Essential Eight compliance for Melbourne businesses means implementing and maintaining the eight cybersecurity controls published by the Australian Signals Directorate — patch applications, patch operating systems, multi-factor authentication, restrict administrative privileges, application control, restrict Microsoft Office macros, user application hardening, and regular backups — to a documented maturity level using Microsoft 365, Azure, Intune, Entra ID, and Defender tools already included in your Microsoft stack.
The Essential Eight mapped to Microsoft 365 tools for Melbourne businesses
Patch applications — Microsoft Intune software update policies handle deployment, while Microsoft Defender Vulnerability Management provides the application patch compliance reporting an assessor will ask for.
Patch operating systems — Intune with Windows Update for Business deployment rings, running monthly patching cycles, with OS patch compliance evidenced through Defender Vulnerability Management.
Multi-factor authentication — Microsoft Entra ID Conditional Access policies enforce MFA; phishing-resistant MFA via FIDO2 security keys or Windows Hello for Business is what Maturity Level 3 requires. For app-based rollout steps, see how to set up Google Authenticator for your business.
Restrict administrative privileges — Entra ID Privileged Identity Management for just-in-time privileged access, no standing Global Admin accounts, and auditing of every admin role assignment.
Application control — Microsoft Defender Application Control (WDAC) policies deployed through Intune, with AppLocker retained for legacy scenarios.
Restrict Office macros — Defender Attack Surface Reduction rules to block macros from internet-sourced files, reinforced by Group Policy or Intune macro restriction policies.
User application hardening — ASR rules to block web shell execution, disable unnecessary browser features, and restrict PowerShell.
Regular backups — Microsoft 365 Backup for Exchange, SharePoint, OneDrive and Teams daily, Azure Backup for server workloads, with tested recovery documented quarterly.
Essential Eight maturity levels — what Melbourne businesses should target in 2026
Maturity Level 1 covers the baseline controls that stop opportunistic attacks. Most phishing, ransomware and credential theft attempts are stopped at ML1, which makes it the right target for the majority of Melbourne SMBs outside the government supply chain.
Maturity Level 2 addresses more sophisticated adversaries, adding requirements around MFA strength, administrative privilege management and completeness of application control. It is required for Victorian government suppliers and increasingly expected of Melbourne businesses servicing Commonwealth agencies.
Maturity Level 3 targets determined, targeted attacks — phishing-resistant MFA, full application control and comprehensive logging. It applies to businesses holding sensitive government data or operating critical infrastructure.
For most Melbourne SMBs the realistic 2026 target is ML1 achieved and documented, with a roadmap to ML2 for anyone in the government supply chain. The ASD updated its Essential Eight Maturity Model Assessment Guide in November 2023, and these targets reflect that current version.
What changed in the Essential Eight in 2025–2026
The ACSC has materially tightened Essential Eight expectations through 2025 and into 2026, and most of the change is in the detail rather than the eight controls themselves. Three shifts matter for Australian businesses.
First, Maturity Level 2 is now required for all non-corporate Commonwealth entities — not aspirational, required. That obligation flows down to suppliers through procurement clauses, so any Melbourne business contracting to a Commonwealth agency is being asked for ML2 evidence at renewal, not ML1.
Second, patching timelines have tightened. At Maturity Level 2 critical vulnerabilities must be remediated within 48 hours of release, and patching completeness has to be evidenced — a screenshot of WSUS is no longer enough. Microsoft Intune update rings and Defender Vulnerability Management reporting produce the evidence an assessor expects.
Third, multi-factor authentication requirements have strengthened. Phishing-resistant MFA — hardware security keys or passkeys — is now required at Maturity Level 3, and the scope of systems requiring MFA has expanded across all levels. Entra ID Conditional Access with FIDO2 keys or Windows Hello for Business satisfies this.
Finally, application control scope has expanded — WDAC policies now need to cover more endpoints and user contexts, not just servers.
The practical takeaway: Microsoft 365 Business Premium and Azure cover the majority of Essential Eight controls at Maturity Level 2. Defender for Business handles malware defence and attack surface reduction; Intune delivers application control and patching; Entra ID provides MFA; and Microsoft Purview covers data backup requirements. A properly configured Business Premium tenant typically meets ML2 across most controls without third-party tooling.
Essential Eight gap assessment for Melbourne businesses — what it covers
A proper gap assessment reviews the current implementation of all eight controls against your target maturity level and documents four things: the current state (what is configured, what is missing, what is only partially implemented), the gap (what has to change to reach the target level), the remediation effort (hours and cost per gap), and the risk of each gap (which missing controls create the most significant exposure).
For a Melbourne business, that assessment typically takes one to two days of remote access to the Microsoft 365 tenant and Azure environment, producing a written report with a prioritised remediation plan rather than a spreadsheet of red ticks.
Search demand backs this up — "essential eight assessment for smes" sits at position 2 in Google, which tells you how many Melbourne SMBs are actively hunting for this service. Our Essential Eight assessment guide for SMEs walks through the methodology in detail.
Essential Eight compliance for Melbourne professional services, legal, and construction businesses
Legal firms. Law Institute of Victoria cyber security guidance increasingly references the Essential Eight, and Melbourne firms acting for government clients are being asked for ML2.
Accounting and financial advisory. ASIC's cyber resilience guidance points to the Essential Eight for financial services licensees, so Melbourne accounting firms holding an AFS licence should treat ML1 as the floor, not the goal.
Construction and engineering. Victorian government infrastructure contracts now routinely carry Essential Eight requirements that flow down to subcontractors. Melbourne construction companies tendering for government work need documented ML1 alignment before the tender, not after.
Defence contractors. DISP membership requires a documented cyber security plan aligned to Essential Eight ML2. Melbourne defence suppliers need a full ML2 assessment and remediation programme completed ahead of any DISP application.
How Mycelium 365 delivers Essential Eight compliance for Melbourne businesses
We start with a gap assessment against your target maturity level, then remediate using the Microsoft licences you already hold — Intune, Entra ID and Defender — rather than bolting on additional tooling. Ongoing alignment is maintained through Managed Microsoft Defender and our Security Operations Centre, which keep patch compliance, MFA coverage and ASR rules under continuous monitoring instead of an annual scramble. Melbourne clients are supported by our local Microsoft 365 team, and evidence is maintained in a form assessors and tender panels accept. Book a gap assessment to see where you currently sit.
Essential Eight compliance for Melbourne businesses — Mycelium 365
Mycelium 365 conducts Essential Eight gap assessments for Melbourne and Australian businesses, delivering a scored maturity assessment against all eight controls with a prioritised remediation plan. Each control is rated against your target maturity level — current state, gap, remediation effort and residual risk — so you leave the engagement knowing exactly what to fix and in what order.
Most businesses achieve Maturity Level 2 within 90 days using the Microsoft 365 Business Premium and Azure licences they already hold, because the remediation work is configuration, not procurement: tightening Intune patch rings, enforcing Entra ID Conditional Access, deploying Defender Application Control policies, and turning on ASR rules. Melbourne clients are supported from our Flinders Street office, and evidence is maintained in a form that Victorian and Commonwealth assessors accept. Book a gap assessment to establish where your business currently sits.