What is the difference between ML1, ML2, and ML3?

Maturity Level 1 is baseline implementation; ML2 adds further controls and shorter timelines; ML3 adds the most rigorous controls including 48-hour application patching for internet-facing services and stricter macro and privileged-access requirements.

Does Lavawall® deliver Strategy 1 application control at ML2?

Yes. Kernel-free application control delivers the prescriptive ML2 application-control requirements. At ML3, driver allowlisting overlaps with Microsoft Windows Defender Application Control and needs coordinated implementation.

Are Australian MSPs required to be Essential Eight compliant themselves?

MSPs serving Australian government clients face increasing expectations to maintain Essential Eight at the level matching the client's requirement. Internal MSP Essential Eight compliance is becoming a standard expectation.

Best Essential Eight software

Best Australian Essential Eight software for MSPs

For Australian MSPs treating the Essential Eight as a procurement gate, the top pick is software that maps directly to all eight strategies at the maturity level the client requires and produces continuous evidence for each. On that test, Lavawall® covers all eight strategies at every maturity level with kernel-free application control and cross-platform patching. Judge any option on direct strategy mapping, application control, patching evidence, macro and hardening evidence, privileged-access restriction, MFA enforcement, and backup hygiene.

Start free, no credit card See the criteria

Eight strategies · ML1, ML2, ML3 · kernel-free application control · cross-platform patching

The Australian Signals Directorate publishes the Essential Eight, the most prescriptive cybersecurity baseline in widespread use: eight mitigation strategies across three maturity levels (ML1, ML2, ML3), each with specific implementation requirements. For Australian MSPs and government contractors, meeting the Essential Eight at the specified level is a procurement gate, not a nice-to-have.

What to look for

Seven criteria decide whether Essential Eight software can carry a real, evidenced program.

Direct Essential Eight strategy mapping

Alignment across all eight strategies and the specific Maturity Level requirements (ML1, ML2, ML3), not a generic interpretation.

Application control (Strategy 1)

Tools that deliver the prescriptive application-control requirements at your chosen maturity level.

Patching evidence (Strategies 2 and 6)

Continuous proof of application and operating-system patching that meets the prescriptive timelines.

Macro and user-application hardening (Strategies 3 and 4)

Documentation of Office macro execution policies and Office and browser hardening.

Privileged-access restrictions (Strategy 5)

Evidence of administrative privilege limits, including just-in-time elevation options.

MFA evidence (Strategy 7)

Enforcement proof across the relevant services.

Backup hygiene (Strategy 8)

Regular execution, retention, and restoration-testing documentation.

Options to evaluate

Lavawall® MSP platform, with Essential Eight first-class

Direct framework mapping at all three Maturity Levels with kernel-driver-free application control; 7,300+ application patching across Windows, macOS, and Linux; configuration assessment for hardening; privileged-access evidence; M365 and Entra MFA enforcement; and backup monitoring.

Best when: Australian MSPs delivering Essential Eight readiness as a billable service.

Airlock Digital + Tenable + manual evidence

Specialised application control plus scanning.

Combines Airlock Digital's mature application controls with Tenable scanning and manually assembled evidence documentation. Common among Australian MSPs already invested in this stack.

Best when: Australian MSPs invested in Airlock and Tenable that need a specialised Essential Eight program.

Microsoft Defender XDR + Microsoft Compliance Manager

Microsoft Compliance Manager includes Essential Eight templates with strong Microsoft-tenant integration. Multi-tenant management runs through Microsoft Lighthouse.

Best when: Microsoft-centric organisations on E5.

Vanta / Drata / Hyperproof / Secureframe

GRC platforms that offer Essential Eight framework templates with varying strengths and varying multi-tenant MSP capabilities. Better suited to single-organisation implementations.

Best when: Single-organisation Essential Eight use cases.

How Lavawall® fits

Lavawall® includes the Australian Essential Eight as a first-class framework across all three Maturity Levels. The strategy mapping reflects the prescriptive ASD implementation requirements rather than a generic interpretation.

Strategy 1 (application control) uses a kernel-free approach. Strategies 2 and 6 (patching) draw on the 7,300+ application catalog across platforms. Strategies 3, 4, and 5 (macro hardening, user-application hardening, and restricting administrative privileges) use the configuration assessment module. Strategy 7 (MFA) connects M365, Entra, and Google Workspace. Strategy 8 (backups) includes backup-system monitoring.

The same evidence base simultaneously satisfies the Essential Eight, ISO 27001, SOC 2, NIST CSF, and 15+ frameworks.

Map your Essential Eight controls free →

Frequently asked

What is the difference between ML1, ML2, and ML3?: Maturity Level 1 is baseline implementation; ML2 adds further controls and shorter timelines; ML3 adds the most rigorous controls including 48-hour application patching for internet-facing services and stricter macro and privileged-access requirements.
Does Lavawall® deliver Strategy 1 application control at ML2?: Yes. Kernel-free application control delivers the prescriptive ML2 application-control requirements. At ML3, driver allowlisting overlaps with Microsoft Windows Defender Application Control and needs coordinated implementation.
Are Australian MSPs required to be Essential Eight compliant themselves?: MSPs serving Australian government clients face increasing expectations to maintain Essential Eight at the level matching the client's requirement. Internal MSP Essential Eight compliance is becoming a standard expectation.