Is the Essential Eight mandatory? Who must comply

Is the Essential Eight mandatory for your organization?

The Essential Eight is mandatory for non-corporate Commonwealth entities subject to the PGPA Act, at Maturity Level 2. Microsoft Learn cites section 14.2 of the Protective Security Policy Framework (PSPF) as the basis for that requirement. For critical infrastructure entities, the Essential Eight is one of several accepted frameworks under the critical infrastructure risk management program (CIRMP) Rules, where Maturity Level 1 is the threshold. Every other organization for which it is recommended is under no legal duty to adopt it, although a customer, regulator or board may still ask for it. Start by confirming which group you belong to, because the obligation depends on your entity type, not on your sector alone.

The Essential Eight is a set of mitigation strategies, not a certification scheme. ASD issues no certificate, so no document from ASD proves that you comply. Your obligation instead defines the evidence you must produce: the maturity level you must reach, the strategies in scope, and the assessment of each strategy's implementation and effectiveness against the maturity model. Ask the requesting party to state the maturity level and the form of evidence they expect, and check whether they accept a self-assessment, an internal review or an independent assessment. Those answers determine the work ahead far more than the framework name does.

If you are a critical infrastructure entity, confirm with your regulator or legal adviser whether your CIRMP relies on the Essential Eight, which of the listed frameworks it accepts as equivalent, and when your compliance window applies. Read the CIRMP Rules text directly for the conditions attached to each option. Commonwealth entities should confirm their current PSPF obligations with their responsible agency. Whichever group you are in, write down the requirement, its owner and the evidence it demands before you scope any technical work.

Who has to implement the Essential Eight and at what level

Non-corporate Commonwealth entities subject to the PGPA Act fall under the Protective Security Policy Framework (PSPF). Microsoft Learn states that Essential Eight Maturity Level 2 is mandatory for these entities, citing section 14.2 of the PSPF. The obligation is to reach and sustain ML2 across all eight mitigation strategies, not to hold a certificate. Entities should be ready to show their assessment results and the evidence behind them to the people who oversee their security reporting.

Level set by the PSPF: The mandatory level is ML2, which includes everything in ML1 plus additional requirements for all eight strategies.
Implementation and effectiveness: The entity must show that each strategy is implemented and that it works as intended, not only that a policy exists.
Evidence trail: Expect to produce scan results, MFA configuration, privileged access records, logs and backup restore test records that map to each ML2 requirement.
Recurring work: Patch cadences, access reviews and restore tests recur, so the evidence must be current when it is requested.
Partner roles: An implementation partner can prepare systems and evidence, but only the entity decides its maturity position and reports against it.

Before relying on this tab, confirm the current PSPF text and any reporting requirements with your agency's security adviser.

How the CIRMP compliance window and equivalent frameworks change the deadline

Under section 8(3) of the Critical infrastructure risk management program (CIRMP) Rules 2023, a responsible entity had 12 months after the end of the applicable period in subsection 4(2) to comply with one of the frameworks listed in the Rules. That window matters more than the framework choice for many organisations, because the date it runs from depends on which period in subsection 4(2) applies to the entity. Start by reading subsection 4(2) against your entity's registration and asset details, then write down the period it points to and the date the 12 months would end. Confirm that reading with the Cyber and Infrastructure Security Centre and your own legal advisers before you commit a plan to it.

Section 8(5) allows an entity to use a framework that is equivalent to one of the listed frameworks, but equivalence comes with conditions. The entity inherits those conditions along with the framework, so an alternative that looks similar to the Essential Eight at Maturity Level One still has to satisfy whatever the Rules attach to it. If you are considering a framework other than the Essential Eight, document the comparison in writing, identify each condition, and ask your legal advisers and the regulator to confirm the equivalence position before you rely on it. Do not treat a vendor's or consultant's statement of equivalence as a determination.

The practical decision is whether the Essential Eight at Maturity Level One fits your existing program, and by when you need evidence that it is in place. Ask your team to map current controls to the Maturity Level One requirements, record which strategies are already met, and estimate the work for the rest. Keep the dates and conditions in a single register that your compliance owner reviews, because a missed window or an unconfirmed equivalence claim is a gap the regulator will ask about. An independent assessor's view can help you test readiness, but the obligation and its interpretation remain with the entity.

What an Essential Eight obligation asks your team to produce

Whether the Essential Eight is required or recommended, the output is the same: a stated target maturity level, evidence for each strategy, and a record that someone reviews it over time. Your organization owns these controls. An implementation partner can prepare systems and evidence, but only an independent assessor issues findings on your maturity.

A stated target maturity level

Write down which maturity level you are aiming for and why. The level decides which ISM Essential Eight profile applies. ML1 covers 46 ISM controls, ML2 covers 87 and ML3 covers 123 in the v2026.09.4 profiles. For Commonwealth entities, confirm with your PSPF obligations whether Maturity Level 2 is expected. For critical infrastructure, confirm which framework and level your CIRMP names.

Evidence for each strategy

Each of the eight mitigation strategies needs evidence of two things: that it is implemented, and that it works as intended. Implementation evidence might be configuration exports or policy records. Effectiveness evidence shows the control operating over time, such as scan results, restore test logs or blocked execution events. Keep both for every strategy, not only the ones that are easy to show.

The ISM profiles as the checklist

ASD publishes Essential Eight ML1, ML2 and ML3 baseline profiles in OSCAL form through the Information Security Manual release. Use the profile for your target level as your working checklist, and map each control to an owner and an evidence source. Confirm the profile version you are testing against, because assessors will ask which release you used.

Named control owners

Assign one accountable person to each strategy and each supporting control. Patching, privileged access, backups and application control often sit across IT operations, security and business teams, so an owner must be able to change the configuration and produce its evidence. Record the owner's name, role and backup contact in the control register, and check that the owners have agreed to the role in writing.

A documented assessment or self-assessment

Because the Essential Eight is not a certification scheme, nothing is issued that you can display as proof. What you hold is a documented assessment: a record of the scope, the level tested, the evidence reviewed, the findings and the gaps. Decide whether an internal self-assessment is enough for your obligation or whether an independent assessor must review it. Ask your regulator or contract owner which they expect.

Recurring reviews and evidence refresh

A level achieved once can slip. Set a review calendar for each strategy: scan cadences, privileged account reviews, application control exception reviews, backup restore tests and profile version checks. Track when each review was last completed and what it found. Ask your implementation partner to set up the schedule and evidence collection, but keep the decisions on acceptable risk with your own staff.

What to confirm with your regulator, contract or counsel

Before you plan any Essential Eight work, resolve four questions. First, which obligation actually applies to you. If you are a non-corporate Commonwealth entity, confirm with your agency how the PSPF requirement for Maturity Level 2 applies to your entity and its systems. If you are a responsible entity under the SOCI Act, confirm which of the five frameworks in your CIRMP you have adopted, because the Essential Eight is only one option. Second, which maturity level the contract, direction or program names, and whether it is a floor or a target. Third, whether a framework other than the Essential Eight is accepted as equivalent, and under which conditions. The CIRMP Rules accept equivalent frameworks, but only with the conditions attached to them, so get that position in writing rather than assuming it.

Fourth, what evidence the requester will accept. Ask whether they expect a self-assessment, an independent assessment, a statement of applicability mapped to the ISM controls, or output from a specific tool. Ask who will review it and how often it must be refreshed. Also confirm the compliance window and whether any transition period applies to your situation, since the dates that matter depend on your entity type and the instrument that binds you. Write the answers down with the name, role and date of the person who gave them.

This page is general information and does not replace legal advice. Interpretation of the PSPF, the SOCI Act and the CIRMP Rules, and of any contractual clause, belongs with your in-house counsel, your regulator's guidance or a qualified adviser. Once those answers are settled, the scope and deliverables of any implementation work can be fixed in writing.

Essential Eight mandatory questions answered

Is the Essential Eight mandatory for private companies in Australia?

For most private companies, no. The Essential Eight is published by the Australian Signals Directorate as a set of mitigation strategies, and the obligation to adopt it comes from a contract, a regulator or a sector rule rather than from the Essential Eight itself. Private organizations usually meet it because a customer, insurer or partner asks for it, or because they choose it as their security baseline. Check each contract and each sector rule that applies to you, because a requirement in a single customer agreement can bind your whole security program to a specific maturity level. If no such requirement exists, the Essential Eight remains a recommended baseline that you can adopt in stages.

Can we get Essential Eight certified?

No. There is no ASD certificate for the Essential Eight, because it is a set of mitigations rather than a certification scheme. Maturity is shown through an assessment of how each of the eight strategies is implemented and how well it works against the maturity model. Any document that claims an official Essential Eight certificate should be treated with caution and checked against what you actually need to show, such as an assessment report or evidence pack prepared for a named requester. Ask your customer or regulator exactly what artifact they expect, and whether an independent assessment is required to produce it.

Do we need Maturity Level 2 or Level 3?

It depends on who is asking and what they require. Non-corporate Commonwealth entities subject to the PGPA Act must meet Maturity Level 2 under section 14.2 of the Protective Security Policy Framework, as Microsoft Learn describes. Critical infrastructure entities that choose the Essential Eight for their risk management program only need Maturity Level 1 under the CIRMP Rules. For everyone else, the target is set by contract or internal risk appetite. Each level adds requirements across all eight strategies, and the ASD ISM Essential Eight profiles list 46, 87 and 123 controls for ML1, ML2 and ML3 in the v2026.09.4 release. Confirm the level in writing before scoping, because moving up a level changes logging, privileged access and backup requirements.

Can an alternative framework satisfy the CIRMP requirement?

Yes, in some cases. Section 8(4) of the CIRMP Rules lets a responsible entity comply with one of five frameworks: AS ISO/IEC 27001:2015, the Essential Eight at maturity level one, the NIST Cybersecurity Framework, C2M2 at Maturity Indicator Level 1, or the 2020-21 AESCSF Framework Core at Security Profile 1. Section 8(5) also accepts a framework equivalent to a listed one, but only with its conditions met. Whether a substitute is truly equivalent is a legal and regulatory question, so confirm it with your regulator or legal counsel before you rely on it. Document the decision and the reasoning in your CIRMP.

Who issues the Essential Eight evidence reports?

The organization owns its controls and its evidence. An implementation partner, such as DeployOpen, can prepare systems, configuration records, logs and test results for assessment. DeployOpen does not issue audit reports, attestations or certifications. An assessor independent of the implementation work is needed when your customer or regulator asks for an independent view. Confirm who the report is addressed to, what level of independence they require, and whether the assessor will test effectiveness as well as implementation for each strategy.

How much effort does Essential Eight take, and what drives it?

No researched figure for effort or cost is available for this page, so treat any number you hear with suspicion until you can trace it. The main drivers are the target level, the size and age of your estate, how many systems you run on unsupported software, how mature your current patching and logging are, and whether identity is already centralized with phishing-resistant multi-factor authentication. Costs have one-time parts (assessment, configuration, backup redesign) and recurring parts (scanning, patch cycles, backup restore tests, reviews). Ask any provider for a written scope that lists each strategy, the level, the systems in scope and the evidence each deliverable will produce.

How DeployOpen prepares Essential Eight evidence for your obligation

DeployOpen starts by confirming which obligation applies to your organization and at what maturity level, because that answer sets the scope. We then prepare the systems and evidence for that level. We do not decide your obligation and we do not issue any assessment result, which remains with your organization and any independent assessor you engage.

How we scope

We confirm which entity type, obligation and maturity level applies, based on your own legal and regulatory advice.
Scope covers the named systems, environments and the eight strategies in the agreed maturity level.
Engagements are fixed-scope, with deliverables and timelines agreed in writing before work starts.

How we build

We implement and configure self-hosted open-source platforms inside your own cloud accounts, data centers or air-gapped networks.
We align controls to the relevant ASD ISM Essential Eight baseline profile for the agreed level.
We test implemented controls for effectiveness and record the results against each in-scope strategy.

How we hand over

We document configurations, owners, procedures and the evidence each control produces, so your team can answer an assessor's questions.
We deliver an evidence register mapping each in-scope control to its supporting artifacts and where they are stored.
Your staff are trained to run the platforms, collect evidence and maintain the records after handover.

How we support

Ongoing support, upgrades and continuous testing are available as a retainer after handover.
A retainer can cover recurring evidence collection, such as patch scan results and backup restore test records.
Ask us to confirm in writing what the retainer includes, how often reviews occur and who owns each recurring task.

Is the Essential Eight mandatory?