Planning movement between Essential Eight maturity levels: choosing a target level, what changes from ML1 to ML2 and ML2 to ML3, the logging that ML2 makes central, and the recurring tasks that keep a level once it is reached.
How to pick a target maturity level: what each level is designed to stop, external drivers such as the PSPF and CIRMP Rules, the size of the control set at each level, and why levels build on each other.
What changes between ML1 and ML2 across the eight strategies: phishing-resistant MFA for all system users, central logging, privileged access expiry and jump servers, wider application control, macro and backup restrictions, and scanning of other applications.
What ML3 adds over ML2: faster patching for internal systems, driver and firmware patching, just-in-time administration and credential protection, MFA for data repositories, log analysis on all servers and workstations, legacy framework removal and immutable backups.
Every logging requirement in the Essential Eight in one place: which events must be centrally logged at ML2, log protection, timely analysis of internet-facing server logs and, at ML3, all servers and workstations, plus incident reporting.
The recurring work that keeps an Essential Eight level after an uplift: scanning cadences, annual ruleset and trusted publisher reviews, privileged access expiry and revalidation, restore tests, and monitoring for configuration drift.
Tell us what you're working on, whether it's a deployment, an audit, a security test or a cyber range. You'll speak with an engineer who can help you scope it.