Maturity Level 3
Essential Eight Maturity Level 3 — adaptive and well-resourced adversaries.
Application Control (ML3)
Prevent execution of unapproved/malicious programs on all workstations and servers.
Patch Applications (ML3)
Apply patches/updates for online services and other apps within timelines based on vulnerability severity.
Configure Microsoft Office Macro Settings (ML3)
Block macros from the internet; only allow vetted macros from trusted locations or digitally signed.
User Application Hardening (ML3)
Disable Flash, web ads, Java, and unneeded browser/Office features; enable ASR rules.
Restrict Administrative Privileges (ML3)
Limit privileged accounts; separate admin and standard accounts; use just-in-time access.
Patch Operating Systems (ML3)
Apply OS patches/updates in line with severity-based timelines; use modern, supported OS versions.
Multi-Factor Authentication (ML3)
Use phishing-resistant MFA for users of internet-facing services and privileged users.
Regular Backups (ML3)
Backup critical data and configs; store securely; test restoration; protect from modification/deletion.