Essential Eight ML2 alignment for mid-market firms.

Essential Eight Maturity Level 2 is the Australian Cyber Security Centre's intermediate maturity level for the eight mitigation strategies in the Essential Eight. ML2 is calibrated for organisations facing adversaries with moderate capability who target the organisation specifically. It is the level APRA-regulated mid-market firms, government suppliers, and most cyber-insurance underwriters expect across the eight controls.

ML1 is a baseline against opportunistic adversaries; ML2 raises the bar for adversaries who specifically target the organisation; ML3 hardens against well-resourced, persistent adversaries. The jump from ML1 to ML2 typically requires programme work across endpoint allow-listing, privileged access, and MFA coverage. The jump from ML2 to ML3 requires session recording, just-in-time privilege, and phishing-resistant MFA across the board.

For a mid-market firm with a baseline IT estate (200 to 2,000 staff): 9 to 18 months for full ML2 alignment across the eight. Application control and PAM are the long poles; MFA gaps are usually closed within 90 days. The work is sequenced — we typically prioritise admin privileges, MFA gaps, and patch cadence in the first quarter, then application control and macro hardening, then user-application hardening and backup uplift.

ML3 is calibrated for organisations facing well-resourced, persistent adversaries — typically nation-state-grade. Mid-market firms are not the priority target for that adversary class, and ML3 controls (just-in-time privilege, session recording on every privileged session, phishing-resistant MFA universally) carry operational cost that does not pay back at mid-market scale. ML2 is the right ratchet point. We document the path to ML3 in the roadmap so it is achievable when the threat profile shifts.

ACSC publishes the Essential Eight Maturity Model, which describes the implementation specifics for each control at each level. Evidence at ML2 is artefact-based: configuration baselines, exception registers, quarterly restoration tests, MFA enrolment reports, PAM session logs, patching cadence reports, application-control rule sets. APRA reviewers, internal auditors and cyber-insurance underwriters all increasingly ask for the same artefacts.

No. Essential Eight is not law for the private sector. It is mandated for non-corporate Commonwealth entities under the Protective Security Policy Framework. For private mid-market firms, it is an expected baseline — APRA references it in CPS 234 reviews, cyber-insurance underwriters use it as an underwriting checklist, and the ACSC recommends it broadly. Most boards now treat ML2 as a de facto expectation.

CPS 234 §13 requires information-security capability commensurate with the threat profile. Essential Eight ML2 is one of the most defensible ways to evidence that capability for an APRA-regulated mid-market firm. APRA does not mandate ML2 — but in practice, an ML2-aligned environment with documented evidence makes a CPS 234 review materially easier. Our ML2 evidence pack is designed to drop into the CPS 234 §13 capability section.

The three controls that fail most often in mid-market FS reviews: (1) restrict administrative privileges — daily-use domain admin accounts and untooled PAM; (2) application control — pilot-stage allow-listing that has not gone production; (3) MFA — incomplete coverage on legacy systems, VPN-without-MFA pockets, and undocumented break-glass accounts. Patching, macros, hardening and backups follow as secondary findings.

The ML2 to ML3 ratchet is the documented, planned uplift path from ML2 to ML3, sequenced over 18 to 36 months. Most mid-market firms do not need ML3 today, but having a documented ratchet makes the roadmap defensible to a board and avoids surprise budget conversations later. We deliver the ratchet as part of the ML2 alignment programme.