Essential Eight Maturity Level 2 Guide

ML2 builds on ML1 and focuses on malicious actors willing to invest more effort in targeting and use more effective tradecraft. It requires stronger coverage, timeliness, control over privileged activity and resistance to bypass. The target should be chosen using risk and applicable obligations.

Organisations need reliable control over executable files and relevant content, supported by maintained rules and coverage across the assessed workstations. Assessment evidence should show effective enforcement, governance and handling of changes and exceptions.

Teams need authoritative application visibility, processes to identify vulnerabilities and patch deployment that meets current ASD requirements. Evidence must reconcile assets, vulnerability information, deployment results and approved exceptions.

Macro controls should restrict untrusted sources, constrain who can change settings and support investigation of macro activity. Confirm that policy applies to the assessed users and devices rather than relying on a template configuration alone.

Security settings for browsers, Microsoft Office, PDF software and other user applications should reduce exposed functionality and prevent users weakening the controls. Validate policy application and exceptions on representative devices.

Separate privileged and unprivileged activity, tightly control membership and access, and review administrative privileges regularly. Service accounts, emergency access and remote administration require the same evidence-based treatment as named administrator accounts.

Maintain an accurate operating-system inventory, identify vulnerabilities and deploy updates in line with current ASD requirements. Unsupported or unmanaged platforms should be visible, risk-assessed and addressed rather than silently excluded.

MFA coverage and factor strength must meet the current model for the relevant users, systems and services. Assess the real authentication path, including legacy protocols, recovery processes and privileged access—not only the identity-provider policy.

Backups should cover important data, software and configuration, be protected from inappropriate access and be tested through restoration. Evidence needs to show successful operation and recovery, not just the existence of scheduled jobs.

Useful evidence includes policy and configuration exports, device and application inventories, management-platform reports, vulnerability and patch records, identity and privilege data, MFA configuration, backup and restore results, exception records, logs, interviews and observed demonstrations.

• Controls cover standard workstations but not the complete boundary
• Asset inventories do not reconcile with patch or application-control platforms
• Privileged accounts are used for routine activity
• MFA can be bypassed through legacy or recovery paths
• Policies are configured centrally but not verified on endpoints
• Unsupported applications or operating systems remain in production
• Backup success is monitored but restoration is not tested
• Exceptions lack an owner, expiry or compensating controls

Establish a verified ML1 baseline, identify the incremental and cumulative ML2 requirements, map dependencies and sequence uplift work. Plan for operational ownership, reporting and reassessment—not only initial configuration.