Somebody has told you your business needs to reach Maturity Level 1: a client’s procurement team, an insurance renewal form, a head contractor. What none of them supply is a plain answer to the next question. What does that actually involve, and how long will it take?
This page sets out every Maturity Level 1 requirement across all eight strategies in plain language, with an honest view of which parts are quick and which are genuine work. Read the strategy that concerns you and skip the rest. Requirements are restated in everyday language from the Essential Eight maturity model published by the Australian Signals Directorate; that page carries the authoritative wording. If the framework is new to you, start with our guide to what the Essential Eight is.
What the maturity model is, and why it starts at zero
ASD defines four maturity levels, Zero through to Three. Level Zero is not a starting grade you graduate from. It exists to capture the situation where the Level One requirements have not been met. Miss one requirement in one strategy and that strategy is at Level Zero.
The levels above zero are built around increasing attacker tradecraft and targeting, not business size or budget. Level One addresses the widely available techniques most opportunistic attacks rely on, which is why it suits most small businesses: not because it is a beginner tier but because it matches the threat they face.
Two pieces of ASD guidance shape the approach. Identify a target maturity level suitable for your environment and progressively implement each level until you reach it. And because the eight strategies complement each other, plan to achieve the same level across all eight before moving up. A business at Level Three on backups and Level Zero on multi-factor authentication is weaker than one sitting evenly at Level One.
A scope note that saves wasted effort: ASD states the Essential Eight was designed to protect internet-connected information technology networks, not enterprise mobility or operational technology networks. Laptops, phones, servers, cloud services and your website are in scope; machinery controllers and site cameras generally are not.
Who Maturity Level 1 is aimed at
For private businesses, no level is legally required. Maturity Level Two is the mandatory baseline for Australian non-corporate Commonwealth entities under the Protective Security Policy Framework — federal departments and most Commonwealth agencies. Everyone else encounters the Essential Eight through contracts, tenders, insurance and client due diligence, which we cover in is the Essential Eight mandatory?.
Level One is normally right if you have no dedicated security team, if a client or insurer asked without naming a level, or if you have never formally assessed before. If a contract specifies Level Two, note that ASD’s assessment guidance says you should not be assessed against Level Two until Level One has been demonstrated. Level One is the path either way.
ASD also states there is no requirement to have an Essential Eight implementation certified by an independent party, although independent assessment may be required by a government directive, a regulator or a contract. For most small businesses, a documented self-assessment with evidence behind it is what is being asked for.
The eight strategies at Maturity Level 1
The summary first, then each strategy in detail below.
| Strategy | What Maturity Level 1 requires, in short |
|---|---|
| Patch applications | Know what software you have, scan for missing patches on a set schedule, patch within defined timeframes, and remove software the vendor no longer supports. |
| Patch operating systems | The same discipline for Windows, macOS, iOS, Android and any server or network device — tighter clock on anything internet-facing, and unsupported systems replaced. |
| Multi-factor authentication | A genuine second factor on the online services holding your sensitive data, including third-party and customer-facing services. |
| Restrict administrative privileges | Admin access approved before granted, admins get a separate account for admin work only, and those accounts stay off email and the web. |
| Application control | Only approved software runs on workstations, including in the folders where downloads and email attachments land. |
| Restrict Microsoft Office macros | Macros off unless there is a demonstrated business need, internet-sourced macros blocked, macro antivirus on, settings locked. |
| User application hardening | Internet Explorer 11 gone, browsers not running Java or web advertisements, browser security settings locked. |
| Regular backups | Backups run and retained by criticality, held securely, restorable to one common point in time, tested, and out of reach of everyday accounts. |
Patch applications
Level One requires automated asset discovery at least fortnightly and a vulnerability scanner with an up-to-date database; scanning at least daily for missing patches in online services and at least weekly for office productivity suites, web browsers and their extensions, email clients, PDF software and security products; patches for online services within 48 hours where the vendor rates the vulnerability critical or a working exploit exists, and within two weeks otherwise; patches for that same everyday software list within two weeks of release; and removal of any of it no longer supported by the vendor.
In practice: automatic updates cover much of the timeframes but not the discovery and scanning requirements, which small businesses most often miss. “Online services” means anything of yours reachable from the internet, and that 48-hour clock is the tightest obligation in all of Level One.
Patch operating systems
Level One requires the same fortnightly asset discovery and up-to-date vulnerability scanner, with scanning at least daily for the operating systems of internet-facing servers and network devices and at least fortnightly for workstations and non-internet-facing servers and network devices. Internet-facing operating systems are patched within 48 hours where critical or where a working exploit exists, and within two weeks otherwise; workstations and non-internet-facing systems within one month. Operating systems no longer supported by their vendor are replaced.
In practice: workstations get a month, comfortable if automatic updates are on and machines get restarted. “Network devices” includes the router or firewall your connection runs through: internet-facing, rarely patched, usually nobody’s job.
Multi-factor authentication
Level One requires multi-factor authentication for users signing in to your own online services and to third-party online services that process, store or communicate your sensitive data; for third-party services holding your non-sensitive data where it is available; and for users and customers signing in to online customer services, including third-party ones, that hold sensitive customer data. ASD also specifies what counts: something the user has plus something they know, or something they have that is unlocked by something they know or are.
In practice: the highest-value control in Level One and usually the fastest, because it is a setting in products you already pay for. There are two traps. Available is not enforced, so on for the owner and optional for everyone else fails the requirement. And if clients log in to a portal holding sensitive information, it extends to them too.
Restrict administrative privileges
Level One requires that requests for privileged access to systems, applications and data repositories are validated when first requested; that privileged users hold a dedicated account used solely for privileged duties; that privileged accounts other than those explicitly authorised cannot reach the internet, email and web services, with any authorised access strictly limited to what the role requires; and that privileged and unprivileged operating environments are kept separate, with neither account type able to log on to the other (local administrator accounts excepted).
In practice: the account you use for email and browsing should not be the one that can install software or change settings. That means a second account for each person doing administrative work, used only when needed. It costs nothing and is the most disruptive change here in daily habit. Decide who genuinely needs administrative access first, which is usually fewer people than currently have it.
Application control
Level One requires application control implemented on workstations, applied to user profiles and the temporary folders used by operating systems, web browsers and email clients, restricting execution to an organisation-approved set, covering executables, software libraries, scripts, installers, compiled HTML, HTML applications and control panel applets.
In practice: normally the hardest of the eight without IT support, because it is not a switch. It means deciding what software is approved and maintaining that decision. The folders named are where downloads and email attachments land, which is exactly where malicious files try to run.
Restrict Microsoft Office macros
Level One requires macros disabled for users without a demonstrated business requirement, macros in files originating from the internet blocked, macro antivirus scanning enabled, and macro security settings that users cannot change.
In practice: most small businesses have no genuine need for macros, so this is quick. Where a spreadsheet does rely on them, “demonstrated business requirement” means the exception covers the people who need it, not everybody. Write down the reason.
User application hardening
Level One requires Internet Explorer 11 disabled or removed, web browsers that do not process Java from the internet, web browsers that do not process web advertisements from the internet, and browser security settings that users cannot change.
In practice: on current machines the first two are largely handled already. Locking browser settings against user change needs a management capability rather than a per-machine tweak, which is where a business with a dozen laptops discovers it needs device management. That is the real cost hiding here.
Regular backups
Level One requires backups of data, applications and settings performed and retained in accordance with business criticality and business continuity requirements; synchronised so everything can be restored to a common point in time; retained in a secure and resilient manner; with restoration to a common point in time tested as part of disaster recovery exercises; and with unprivileged user accounts unable to access backups belonging to other accounts, and prevented from modifying or deleting backups.
In practice: the requirement is not “a backup exists”. Backups must cover applications and settings as well as data, line up so everything restores to the same moment, sit out of reach of ordinary accounts, and be proven by an actual restore. File synchronisation is not a backup: a deletion or an encryption syncs straight through. The testing requirement is the one most businesses fail, and it is free to fix.
What is quick, and what takes real work
The honest answer to “how long does Level One take” is that it depends almost entirely on where you start: how many devices, how much runs in managed cloud services, whether anything is too old to support current software, and whether you have any device management. Any single figure quoted for total time or total cost is guessing at your starting position. What can be said reliably is the relative order of difficulty.
| Effort | Typically involves | Why |
|---|---|---|
| Fast — days | Enforcing multi-factor authentication; turning on automatic updates; disabling macros where there is no business need; removing unsupported software; running a test restore. | Settings in products you already have, or decisions needing no purchase — and they remove the largest share of practical risk. |
| Moderate — weeks | Separate administrative accounts; the scanning and asset discovery routine; securing backups against everyday accounts; documenting who has access to what. | These need changed habits and a little tooling, and must survive the first month to count. |
| Genuine project — months | Application control; locking browser and macro settings against user change; replacing hardware or operating systems the vendor no longer supports. | These need a management capability across devices, or capital spend, or both — and are where an external provider earns their fee. |
Where you land on cost depends on the same variables. We break down the DIY, consultant and software options in what Essential Eight compliance costs rather than quoting a figure here that would not apply to you.
The mistake that undoes most of the work
Level One is a state, not a project. Notice how many requirements are continuous: patches within 48 hours, two weeks or one month of release; scanning daily, weekly or fortnightly; restoration tested as part of disaster recovery exercises. Those reset every week.
Three things predictably erode a hard-won Level One. Privilege drift, where someone gets administrative access to solve a Friday problem and keeps it for three years. New software arriving outside the approved set. And ASD updating the maturity model, so an assessment against an older version no longer describes what is required. A business that fixes everything once and never looks again typically drifts back toward Level Zero on at least one strategy within a year.
What to do if you cannot meet one requirement
ASD expects a risk-based approach and accepts that exceptions happen. Minimise exceptions and their scope through compensating controls and the fewest systems and users affected, document and approve each one through an appropriate process, then monitor and review regularly. ASD notes that appropriate use of exceptions should not prevent an organisation being assessed as meeting a given maturity level. The practical translation: a documented, approved, reviewed exception with a compensating control is a legitimate position; an undocumented gap you hope nobody asks about is not.
Working out where you actually stand
The requirements above run to several dozen items. The useful question is not “are we compliant” but “which do we already meet, which are close, and which have not been started”. That is a per-control answer, not a per-strategy one, and it is the thing that tells you where to start.
This is what CyberSmart360 was built to do. You work through a plain-language wizard covering 186 controls across the Essential Eight and the ACSC Security Principles, translated for 44 industries, and get a compliance score, a ranked gap report, a costed 12-month remediation plan, evidence tracking and a downloadable PDF report. The ranked gap report is the part that matters here: it stops you guessing which of the eight to tackle first, and gives you something dated to send a client or insurer while the work is in progress.
Frequently asked questions
Is Maturity Level 1 enough?
It depends who is asking. Level One addresses widely available attack techniques, which covers most of what a small business faces. If a contract, regulator or client specifies Level Two, that is the requirement. ASD notes the Essential Eight is a minimum set of preventative measures and will not mitigate all cyber threats.
Does Maturity Level 1 still apply if everything we use is cloud-based?
Yes, though the work shifts. The vendor patches their own platform. Multi-factor authentication, device patching, administrative account separation, application control on your workstations, browser and macro settings, and backups of anything the vendor does not hold all remain yours.
Do we need to be certified at Maturity Level 1?
ASD states there is no requirement for an Essential Eight implementation to be certified by an independent party. Independent assessment may be required by a government directive, a regulator or a contract, so check what the requester is asking for before commissioning one.
Can we be at Level 1 on some strategies and Level 2 on others?
You can be, but ASD advises achieving the same level across all eight before moving up, because the eight complement each other. Report a per-strategy result alongside an overall level, and remember the overall position is set by your weakest strategy, not your average.
How long will Maturity Level 1 take us?
Not answerable without knowing your starting position, and anyone quoting a figure without asking about your devices, cloud services and hardware age is guessing. The realistic sequence is days for the settings-based controls, weeks for the habit-based ones, months for application control and any hardware replacement.
Find out where you stand before you start spending
The most common way businesses waste money on the Essential Eight is buying something before establishing which Level One requirements they already meet. Assessing first is cheaper and produces a shorter list. The free 7-day trial of CyberSmart360 at cybersmart360.com needs no credit card and covers one user and one assessment. Detail is on the plans and pricing page.
This article is general information about a security framework and the obligations that commonly sit around it. It is not legal, tax or professional advice, and it does not replace advice specific to your business or practice.
