The Essential Eight is a set of baseline cyber security strategies developed by the Australian Signals Directorate. Also known as the ASD Essential Eight, it helps organisations protect themselves against common cyber threats by focusing on eight key areas:
These controls are designed to make it harder for attackers to compromise systems, steal credentials, exploit vulnerabilities or cause serious disruption. But the Essential Eight isn’t a “set and forget” exercise. It’s a maturity model. That means organisations are expected to keep improving their controls and prove they’re working effectively over time.
Maturity Level 3 is the highest level in the Essential Eight Maturity Model. It is intended for organisations seeking protection against more adaptive and targeted cyber threats. These attackers may use stolen credentials, exploit older software, look for gaps in privileged access, move through the network and attempt to bypass security controls. Level 3 is not necessarily the appropriate target for every organisation; ASD recommends selecting a target maturity level based on the organisation’s threat environment, risk profile and potential consequences of a cyber incident.
In practical terms, the Essential Eight Maturity Level 3 requirements call for stronger, more consistently applied controls across users, devices, applications, systems and backups. That might include stricter patching, stronger multi-factor authentication, tighter control over admin access, hardened applications, more resilient backups and better monitoring of exceptions.
The challenge? These controls don’t look after themselves.
Achieving cyber security maturity level 3 is a strong milestone, but the real value comes from making sure those controls are optimised, connected and actively supporting your broader security posture.
That’s where defense in depth becomes important..
The Essential Eight gives organisations a strong baseline across areas like patching, multi-factor authentication, application control, macro settings, privileged access and backups. But at Maturity Level 3, these controls shouldn’t operate in isolation. They need to work together as part of a layered defence model, where one control supports the next and security teams have the visibility to understand what’s happening across the environment.
For example, patching helps reduce exploitable weaknesses, but continuous monitoring helps confirm whether vulnerable systems are being targeted. Multi-factor authentication helps protect accounts, but security teams still need to identify suspicious login behaviour, impossible travel, repeated failed attempts or unexpected access patterns. Backups are critical for resilience, but they need to be monitored, tested and protected from tampering.
Rather than treating Essential Eight implementation as a point-in-time outcome, a defence-in-depth approach helps organisations validate that their controls are working as intended, identify gaps early and respond quickly when something needs attention. It also gives SMBs a clearer view of how their security layers are performing together, not just whether individual controls have been implemented.
For many SMBs, the challenge isn’t willingness. It’s capacity. They may have invested in strong tools and uplifted their controls, but they don’t always have the internal resources or specialist cyber expertise to monitor, tune and optimise those controls around the clock. A defense-in-depth approach helps close that gap.. With continuous visibility across users, endpoints, cloud services, networks and critical systems, SMBs can move beyond “we’ve implemented Level 3 controls” towards “we’re actively managing and improving our Level 3 posture.” And that’s the difference between having cyber maturity on paper and getting real security value from it.
Maintaining Essential Eight Maturity Level 3 isn’t just about implementing controls; it is also about demonstrating through credible evidence that they are operating effectively. Organisations need evidence that controls are in place, alerts are being reviewed, vulnerabilities are being managed and incidents are being escalated appropriately.
This matters for customers, boards, insurers, regulators and internal stakeholders. It shows that cyber security isn’t being treated as a one-off project. It’s being managed with discipline and accountability.
Without continuous visibility, that evidence becomes harder to maintain. Gaps appear. Logs go unchecked. Alerts are missed. Exceptions drift. Controls weaken over time.
Maintaining Essential Eight Maturity Level 3 requires ongoing governance, technical expertise, evidence, reporting and continuous improvement. While a 24/7 Managed SOC is not itself an Essential Eight requirement, it can complement the framework by strengthening threat detection, incident response and visibility. For SMBs without these capabilities in-house, managed support can help close the operational gap.
That’s where Infotrust can help.
Infotrust works with Australian organisations to strengthen their security posture through expert-led cyber security services, practical guidance and ongoing operational support. Our 24/7 Managed SOC gives SMBs continuous visibility across their environment, helping detect, investigate and respond to suspicious activity before it escalates. Rather than relying on alerts that may sit unseen after hours, organisations gain access to experienced cyber security experts who are watching for threats around the clock.
Infotrust can also support SMBs through Managed Detection and Response, SIEM and log management, incident response, GRC advisory, penetration testing and broader defensive and offensive security services. Together, these services help organisations move beyond point-in-time compliance and towards sustainable cyber resilience.
Because Maturity Level 3 isn’t a badge you earn once… it’s a standard you need to maintain every day.
And at that level, cyber security can’t afford to sleep.