Essential Eight assessment and Essential Eight maturity assessment work in 2026 must account for ASD's proposed Essentials series consultation (opened 15 June 2026) while the current Essential 8 maturity level 2 model remains published. This guide covers Essential Eight gap analysis, Essential Eight compliance Australia evidence expectations, and Essential Eight remediation / uplift engineering, with remote delivery and Australian residency where required. We are not IRAP assessors.
2026 update: evolve the programme, do not pause it
ASD's Essentials consultation does not pause ML2 uplift. Until final guidance lands:
Continue closing ML1/ML2 gaps: controls still address real attack paths
Version the assessment model and guide date used
Map requirement → enforcement point → evidence for Essentials remapping
Avoid policy-only remediation: live enforcement survives framework changes
What ML2 actually represents
ASD defines four maturity levels. ML2 targets step-up actors beyond commodity attacks.
- Achieve the same maturity level across all eight strategies before claiming that level
- No universal independent certification, though regulators or contracts may require one
A system with strong MFA but weak patching is not “ML2 because identity is ML2”.
ML1 vs ML2: what changes in practice
ML1 often means foundational controls exist but evidence is thin: policies without timestamps, partial MFA coverage, informal patching.
ML2 adds measurable operational requirements: defined patch windows, phishing-resistant MFA, privileged-access lifecycle, application control on workstations and internet-facing servers, hardened Office/browser/PDF config, central logging, protected backups with restore tests.
Assessors need timestamped scanner history, IdP policy plus sign-in logs, PAM exports, blocked-execution tests, not screenshots alone.
Evidence assessors test at ML2
| Strategy | ML2 themes | Evidence to produce |
|---|---|---|
| Patch applications | Scanning cadence, critical patch windows | Scanner history, vuln age, patch records |
| Patch operating systems | Internet-facing daily scan | OS inventory, compliance, exceptions |
| MFA | Phishing-resistant MFA, central auth logging | IdP policy, live login test, SIEM events |
| Restrict admin privileges | Revalidation, inactive disable, jump hosts | PAM exports, admin event logs |
| Application control | Workstations + internet-facing servers | Policy, blocked-execution test, logs |
| Restrict Office macros | Business-need only, internet macros blocked | Group Policy/MDM, test document |
| User app hardening | Browser/Office/PDF, PowerShell logging | Live config, process-creation events |
| Regular backups | Secure retention, restore tests, ACL separation | Job history, restore report |
Central SIEM, endpoint, vuln management, IAM/PAM and backup platforms generate reusable evidence. See SOC automation evidence for audit-grade artefact design.
Essential Eight uplift services: practical sequence
ASD ranks evidence: simulated tests / live config (strongest) → screenshots → policy (weakest).
Week 1–2: scope boundary, maturity snapshot, Essential Eight gap analysis
Week 3–6: close enforcement gaps (MFA, patching telemetry, admin lifecycle, logging)
Week 7+: simulated tests, retest pack, Essentials transition mapping
Delivery uses AEST/AEDT overlap with architectures that keep production data in Australian Regions when required. See Australia hub and residency guide.
Readiness checklist
- Define assessment boundary and target maturity level
- Map each strategy to enforcement point and evidence artefact
- Record ASD guide version used in the assessment
- Close ML1 gaps before claiming ML2 on any strategy
- Run simulated control tests for weakest strategies
- Prepare Essentials remapping register for 2026 transition
Limitations
Not legal advice. No ASD endorsement claimed. IRAP assessments are out of scope. Essential Eight gap assessment and uplift engineering only.
Sources: ASD Essential Eight, verified 8 August 2026.
Next step: Scope Essential Eight gap assessment · E8 assessment pillar · Australia hub
