The Essential Eight controls are exactly what they were in 2023 — what's changed is that someone with a chequebook now wants you to prove your maturity before they'll sign.
You can't see the Essential Eight on your balance sheet — until an insurer or a big client asks you to prove it before they'll sign. That's the quiet shift Melbourne business owners are running into right now. The framework itself hasn't moved. The eight mitigation strategies, and the maturity model that grades them, are the same model the Australian Signals Directorate (ASD) and its Australian Cyber Security Centre last updated in November 2023. What's changed in 2026 is the audience. The people reading your security posture have got far less forgiving — and they're attaching real money to the answer.
Update, 15 October 2026: one thing has moved since we first wrote this. ASD has released ASD Essentials, the successor to the Essential Eight. Nothing below stops applying overnight. The Essential Eight stays on cyber.gov.au during a transition expected to take a year or two, the work you've already done still counts, and insurers, tenders and clients still ask for Essential Eight evidence for now. ASD's advice is to check your existing controls against Essentials rather than assume they're equivalent.
What changed with the Essential Eight in 2026?
In 2026 the Essential Eight controls stayed the same; what changed is who checks them. Cyber insurers, larger clients and government buyers now want evidence of your maturity, increasingly at Maturity Level 2, and that's the shift Key IT is helping Melbourne businesses prepare for.
If you've read our plain-English guide to the eight controls, you know the mechanics: application control, patching applications, Microsoft Office macro settings, user application hardening, restricting admin privileges, patching operating systems, regular backups and multi-factor authentication, each graded from Maturity Level Zero up to Level Three. None of that has moved. What's moved is who's looking, why, and how hard they're pushing.
- The controls are settled. Treat any "new for 2026" claim about the eight controls with suspicion and check it against the ASD's own maturity model — the news isn't the controls, it's the expectation around them.
- The judgement isn't. Industry commentators increasingly describe Maturity Level 2 as the expected baseline for businesses bidding for serious work in 2026 — not because the law moved, but because buyers and insurers decided "Level 1, we hope" is no longer good enough.
What do cyber insurers want to see in 2026?
Cyber insurers and their brokers now want proof that your Essential Eight controls are genuinely in place and operating — a self-assessed tick on the renewal form carries far less weight than it used to. After a few hard years of paying out, insurers have tightened their questionnaires, and the change worth noticing in 2026 isn't a longer list of questions: it's that "yes" now needs evidence behind it, and many renewals hinge on maturity you can demonstrate.
This builds directly on what we covered about what cyber insurers now require to issue and pay out a policy, and our cyber insurance renewal checklist lists the evidence worth gathering before your premium is set. The honest risk is the gap between what you declared and what was actually running on the day of a breach. If you ticked "MFA on all remote access" and one service slipped through, that's the gap a claims assessor lives for.
Is SMS-code MFA still enough for Maturity Level 2?
No, not for the accounts and services that level covers. The ASD's November 2023 update made phishing-resistant multi-factor authentication part of Maturity Level 2, and SMS codes or basic push approvals don't meet that bar. For years, "do you have MFA?" was a yes/no question and any second factor counted. Phishing-resistant methods include passkeys, FIDO2 security keys, smart cards and Windows Hello for Business, and they matter because attackers have got good at intercepting SMS codes and fatiguing people into approving push prompts.
- Not all MFA is equal anymore. An SMS code is better than nothing, but it can be intercepted or socially engineered. Phishing-resistant methods such as passkeys in Microsoft 365 can't be relayed to an attacker the same way, so it's worth knowing which kind of MFA each of your accounts actually uses — not just whether MFA is switched on.
- It's an identity project, not a toggle. Moving a whole organisation onto phishing-resistant MFA across Microsoft 365, remote access and admin accounts takes planning, the right licensing and a rollout that doesn't lock your team out. It rewards doing it properly once.
Why are big clients asking suppliers for Essential Eight evidence?
Because a weak supplier is now treated as the buyer's own risk, prime contractors and government buyers increasingly ask suppliers to demonstrate Essential Eight maturity before awarding or renewing work. So the other group judging you isn't an insurer at all — it's the larger business or government department you want to sell to, and supply-chain cybersecurity scrutiny has pushed that judgement down the food chain to SMBs.
- The questionnaire arrives before the contract. A vendor risk assessment landing in your inbox is no longer a formality — our security questionnaire guide decodes what each question is really asking. For many Melbourne SMBs, an honest, evidenced answer is now the difference between making the shortlist and being quietly dropped.
- Evidence beats assertion. Buyers and assessors want artefacts — patching reports, MFA coverage, backup test results — not a confident email. Producing them on request makes security a selling point, and it wins you work a less-prepared competitor can't.
How Key IT helps you prove it, not just claim it
Maturity Level 2 isn't a product you buy; it's a state you can demonstrate on any given day. That's the part most businesses underestimate — it's the ongoing evidence, not the initial fix, that wins renewals and contracts. As Melbourne's security-first MSP, with every one of our engineers security-certified, this is the work we do every day.
An honest baseline first
Our Essential 8 service grades your current maturity against the ASD model — by your weakest control, the way it's actually scored — then sets a roadmap to lift it, rather than telling you what you'd like to hear.
Controls that keep proving themselves
Patching, hardening, EDR on every device and phishing-resistant MFA only count if they stay in place. Our engineers maintain them, 24/7 SOC monitoring watches for the attacks they are there to stop, and we produce the reporting that insurers, brokers and big clients now ask to see.
The paperwork, handled
When an insurer questionnaire or a client vendor assessment lands, we help you answer it accurately and back it with documentation — so your cover stays valid and your tenders stand up to scrutiny.
Frequently asked questions
Did the Essential Eight change in 2026?
No. The eight controls and the maturity model behind them are the same ones the ASD's Australian Cyber Security Centre last updated in November 2023. What's changed in 2026 is the expectation around them — insurers, larger clients and government supply chains increasingly want provable maturity, not a self-declared tick. The bigger news is ASD Essentials, which ASD released on 15 October 2026 to succeed the Essential Eight; the Essential Eight stays on cyber.gov.au through a transition expected to take a year or two. Always check the ACSC's own guidance for the current detail at the time you're reading.
Will insurers stop asking about the Essential Eight?
Nobody knows yet. As of 15 October 2026, we haven't seen an insurer announce a move from Essential Eight questions to ASD Essentials, and each insurer writes its own renewal questionnaire, so any change is likely to arrive one insurer at a time. Plan for Essential Eight questions at your next renewal, keep dated evidence for each control, and ask your broker whether the wording is changing.
Is Maturity Level 2 legally required for my business?
For most private businesses, no — it isn't a blanket legal mandate. Industry commentary describes ML2 as an expected baseline for winning serious contracts and renewing cyber insurance in 2026, which is a commercial pressure rather than a law. Specific government and regulated sectors can have stricter, separate obligations, so it's worth confirming what applies to your work.
What is phishing-resistant MFA and do I need it?
It's multi-factor authentication that can't easily be intercepted or relayed to an attacker — methods like passkeys, FIDO2 security keys or certificate-based logins, rather than SMS codes or basic push approvals. Since the ASD's November 2023 update it's part of Maturity Level 2, so if insurers or clients assess you at that level, it's the version that counts.
What is Essential Eight Maturity Level 2?
Maturity Level 2 is the middle of the ASD's three target levels, aimed at attackers who invest more time and better tools than opportunists. It means broader patching, tighter admin rights, phishing-resistant MFA, event logging and backups only designated backup administrators can change or delete, measured control by control, with your weakest control setting your real level.
Is there an official Essential Eight certification?
No. The ASD publishes the maturity model and guidance for assessors, but it doesn't issue Essential Eight certificates. "Essential Eight compliance" is shown with evidence instead: an assessment of your maturity level against the ASD model, plus reports proving the controls stay in place. Be wary of anyone selling a certificate as the finish line.
How do I prove our Essential Eight maturity to an insurer or client?
With evidence, not assertions: patching and OS update records, MFA coverage across email, remote access and admin accounts, application control and hardening configurations, and tested backup restores. An assessment that documents your maturity level — and ongoing reporting that shows the controls staying in place — is what stands up when a claims assessor or a procurement team looks closely.
Where should a Melbourne business start with the Essential Eight?
Start with an honest baseline. Key IT's free Essential 8 self-assessment shows which of the eight controls you have in place today. Our security-certified engineers can then grade each control against the ASD model and map the steps to the level your insurer or clients expect, for businesses across Melbourne and remotely beyond it, including regional Victoria.
Where do you stand on the Essential Eight? Tick the controls you have in place in a free 60-second self-check.
Take the Self-Check