Essential 8 Has Changed: Here’s What Your Business Actually Needs to Do Now

If you thought you had the Essential 8 cybersecurity framework sorted, it’s worth having another look. The Australian Signals Directorate (ASD) updated the Essential Eight maturity model in November 2023, and the changes are more significant than a lot of Australian businesses realise. For anyone at Maturity Level 1 or aiming for Level 2, the goalposts have moved.

This guide breaks down exactly what changed, what it means for your organisation, and how to close the gap before it becomes a problem.

Quick Summary: What Changed in the Essential 8 Framework

The Essential 8 is a set of eight technical cybersecurity mitigation strategies developed by the Australian Signals Directorate to help organisations protect their systems against the most common cyber threats. It’s built around a maturity model with four levels (0 through 3), where each level of maturity adds more rigour to your defences.

The ACSC updates the Essential Eight Maturity Model annually to assist organisations in protecting their internet-connected IT networks against common cyber threats. The November 2023 revision was more substantial than previous years.

The short version of what changed:

• Patching timelines tightened significantly across all maturity levels
• MFA requirements lifted, with phishing-resistant MFA now required at lower levels
• Administrative privilege controls expanded to cover more systems
• Centralised event log management was introduced as a Level 2 requirement
• Application control rulesets now require annual review at a lower level than before
• Weekly vulnerability scanning replaced fortnightly as the minimum

The proportion of entities that reached overall Maturity Level 2 across the Essential Eight mitigation strategies actually dropped after the November 2023 changes because ASD increased and hardened the controls required to reach Level 2 in response to the threat environment. In 2025, only 22 per cent of government entities reached Level 2, compared to 25 per cent in 2023.

The November 2023 Maturity Level Revision: What’s Different

The Essential Eight maturity model previously had some flexibility around when and how controls were applied at each level. The 2023 revision tightened that up considerably.

Here are the headline changes:

• 48-hour critical patch response: The update mandates a 48-hour response time for critical vulnerabilities across all maturity levels, not just the higher ones.
• MFA is now mandatory: Multi-factor authentication shifted from highly recommended to mandatory for all users with privileged access.
• Weekly vulnerability scanning: Organisations must now scan for critical vulnerabilities and high-risk software at least weekly, replacing the previous fortnightly minimum.
• Application control at a lower level: Annual review of rulesets and implementing Microsoft’s recommended application blocklist is now required at Maturity Level 2 instead of Level 3.
• Incident response plans are now a Level 2 requirement: Developing and maintaining cyber security incident response plans is now a prerequisite for maturity level 2 and higher against most mitigation strategies. 

Business Type	Recommended Level
Small business, low data sensitivity	Level 1
SMB holding personal/sensitive data	Level 2
Enterprise or government adjacent	Level 2 to 3
Critical infrastructure / government	Level 3

Who Is Now Effectively Required to Comply?

The Essential 8 is formally mandatory for non-corporate Commonwealth entities. For private sector organisations, it has historically sat in the “strongly recommended” category. That picture is shifting.

The mandatory ransomware reporting regime commenced on 29 May 2025, requiring organisations with an annual turnover exceeding $3 million to report ransomware payments to the Australian Signals Directorate within 72 hours. Piper Alderman

On top of that, the Privacy Act now explicitly clarifies that “reasonable steps” to protect personal information include implementing technical and organisational measures, effective from December 2024. MinterEllison For any business holding customer data, that wording carries real weight.

The practical upshot: if your organisation holds personal data and generates over $3 million a year, Level 2 compliance is now the sensible minimum. Not because a regulator will knock on your door tomorrow, but because the cost of not complying is rising fast.

The average self-reported cost of cybercrime per report for small businesses rose by 14 per cent to $56,600 in the 2024-25 financial year. That’s the average. Worst-case scenarios look quite different.

The 8 Strategies: Updated Guidance for Each

Here’s what the November 2023 revision means for each of the eight controls.

1. Application Control (Level Requirements Tightened)

Application control restricts which software can run on your systems, blocking unauthorised programs, including malware.

The annual review of application control rulesets and implementing Microsoft’s recommended application blocklist are now both required at Maturity Level 2, previously a Level 3 requirement. Grant Thornton

What this means in practice:

• Review your application control rulesets annually
• Implement Microsoft’s recommended blocklist by Level 2 (not just Level 3)
• Shift from a reactive to a proactive control stance

 2. Patch Applications (New Timelines)

Patching is one of the areas with the most significant change. The previous timelines were already tight; the new ones are tighter.

Organisations must now patch, update or otherwise mitigate critical vulnerabilities within 48 hours. This change impacts Maturity Level One through Maturity Level Three.

• Critical vulnerabilities: patch within 48 hours (all levels)
• Applications interacting with untrusted internet content: patch within two weeks
• Vulnerability scanning: weekly, not fortnightly

For Melbourne businesses running mixed environments with legacy systems, this is often the hardest control to get right. It requires good asset visibility and, usually, automated patch management.

3. Multi-Factor Authentication (Phishing-Resistant MFA Now the Target)

MFA is no longer optional at any level. The question now is what type of MFA you’re running.

The introduction of a minimum standard for MFA at Maturity Level One now requires ‘something users have’ in addition to ‘something users know’, addressing weaknesses in previous MFA implementations.

At Level 2, phishing-resistant MFA methods such as hardware keys or biometrics are required. Standard SMS codes no longer meet the bar.

Key actions:

• Audit current MFA coverage across all user accounts
• Upgrade to phishing-resistant MFA for privileged access and customer portals
• Document your MFA implementation as part of your compliance record

4. Restrict Administrative Privileges (New Level 2 Scope)

Requirements have been updated to include new considerations on controlling privileged access to data repositories, administrative infrastructure and internet-facing services. 

Restricting administrative privileges has also shifted from highly recommended to mandatory. 

This means organisations need to audit who has admin access, remove unnecessary privileges, and implement just-in-time access where possible. For many Melbourne businesses, admin accounts remain one of the most exploited attack paths.

5. Patch Operating Systems / User Application Hardening / Macros / Backups

These four strategies share some common themes from the 2023 update:

6. Operating Systems: The same 48-hour patch rule applies to critical vulnerabilities. Patching has seen changes at each of the three maturity levels, including new requirements for regular vulnerability scanning and stricter timelines.

7. User Application Hardening: An increased focus has been placed on logging of command line processes, including requirements for protection and monitoring of logs at lower maturity levels.

8. Microsoft Office Macros: Microsoft Office macros are now disabled by default to prevent malicious macros from running unless specifically enabled by the user. The focus has moved from logging macro execution to controlling which macros can run at all.

Backups: The November 2023 backup updates encouraged entities to consider the business criticality of their data when prioritising backups, rather than focusing exclusively on what entities consider to be ‘important’ data. Backups must also be tested for restorability.

What Level Should Your Business Be At?

The ACSC guidance is reasonably clear:

Business Type	Recommended Level
Small business, low data sensitivity	Level 1
SMB holding personal/sensitive data	Level 2
Enterprise or government adjacent	Level 2 to 3
Critical infrastructure/government	Level 3

Maturity Level 1 is recommended for most small to medium businesses, Level 2 for larger enterprises, and Level 3 for enterprises or government agencies with more critical infrastructures or higher threat environments. 

With Privacy Act reforms in place and cyber threats escalating, most Melbourne businesses holding customer data should be targeting Level 2. Level 1 is a starting point, not a destination.

The Cyber Insurance Connection: Why Insurers Now Care About Your Maturity Level

This is the angle many businesses haven’t fully considered. Cyber insurance underwriters have started scrutinising security maturity more carefully when assessing claims and premiums.

Insurers increasingly require Essential Eight Maturity Level 2 proof before honouring claims. Businesses that suffer a breach while still at Level 0 or Level 1 may find their claims contested, particularly if the attack vector (like unpatched systems or weak MFA) was directly addressed by the Essential 8 framework.

This isn’t just about compliance. A strong security posture now has direct financial implications beyond just avoiding a breach.

How to Get From Level 0 to Level 2: A Practical Roadmap

Getting from Level 0 to Level 2 is achievable for most Australian businesses. It takes planning, the right tools, and consistent implementation across all eight controls.

Stage 1: Assessment (Weeks 1-4)

• Conduct a current maturity assessment against the updated framework
• Identify your biggest gaps across all eight controls
• Prioritise by risk, not by effort

Stage 2: Foundations (Weeks 4-12)

• Implement MFA across all users, starting with admin and privileged accounts
• Deploy automated patch management for applications and operating systems
• Disable Microsoft Office macros by default, and allow only signed and approved macros
• Set up centralised backup with tested restore capability

Stage 3: Hardening (Weeks 12-24)

• Implement application control with regular ruleset reviews
• Restrict administrative privileges and remove unnecessary admin accounts
• Harden user applications and implement command-line logging
• Set up centralised event log management

Stage 4: Validation (Ongoing)

• Weekly vulnerability scanning as a standard process
• Annual application control ruleset review
• Regular tabletop exercises against your incident response plan
• Ongoing security assessment against the ACSC Essential 8 checklist

The goal is to implement the Essential Eight consistently across all controls to reach your target maturity level, not just tick off individual items.

What an MSP Handles vs What You Handle In-House

Businesses often ask how to divide responsibilities when working with a managed service provider. Here’s the general split:

Your MSP typically handles:

• Patch management automation and deployment
• MFA configuration and admin
• Security monitoring and event log management
• Application control policy management
• Vulnerability scanning and reporting
• Backup management and restore testing

You handle:

• Approving macro and application exceptions
• Reviewing privileged access requests
• Accepting risk on specific decisions
• Training staff on cybersecurity practices
• Cyber risk ownership at the executive level

The right MSP partner, like Telco ICT Group’s managed IT services, will have a structured Essential 8 compliance programme that maps directly to the ACSC framework. If you’re a Melbourne business looking to close your maturity gap, this is the most efficient path.

At Telco ICT Group, we work with Melbourne businesses and organisations across Australia to assess, plan and implement the Essential 8 across all maturity levels. If you’re not sure where your current maturity sits, start with a gap assessment.

Get your Essential 8 gap assessment Today. Talk to our managed IT team

Frequently Asked Questions

What changed in the Essential 8 in 2023?
The November 2023 update tightened patching timelines to 48 hours for critical vulnerabilities, made MFA mandatory, required weekly vulnerability scanning, added centralised event logging at Level 2, and shifted several Level 3 controls down to Level 2.

Is the Essential 8 mandatory for private businesses in Australia?
It is formally mandatory for Commonwealth government entities. For private organisations, it is not legislated directly, but the 2024 Privacy Act reforms and the Cyber Security Act 2024 create strong compliance incentives, particularly for businesses holding personal data.

What is the difference between Essential 8 maturity levels 1, 2 and 3?
Level 1 addresses opportunistic attacks with basic controls. Level 2 targets more targeted threats and requires phishing-resistant MFA, centralised logging and stricter patching. Level 3 is for high-value targets and requires the most rigorous implementation across all eight controls.

How much does Essential 8 Level 2 implementation cost?
Costs vary depending on your current environment, existing tools, business size, and the provider you engage. The most practical approach is to get a gap assessment first, as this gives you a realistic picture of what investment is actually required.

How does the Essential 8 relate to the Privacy Act?
The updated Privacy Act now explicitly requires organisations to take “technical and organisational measures” to protect personal data. The Essential 8 is widely recognised as meeting that standard. For businesses holding customer information, achieving Level 2 is the most defensible approach to demonstrating compliance.