This Essential 8 checklist is the full Maturity Level One list, all 48 requirements, in the Australian Signals Directorate’s own wording. Nothing is held back behind an email form. If you manage a five person allied health clinic or a small NDIS provider, Maturity Level One is the tier the ASD says may be suitable for small to medium enterprises, and what follows is what it asks of you.
Check the version before you start. The maturity model was last updated on 27 November 2023, and the ASD says legacy versions of it are often no longer fit for purpose. The list below is the current one.
What is the Essential Eight in cyber security?
The Essential Eight is a set of eight mitigation strategies the Australian Signals Directorate recommends as a baseline for internet-connected IT networks. They are application control, patch applications, patch operating systems, restrict administrative privileges, restrict Microsoft Office macros, user application hardening, multi-factor authentication and regular backups.
Sitting over those eight is the maturity model, which defines four levels, Maturity Level Zero through to Maturity Level Three. Level One is aimed at attackers using commodity tools that anyone can download. Someone scanning the internet for an unpatched service. Someone signing in with a password that was stolen, reused or guessed. The ASD is blunt about the motive: these attackers are looking for any victim rather than a specific one.
That distinction matters for a clinic. You are not being singled out. You are being scanned along with everybody else, and Maturity Level One is the tier that makes the scan come back empty.
One more thing about the model, because it changes how you sequence the work. The ASD says to reach the same maturity level across all eight strategies before moving to a higher one. Multi-factor authentication at Level Two and backups at Level Zero is not a strong position with one weak spot. It is a weak position with one good-looking part.
The Essential 8 checklist: all 48 Maturity Level One requirements
Maturity Level One sets out 48 requirements across the eight mitigation strategies. They are not spread evenly. Patch applications carries nine and patch operating systems carries eight, while application control carries three.
The wording below is the ASD’s, unchanged, from Appendix A of the Essential Eight maturity model. The numbering is ours, added so you can point at a line in a meeting without reading the whole sentence out.
| Mitigation strategy | # | Maturity Level One requirement |
|---|---|---|
| Application control | 1 | Application control is implemented on workstations. |
| 2 | Application control is applied to user profiles and temporary folders used by operating systems, web browsers and email clients. | |
| 3 | Application control restricts the execution of executables, software libraries, scripts, installers, compiled HTML, HTML applications and control panel applets to an organisation-approved set. | |
| Patch applications | 4 | An automated method of asset discovery is used at least fortnightly to support the detection of assets for subsequent vulnerability scanning activities. |
| 5 | A vulnerability scanner with an up-to-date vulnerability database is used for vulnerability scanning activities. | |
| 6 | A vulnerability scanner is used at least daily to identify missing patches or updates for vulnerabilities in online services. | |
| 7 | A vulnerability scanner is used at least weekly to identify missing patches or updates for vulnerabilities in office productivity suites, web browsers and their extensions, email clients, PDF software, and security products. | |
| 8 | Patches, updates or other vendor mitigations for vulnerabilities in online services are applied within 48 hours of release when vulnerabilities are assessed as critical by vendors or when working exploits exist. | |
| 9 | Patches, updates or other vendor mitigations for vulnerabilities in online services are applied within two weeks of release when vulnerabilities are assessed as non-critical by vendors and no working exploits exist. | |
| 10 | Patches, updates or other vendor mitigations for vulnerabilities in office productivity suites, web browsers and their extensions, email clients, PDF software, and security products are applied within two weeks of release. | |
| 11 | Online services that are no longer supported by vendors are removed. | |
| 12 | Office productivity suites, web browsers and their extensions, email clients, PDF software, Adobe Flash Player, and security products that are no longer supported by vendors are removed. | |
| Patch operating systems | 13 | An automated method of asset discovery is used at least fortnightly to support the detection of assets for subsequent vulnerability scanning activities. |
| 14 | A vulnerability scanner with an up-to-date vulnerability database is used for vulnerability scanning activities. | |
| 15 | A vulnerability scanner is used at least daily to identify missing patches or updates for vulnerabilities in operating systems of internet-facing servers and internet-facing network devices. | |
| 16 | A vulnerability scanner is used at least fortnightly to identify missing patches or updates for vulnerabilities in operating systems of workstations, non-internet-facing servers and non-internet-facing network devices. | |
| 17 | Patches, updates or other vendor mitigations for vulnerabilities in operating systems of internet-facing servers and internet-facing network devices are applied within 48 hours of release when vulnerabilities are assessed as critical by vendors or when working exploits exist. | |
| 18 | Patches, updates or other vendor mitigations for vulnerabilities in operating systems of internet-facing servers and internet-facing network devices are applied within two weeks of release when vulnerabilities are assessed as non-critical by vendors and no working exploits exist. | |
| 19 | Patches, updates or other vendor mitigations for vulnerabilities in operating systems of workstations, non-internet-facing servers and non-internet-facing network devices are applied within one month of release. | |
| 20 | Operating systems that are no longer supported by vendors are replaced. | |
| Multi-factor authentication | 21 | Multi-factor authentication is used to authenticate users to their organisation’s online services that process, store or communicate their organisation’s sensitive data. |
| 22 | Multi-factor authentication is used to authenticate users to third-party online services that process, store or communicate their organisation’s sensitive data. | |
| 23 | Multi-factor authentication (where available) is used to authenticate users to third-party online services that process, store or communicate their organisation’s non-sensitive data. | |
| 24 | Multi-factor authentication is used to authenticate users to their organisation’s online customer services that process, store or communicate their organisation’s sensitive customer data. | |
| 25 | Multi-factor authentication is used to authenticate users to third-party online customer services that process, store or communicate their organisation’s sensitive customer data. | |
| 26 | Multi-factor authentication is used to authenticate customers to online customer services that process, store or communicate sensitive customer data. | |
| 27 | Multi-factor authentication uses either: something users have and something users know, or something users have that is unlocked by something users know or are. | |
| Restrict administrative privileges | 28 | Requests for privileged access to systems, applications and data repositories are validated when first requested. |
| 29 | Privileged users are assigned a dedicated privileged user account to be used solely for duties requiring privileged access. | |
| 30 | Privileged user accounts (excluding those explicitly authorised to access online services) are prevented from accessing the internet, email and web services. | |
| 31 | Privileged user accounts explicitly authorised to access online services are strictly limited to only what is required for users and services to undertake their duties. | |
| 32 | Privileged users use separate privileged and unprivileged operating environments. | |
| 33 | Unprivileged user accounts cannot logon to privileged operating environments. | |
| 34 | Privileged user accounts (excluding local administrator accounts) cannot logon to unprivileged operating environments. | |
| Restrict Microsoft Office macros | 35 | Microsoft Office macros are disabled for users that do not have a demonstrated business requirement. |
| 36 | Microsoft Office macros in files originating from the internet are blocked. | |
| 37 | Microsoft Office macro antivirus scanning is enabled. | |
| 38 | Microsoft Office macro security settings cannot be changed by users. | |
| User application hardening | 39 | Internet Explorer 11 is disabled or removed. |
| 40 | Web browsers do not process Java from the internet. | |
| 41 | Web browsers do not process web advertisements from the internet. | |
| 42 | Web browser security settings cannot be changed by users. | |
| Regular backups | 43 | Backups of data, applications and settings are performed and retained in accordance with business criticality and business continuity requirements. |
| 44 | Backups of data, applications and settings are synchronised to enable restoration to a common point in time. | |
| 45 | Backups of data, applications and settings are retained in a secure and resilient manner. | |
| 46 | Restoration of data, applications and settings from backups to a common point in time is tested as part of disaster recovery exercises. | |
| 47 | Unprivileged user accounts cannot access backups belonging to other user accounts. | |
| 48 | Unprivileged user accounts are prevented from modifying and deleting backups. |
Working through 48 lines by hand is a slow afternoon. The free Essential Eight Maturity Level 1 assessment walks the same eight strategies in about five minutes and returns a scored result you can forward to a practice partner or a board.
What counts as implemented, and what does not
A strategy counts as implemented at Maturity Level One only when every requirement inside it is met, either directly or through a compensating control that provides an equivalent level of protection. The ASD allows compensating controls. What it asks is that the system owner demonstrates the equivalence rather than asserting it.
The part that catches people is what happens when you decide to skip a strategy outright. Accepting the risk without a compensating control, or buying cyber insurance and treating the matter as handled, does not leave you partially compliant. The ASD’s maturity model FAQ says an organisation that does this will be assessed at Maturity Level Zero for that mitigation strategy and for its overall Essential Eight implementation. One skipped strategy takes the whole result to zero.
If any of the eight is going to be the one under discussion, it is application control. It is genuinely hard on a network that grew one laptop at a time, and the temptation to leave it for next year is real. Leaving it is a decision about the entire rating, not about one strategy.
What an Essential 8 audit will accept as evidence
An Essential 8 audit tests configuration, not intention. The ASD’s Essential Eight assessment process guide sorts evidence into four tiers of quality, and a policy document sits at the bottom of them.
- Excellent evidence: testing a control with a simulated activity, such as attempting to run a test application to check application control rulesets.
- Good evidence: reviewing the configuration of a system through the system’s own interface.
- Fair evidence: reviewing a copy of the configuration, such as a report or a screenshot.
- Poor evidence: a policy or a verbal statement of intent.
The guide does not hedge on the ranking. It says assessments conducted using interviews, reports and screenshots will always be inferior to assessments conducted using scripts and tools, partly because tools examine many machines rather than one sample workstation.
Read that against how a small practice usually prepares. The policy is written, the induction pack mentions it, the practice manager can describe it accurately, and nobody has ever run a test. On the ASD’s own scale that is Poor evidence, and it is the gap that turns a confident self-assessment into a disappointing external one.
How to implement the Essential Eight in a small Victorian practice
Start with the requirements that cost nothing but a configuration change, and sequence them so nothing breaks the clinic at nine on a Tuesday morning. Eight of the 48 requirements sit in restrict Microsoft Office macros and user application hardening, and most of those are a group policy or Intune setting rather than a purchase.
That first block covers blocking macros in files that came from the internet, stopping users changing their own macro and browser security settings, removing Internet Explorer 11, and stopping browsers processing Java and web advertisements. None of it needs a budget line.
Multi-factor authentication comes next. Seven requirements, and they reach further than most people expect, because they cover third-party services holding your data as well as your own systems. Your practice management system, your cloud file storage, your accounting platform. TERU’s identity and access work covers the rollout where a practice has nobody to run it internally.
Then backups, which is six requirements, two of them about whether an ordinary user account can reach, alter or delete the backup. Ransomware operators go looking for exactly that. Test a restore while you are there. Plenty of practices have backups running and no evidence they have ever restored from one, and evidence is what a backup and recovery engagement is meant to produce.
Leave patching and application control until last. Not because they matter least, but because they need tooling and the first three do not. Seventeen of the 48 requirements sit in the two patching strategies, and eight of those assume you own a vulnerability scanner and an automated way to discover assets on your network.
Is the Essential Eight mandatory for health and NDIS providers?
Not by statute, whatever a vendor may have implied. The ASD presents the Essential Eight as a recommended baseline, not a legal requirement. The one place it carries a mandate is the Commonwealth: for non-corporate Commonwealth entities subject to the Protective Security Policy Framework, the ASD says Maturity Level Two is considered a mandatory baseline. A private clinic in Camberwell is not one of those entities.
What does apply is Australian Privacy Principle 11. Under the Privacy Act 1988, an APP entity must take such steps as are reasonable in the circumstances to protect the personal information it holds from misuse, interference and loss, as well as unauthorised access, modification or disclosure. The OAIC’s guidance on APP 11 says those reasonable steps include both technical and organisational measures.
APP 11 does not name the Essential Eight. It does not name any framework at all. That is precisely why the Essential Eight is useful here. Reasonable steps get judged after something has already gone wrong, and the Essential Eight is the closest thing Australia has to a published, technical answer to what reasonable looked like.
The turnover question comes up in almost every first conversation, so here it is. The $3 million small business exemption does not help an allied health clinic. The OAIC states that regardless of turnover, the Privacy Act covers any business that is a health service provider. A two-room podiatry practice carries the same APP 11 obligation as a hospital network.
NDIS providers have a second thread to pull. The information management requirements in the NDIS Practice Standards are tested during registration audits, and the systems and records an NDIS auditor asks for overlap heavily with the eight strategies in this checklist. Work done for one is rarely wasted on the other.
What to do this week
Get one strategy to Maturity Level One properly rather than getting all eight to somewhere.
Open the table above and mark each of the 48 requirements yes, no or not sure. Do no research while you do it. The honest first pass is the valuable one, and the “not sure” rows are its real output. On most first attempts there are more of those than anyone expects.
Take the macro and browser hardening requirements to whoever manages your devices. Eight requirements, one afternoon, nothing to buy. It is the shortest distance between where you are now and a strategy you can defend.
Before the month ends, restore a single file from backup and keep the proof. A screenshot and a date is Fair evidence on the ASD’s scale, which is two tiers above a policy nobody has tested.
If you would rather have the score before that meeting than after it, the free Essential Eight Maturity Level 1 assessment covers the eight strategies and returns a result you can send on.
Last reviewed: 21 September 2026.
This article is general information about the Essential Eight and Australian privacy obligations. It is not legal advice. Confirm your own obligations with the OAIC, the NDIS Quality and Safeguards Commission, or your own adviser, before acting on it.