What Essential Eight Maturity Level Two actually requires
Maturity Level Two is the practical expectation for most Australian organisations handling sensitive data. Here is what each strategy asks for, and where self-assessments overstate.
The Gwenda Team · · 2 min read
Most organisations that self-assess against the Essential Eight land on Maturity Level Two and are surprised when an assessor disagrees. The gap is rarely a missing control. The maturity model asks about configuration and timing; a self-assessment asks a person.
The eight, and what Level Two is really asking
Application control. An allowlist policy on paper is the easy half. Level Two wants execution actually restricted on workstations and internet-facing servers, with the ruleset validated annually.
Patch applications. Internet-facing services patched within two weeks, and within 48 hours where a working exploit exists. The measurable question is the age of your oldest unpatched internet-facing service, right now.
Office macro settings. Macros from the internet blocked, and macro security settings that users cannot change.
User application hardening. Browsers configured not to process Java or web advertisements from the internet, with the settings enforced rather than recommended.
Restrict administrative privileges. Privileged accounts separated from day-to-day accounts, and privileged access requests validated. This is where standing access quietly accumulates.
Patch operating systems. The same two-week and 48-hour clocks, applied to operating systems, on supported versions.
Multi-factor authentication. Phishing-resistant MFA on internet-facing services and for privileged actions.
Regular backups. Backups retained and (the part that fails most often) restoration tested, with backups unreachable from a compromised privileged account.
Why self-assessment overstates
In order of how often we see them:
- Intent is recorded as state. A policy that says patches are applied within two weeks is not evidence that they were.
- Exceptions are invisible. Exclusion groups, break-glass accounts and unmanaged devices are exactly the things a questionnaire does not ask about.
- Coverage is assumed. "All endpoints are managed" usually means all endpoints the person answering knows about.
What to do instead
Read the systems. Every one of the eight strategies resolves to configuration that a machine can query: policy objects in your identity provider, compliance state in your MDM, patch levels on your fleet, retention and restore records in your backup service.
See your real Essential Eight maturity
Gwenda scores each of the eight strategies from the configuration itself, exclusions included, rather than from a questionnaire.
Related
See where you actually stand.
Gwenda reads the applications you already run, discovers the controls you already have, and measures them against the gold standard for your industry.