The Australian Cyber Security Centre (ACSC) doesn’t just provide eight controls—it categorizes the implementation of these controls into distinct Maturity Levels. Understanding these levels is crucial for balancing your cyber security investment with your actual risk profile.
The Maturity Levels Explained
- Maturity Level 0 (ML0): Indicates significant weaknesses in your cyber security posture. If your organization scores ML0, you have foundational vulnerabilities that leave you highly susceptible to common attacks.
- Maturity Level 1 (ML1): The baseline for most SMEs. ML1 focuses on mitigating the risk of opportunistic adversaries who use publicly available tools to find vulnerable targets. If you want a basic, solid defense, ML1 is your starting point.
- Maturity Level 2 (ML2): Designed to protect against adversaries who have more time and resources. They might target specific businesses using phishing designed to deceive employees. Medical, legal, and financial SMEs should aim here.
- Maturity Level 3 (ML3): The gold standard. ML3 mitigates attacks from highly sophisticated, state-sponsored adversaries. These attackers use custom malware, advanced techniques, and deep patience. Government contractors and critical infrastructure providers typically mandate ML3.
How is the Overall Level Calculated?
A crucial rule of the Essential Eight is that your overall maturity level is determined by your lowest-scoring control. If you are ML3 in seven controls, but only ML1 in "Patching Applications," your organization is officially rated at ML1. Weak links break the chain.
What is Your Target Level?
Don't just guess your maturity. Discover your current and target levels by taking our Free Essential Eight Assessment. Find out which control is holding you back from achieving ML2 or ML3!