| Australian Essential Eight requirement | Lavawall® collects | ThreeShield delivers |
|---|---|---|
| Multi-factor authentication status | ✓ Continuously | — |
| Patch and vulnerability posture | ✓ Continuously | — |
| Encryption at rest and in transit | ✓ Continuously | — |
| Access and audit-log review | ✓ Continuously | — |
| Risk assessment and scoping | ⚑ Platform data | CISSP/CISA-led |
| Policies, procedures, and evidence package | — | Written by ThreeShield |
Likely, if your organization operates in Australia or in the security sector. The Essential Eight is mandatory for Non-Corporate Commonwealth Entities (NCCEs) and recommended for all Australian organizations. We confirm scope in the first call, at no charge.
A gap assessment against the Essential Eight usually takes a few weeks. Closing the gaps and standing up the evidence takes longer, and that is where most of the work sits, so the total depends on your starting point. Because Lavawall® is already collecting the technical evidence while we work, you do not restart from zero at reassessment.
Yes. Many clients begin self-serve on Lavawall®, then bring in ThreeShield for the assessment, the policies, and the sign-off once they know where the gaps are. The three engagement models below are meant to be moved between.
ThreeShield meets you at your current security maturity. Every level includes Lavawall®.
For lean IT teams and cost-conscious organizations with internal security capacity
Expert guidance alongside your team, ideal for MSPs and organizations with some internal IT capacity
Full compliance delivery, managed end to end by ThreeShield
Choose your engagement model: DIY via Lavawall®, supported by ThreeShield's CISSP/CISA team, or fully done-for-you. Every model includes continuous monitoring, so you stay compliant between audits.
Book a Scoping CallDIY · Supported · Done-for-You