ACSC ALIGNED · NOVEMBER 2025 ISM

Essential Eight Maturity Assessment

EDUC4TE's free Essential Eight maturity assessment scores all eight controls against ACSC Maturity Level 0 to 3, with per-control evidence prompts referencing current Information Security Manual control identifiers. Fifteen multiple-choice questions, no account required, instant Red Amber Green scorecard with admin centre paths and a remediation roadmap aligned to the Australian Signals Directorate's current published model.

✓ No account required✓ Takes 5 minutes✓ Results emailed instantly

Your Details

We'll email your personalised maturity scorecard when you finish.

We will email your result and never share your details with third parties.

15
Questions across the eight ACSC controls
3
Pillars: Prevention · Limiting Damage · Recovery & Application Control
5 min
Instant RAG scorecard on completion

Frequently asked questions

What is the ACSC Essential Eight?
The Essential Eight is a baseline of eight mitigation strategies published by the Australian Cyber Security Centre (ACSC), part of the Australian Signals Directorate (ASD), to protect organisations against cyber threats.
What is Maturity Level 2?
Maturity Level 2 is the second of four maturity levels (0 to 3) in the ACSC Essential Eight Maturity Model. It targets adversaries with modest tradecraft and is the recommended baseline for most non-government Australian organisations.
Is the Essential Eight mandatory in Australia?
It is mandatory for Commonwealth non-corporate entities under the Protective Security Policy Framework (PSPF). For private sector organisations it is the de facto baseline expected by Australian cyber insurers and regulators.
How long does Essential Eight ML2 alignment take?
A typical mid-market Microsoft 365 organisation reaches Maturity Level 2 in six to nine months of focused programme work, depending on patching maturity, application control posture, and admin privilege hygiene.
Does the Essential Eight cover AI?
The eight controls apply to AI workloads as applications and identities. ASD published supplementary guidance on AI and large language model deployment in 2024 that supplements the core Essential Eight controls.

Related from Educ4te

Copilot Essential Eight alignment

How the eight ACSC controls map to Microsoft 365 Copilot Wave 3.

90-Day Copilot Security Roadmap

Essential Eight-aligned phased activation plan for Microsoft 365 Copilot.

Educ4te blog

Practitioner articles on Essential Eight maturity, ASD guidance, and ML2 alignment.

Authoritative sources

This article draws on primary, authoritative sources. Each link opens in a new tab.

  1. Essential Eight maturity model (opens in a new tab) — Australian Cyber Security Centre
  2. Information Security Manual (ISM) (opens in a new tab) — Australian Signals Directorate
  3. Essential Eight Assessment Process Guide (opens in a new tab) — Australian Cyber Security Centre
  4. ACSC Essential Eight (ANZ) overview (opens in a new tab) — Microsoft Learn