Is Essential Eight ML1 enough for my business?

For most mid-market Australian businesses with no specific regulatory obligation, ML1 is a fair first target, and it answers most 2026 insurance questionnaires. Some sectors are being pushed further. That includes financial services under the Australian Prudential Regulation Authority (APRA), defence supply chains, registered training organisations, and law firms audited by corporate clients. In those, expect the bar to keep moving toward ML2 over the next two years.

Who actually audits Essential Eight compliance?

Nobody from the ACSC will knock on your door. In practice, three groups audit you. Your cyber insurance broker at renewal, your larger corporate clients through their vendor-security checks, and increasingly your own sector regulator. Depending on your sector that regulator is APRA, the Australian Securities and Investments Commission (ASIC), the Australian Skills Quality Authority (ASQA), or a state Law Society. Each scores it their own way, and the Essential Eight is the language underneath all of them.

How does the Essential Eight map to our cyber insurance questionnaire?

It maps closely but imperfectly. Most Australian renewal questionnaires now cover the same ground: multi-factor authentication, patch cadence, admin access, backups and training. Many reference the Essential Eight by name. Your broker scores against their own criteria, and an ML1 business usually clears a renewal without red flags. We've filled in enough of these to know which questions and answers move the premium and which don't.

Do we have to do all eight controls, or can we pick?

The Essential Eight is scored as a package. Your overall maturity is the weakest control, not the average. Being ML2 on seven controls and ML0 on one means you're at ML0 overall. That's deliberate: the controls are designed to work together, and attackers go through the weakest one.

Can you give us a rough budget and timeline for the ML0 to ML1 move?

It depends on where you start and how big the environment is. A mid-market business we haven't worked with before usually assesses mid-ML0, and reaches ML1 within 90 to 180 days of deliberate work. For clients already on our Managed IT Complete stack, ML1 is a level we maintain by default rather than a separate project.

The Essential Eight, and which maturity level your business needs.

Your insurer, your biggest client or your auditor has probably asked about it. The Essential Eight is a control set from the Australian Cyber Security Centre (ACSC), and it is what your business gets scored against. Aim at the right maturity level and most of those questions answer themselves.

The Essential Eight explained

Eight controls that stop most attacks on Australian businesses.

The Australian Signals Directorate publishes and maintains the list through the ACSC. Eight controls are not the whole of cybersecurity, but they are the shared language. Insurers score against them, larger clients ask about them, and regulators reference them. Almost every serious incident post-mortem traces back to one or more of them.

It is the framework you will be asked about, so it is the one our services are built around.

Go to the source

The ACSC's own Essential Eight documents.

If you are producing evidence for a regulator or an auditor, quote from these rather than from us. The ACSC's wording is the one that counts.

Pick a control

Application control, patching, Office macros, hardening, admin rights, multi-factor authentication and backups.

Take the self-assessment

Application control

Only letting approved programs run on your computers. Everything else is blocked by default.

Read the control

Patch applications

Keeping your software up to date so it has the latest security fixes.

Read the control

Configure Microsoft Office macro settings

Stopping the little automation scripts inside Word and Excel from running unless they're from a trusted source.

Read the control

User application hardening

Turning off features in web browsers and Office that attackers commonly abuse.

Read the control

Restrict administrative privileges

Making sure only the people who need admin rights have them, and only when they need them.

Read the control

Patch operating systems

Keeping Windows, macOS, Linux and your server operating systems up to date.

Read the control

Multi-factor authentication

Requiring something more than a password to log in: a code, a key, or an app.

Read the control

Regular backups

Keeping copies of your important data somewhere safe, and regularly testing that you can actually restore them.

Read the control

Maturity levels

Maturity levels ML0 to ML3, and which one your business should aim for.

ML0 to ML3 are the four maturity levels, zero through three. Your overall score is your weakest control, not an average. Aim for the lowest level that satisfies the people auditing you and the people whose data you keep, then add a margin.

ML0 Where most businesses start

Controls partly in place or missing, and no evidence written down. Most mid-market Australian businesses land here before anyone has assessed them properly. Nobody aims for ML0. The question is what a realistic path to ML1 or above looks like.

ML1 If a breach would mostly hurt you, not the people you serve

Controls that stand up to the attack tools anyone can download. Right if you don't keep client information that would do real damage if it leaked. Most cyber-insurance renewals and vendor-security audits now expect this much.

ML2 If a breach would significantly affect others

Controls tuned against attackers who know what they are doing, with admin access properly isolated and evidence you can produce on request. Right for law, finance, health and regulated services. It is the level we build for.

ML3 If you handle classified work or you're a named enterprise target

Central logging of everything an admin does, credentials protected by hardware, and validation that never stops. Built for defence supply chains, classified environments, and businesses big enough to attract an attacker who targets them by name.

Find your level

Which level should you aim for?

Three questions get you most of the way there.

Maturity level picker

Q1Has a defence contractor, classified-information body or named regulator specifically asked you for Essential Eight ML3?

No, nobody has specifically asked.Yes, someone specific has required it.

Q2If your environment were breached tomorrow, who would be harmed?

Only us. Lost revenue and a lot of work, but nobody else is exposed.Our customers would also be significantly harmed.

Q3Do regulators or insurers ask you to prove that your IT controls are working?

No. No regulator or insurer is asking us for that kind of evidence.Yes. At renewal, audit or incident, someone wants evidence.

Your recommended target

Your target level appears here once all three questions are answered, along with the reason for it.

By industry

Which level fits your industry.

ML1
You keep no data that would seriously harm your clients if it leaked. A breach costs you time and money, but nobody else pays for it. Trades, light retail, logistics, marketing and professional services without sensitive client files usually land here. Our Managed IT Complete stack is built to maintain ML1 without you thinking about it.
ML2
You carry information whose exposure would do real harm to your clients, patients, donors or counterparties. Law firms, financial services, accounting, health and allied-health, education, not-for-profits with beneficiary data, conveyancers. Our Managed IT Complete plus Compliance stack is built to reach ML2 and stay there.
ML3
You handle classified or highly sensitive information under a specific obligation: defence supply chain, top-secret work, critical-infrastructure operators. If you're wondering whether ML3 applies, it almost certainly doesn't. The parties who need ML3 have been told so in writing.
ML0
A starting point. If an accurate assessment puts you here, the next question is which of the three levels above your business needs.

Free self-assessment

Score yourself. Get a branded PDF.

Eight questions, your estimated maturity level, a report you can share.

Answer for where you actually sit today, not where you plan to be. You get an estimated maturity level and a CCP-branded PDF you can hand to your board, your broker or your auditor. It runs entirely in your browser. No email required, and nothing reaches us unless you decide to book a call.

Take the self-assessment

Assessment to uplift

What an Essential Eight uplift involves, from assessment to review.

Assess, gap-analyse, plan, uplift, review, then start again. Reaching a maturity level is one job and sustaining it is another, because your staff change, your vendors change and the attacks change. Each pass through the loop, we re-audit against the current bar and step you up from there.

Step 01

Assess where you actually sit.

01 · Assess where you actually sit.

A written audit of your environment against the ACSC criteria, control by control. You get a rating for each of the eight controls, and one overall maturity level set by the weakest of them.

Click any step to read it

Step 01

Assess where you actually sit.

A written audit of your environment against the ACSC criteria, control by control. You get a rating for each of the eight controls, and one overall maturity level set by the weakest of them.

Common questions

What business owners actually ask about the Essential Eight.

Is Essential Eight ML1 enough for my business?: For most mid-market Australian businesses with no specific regulatory obligation, ML1 is a fair first target, and it answers most 2026 insurance questionnaires. Some sectors are being pushed further. That includes financial services under the Australian Prudential Regulation Authority (APRA), defence supply chains, registered training organisations, and law firms audited by corporate clients. In those, expect the bar to keep moving toward ML2 over the next two years.

Who actually audits Essential Eight compliance?: Nobody from the ACSC will knock on your door. In practice, three groups audit you. Your cyber insurance broker at renewal, your larger corporate clients through their vendor-security checks, and increasingly your own sector regulator. Depending on your sector that regulator is APRA, the Australian Securities and Investments Commission (ASIC), the Australian Skills Quality Authority (ASQA), or a state Law Society. Each scores it their own way, and the Essential Eight is the language underneath all of them.

How does the Essential Eight map to our cyber insurance questionnaire?: It maps closely but imperfectly. Most Australian renewal questionnaires now cover the same ground: multi-factor authentication, patch cadence, admin access, backups and training. Many reference the Essential Eight by name. Your broker scores against their own criteria, and an ML1 business usually clears a renewal without red flags. We've filled in enough of these to know which questions and answers move the premium and which don't.

Do we have to do all eight controls, or can we pick?: The Essential Eight is scored as a package. Your overall maturity is the weakest control, not the average. Being ML2 on seven controls and ML0 on one means you're at ML0 overall. That's deliberate: the controls are designed to work together, and attackers go through the weakest one.

Can you give us a rough budget and timeline for the ML0 to ML1 move?: It depends on where you start and how big the environment is. A mid-market business we haven't worked with before usually assesses mid-ML0, and reaches ML1 within 90 to 180 days of deliberate work. For clients already on our Managed IT Complete stack, ML1 is a level we maintain by default rather than a separate project.

The qualifier

Let's see if we're a fit.

Seven questions, one moment of your time. We'd rather tell you now than three months in.