Security you can prove.

Eight mitigation strategies published by the Australian Signals Directorate, each scored from Maturity Level Zero to Maturity Level Three. It is the Australian baseline for practical cyber security uplift.

For non-corporate Commonwealth entities, yes, under the Protective Security Policy Framework. NSW government agencies must implement it to at least Maturity Level 1 under the NSW Cyber Security Policy. Defence Industry Security Program members must meet or exceed Maturity Level 2 on systems used to correspond with Defence. For private business generally it is not law, but it is increasingly a contractual requirement flowed down by customers.

ASD announced in June 2026 that it will replace the Essential Eight with a new “Essentials” series over roughly two years, with separate guidance for enterprise IT, operational technology and cloud. The Essential Eight remains current and both will run side by side during the transition. Work done now is not wasted, and we took part in the consultation.

Alignment means your controls match the standard and the evidence exists. Certification means an accredited certification body has audited you and issued a certificate. AWD prepares, governs and supports the process. Only an accredited certification body can certify you, and in Australia those bodies are accredited by JAS-ANZ or another IAF Multilateral Recognition Arrangement signatory.

Typically nine to eighteen months from gap analysis to Stage 2 audit, depending on scope and how much is already documented.

Essential Eight if you want measurable security uplift and your customers ask about ACSC alignment. ISO 27001 if you need a certificate to satisfy enterprise customers, insurers or offshore partners. Many businesses do the Essential Eight first and use it as the foundation.