Achieved maturity
L0
Essential Eight Maturity Level 2
ML2 is the level many programmes ask for. Constant shows the ML2 bar for each strategy and the evidence an assessor expects.
What ML2 changes
Essential Eight Maturity Level 2 is the middle of the ACSC model. It is stricter than Maturity Level 1 and short of the centralised, tighter timeframes at Maturity Level 3.
Organisations should use ASD’s current maturity model as the authoritative requirement. Constant maps the ML2 requirements to evidence and records the result strategy by strategy.
ML2 at a glance
Use this as the requirement. The checklist page turns it into artefacts to collect.
| Strategy | Maturity Level 2 |
|---|---|
| Application control | Application control on workstations and internet-facing servers |
| Patch applications | Patch non-internet-facing apps within 1 month |
| Configure Microsoft Office macros | Block macros in files from untrusted sources |
| User application hardening | Extended hardening including web browsers |
| Restrict administrative privileges | Dedicated admin workstations and MFA |
| Patch operating systems | Patch all OS within 1 month |
| Multi-factor authentication | MFA for all users accessing important data |
| Regular backups | Synchronise backups with retention policy |
How to hold ML2 between audits
ML2 fails quietly when patch windows slip or application control coverage is only on part of the fleet. A continuous record shows that earlier than a yearly workshop.
Sources and further reading
Last reviewed 23 September 2026.
Related pages
Questions answered
What is Essential Eight Maturity Level 2?
Maturity Level 2 is the ACSC Essential Eight level between a minimum baseline and the tighter Maturity Level 3 standard. Requirements differ by strategy. Examples include application control on workstations and internet-facing servers, patching non-internet-facing applications within one month, and multi-factor authentication for all users accessing important data.
Does Constant assess ML2 separately from ML1 and ML3?
Yes. Constant tracks all three levels. You can see what ML2 requires, what you have evidenced, and what a certified assessor has reviewed.
Is Maturity Level 2 the same requirement for every strategy?
No. Each Essential Eight strategy has its own ML2 bar. Application control, patching, macros, hardening, privileged access, operating systems, multi-factor authentication, and backups are assessed separately.
What if only some strategies meet Maturity Level 2?
Constant shows the level strategy by strategy. A partial result stays visible, with the evidence and the gap, instead of one score that hides which strategies are short.
Start your compliance journey today
Choose the right plan for your organisation. Scale seamlessly as your compliance needs evolve.
Ready to simplify your compliance process?
Book a demo and see constant in action.
All Paid Plans Include
-
Unlimited human assessor reviews
-
Evidence collection
-
AI-assisted pre-reviews
-
Compliance dashboards
-
Australian business-hours support
-
On-demand reporting
-
Control owners and tasks
-
Evidence uploads
-
Maturity and gap tracking
-
Role-based access controls
-
Framework guidance
-
5×5 Risk Matrix
-
Australian data residency