In short: Private Australian businesses aren’t legally required to implement the Essential Eight. But Defence requires all members of its Defence Industry Security Program to reach Maturity Level 2. Non-corporate Commonwealth entities must meet Level 2 and hold contracted providers to Commonwealth security policy. Banks, insurers and super funds must assess their suppliers’ security. Those requirements reach suppliers through tenders, contracts and vendor questionnaires.
For most private organisations, the Essential Eight isn’t a legal obligation. No law says a mid-market manufacturer, logistics business or professional services firm must reach a set maturity level.
That’s increasingly beside the point. Essential Eight requirements for suppliers now come from the organisations you sell to. Those buyers are bound by the framework, or by frameworks that hold them accountable for your security, and they pass those expectations down the supply chain through tenders, contracts and vendor questionnaires.
So the real question isn’t “do we have to?” It’s “what happens when a customer asks, and we can’t answer?”
Where do Essential Eight requirements for suppliers come from?
Do Defence suppliers need Essential Eight Maturity Level 2?
Yes. Defence states that “all Defence Industry Security Program (DISP) members are now required to achieve and maintain compliance with the full E8 Maturity Level 2 standard.” Members complete a cyber security questionnaire with 107 Essential Eight controls. A point-in-time assessment follows, and members that fall short may be put on an uplift program.
What do Commonwealth agencies require of their suppliers?
Under the Protective Security Policy Framework (PSPF), non-corporate Commonwealth entities must implement Essential Eight Maturity Level Two mitigations to reach a “Managing” rating. Their accountability doesn’t stop at their own network. When the Auditor-General reviewed how agencies manage cyber supply chain risk, it noted that entities must ensure contracted providers comply with relevant PSPF requirements. In practice, that obligation lands on suppliers as a security schedule in the contract.
What do state governments require?
Each state sets its own policy. In NSW, agencies must implement the Essential Eight at a minimum of Maturity Level 1. In Victoria, the Protective Data Security Standards require contracted service providers with access to information to adhere to the standards. If you sell into state government, read the security schedule early. Each state’s requirements are different.
Do APRA-regulated entities require the Essential Eight from suppliers?
Not by name. Banks, insurers and superannuation funds must meet CPS 234, the information security standard set by the Australian Prudential Regulation Authority (APRA). Paragraph 16 requires them to assess the information security capability of any third party that manages their information assets. Paragraph 28 requires them to check that the third party’s control testing is adequate. So these buyers are obliged to scrutinise their suppliers, and the Essential Eight, published by the Australian Signals Directorate, is an obvious baseline to scrutinise against.
How do buyers ask for Essential Eight evidence?
It rarely arrives as a friendly question. It shows up as a security schedule in a tender, a vendor risk questionnaire at onboarding, or a new clause at contract renewal.
The detail asked for is getting sharper. A July 2026 analysis of government tenders notes that buyers ask for a maturity level and then probe the scope behind it. That means a rating for each strategy, the environment assessed, the assessment date and who carried it out. The same analysis notes the security schedule is often a pass/fail gate rather than a scored criterion. A general statement that you are “aligned with the Essential Eight” won’t get through that gate.
Why does waiting until the tender arrives cost more?
Uplift takes time. Application control, patching cadence and admin privilege changes reach every device in the business, and a tender response window is rarely long enough to make them properly. Organisations that discover their gaps when the questionnaire arrives end up choosing between a rushed fix, a qualified answer or walking away from the bid.
Buyers are tightening their side too. The same Auditor-General audit found that none of the agencies reviewed had processes for verifying the reliability of the cyber security information their contractors supplied. A finding like that shows exactly where buyer scrutiny goes next.
On 15 October 2026, ASD launched the Essentials series, with its first chapter, Essentials for enterprise IT, described as an evolution of the Essential Eight. When ASD first announced the upcoming change in June 2026, it said it expected to retire the Essential Eight within two years, but it will maintain both frameworks during the transition, and it advises organisations to keep meeting their current regulatory obligations until regulators communicate changes. ASD’s current guidance says it will advise on transition timing “in due course”.
That isn’t a reason to wait. Today’s Defence and Commonwealth requirements still name Essential Eight maturity levels, and ASD has said the investment made under the Essential Eight will remain relevant under the Essentials. Our guide, ASD Essentials Is Here: What Changes From the Essential Eight, covers what’s new, what carries over and what to do first.
How should suppliers prepare for Essential Eight requirements?
- Map your exposure. List the customers and pipeline deals that carry security schedules, and note which maturity level each one references.
- Know your actual maturity, strategy by strategy. Measure it rather than estimate it. If you need a refresher on the model itself, start with Essential Eight Compliance in 2026: What Australian Businesses Need to Know.
- Close Level 1 gaps first. Maturity Level 2 builds on the Level 1 controls, so a Level 2 claim won’t stand if Level 1 isn’t holding. For help sequencing the work, see What to Fix First When Every Security Gap Seems Urgent.
- Keep your evidence current. Maturity drifts as devices are added, exceptions pile up and patches slip. Last year’s answer may not be true today.
If you want evidence of where you stand at Maturity Level 1 before the questionnaire arrives, start with our Live Security Posture Assessment. If your buyers already expect Level 2 or Level 3, get in touch and we’ll scope it with you.
FAQs
Is the Essential Eight mandatory for private businesses in Australia?
No law requires private businesses to implement the Essential Eight. However, Defence, Commonwealth and state government buyers, and APRA-regulated entities, set security requirements for their suppliers through tenders, contracts and vendor questionnaires. For suppliers to these organisations, Essential Eight maturity is increasingly a condition of winning and keeping work.
What Essential Eight maturity level do Defence suppliers need?
Defence requires all Defence Industry Security Program (DISP) members to achieve and maintain the full Essential Eight Maturity Level 2 standard. Members complete a cyber security questionnaire, followed by a point-in-time assessment, and may be placed on an uplift program if they fall short.
What Essential Eight maturity level must Commonwealth agencies meet?
Under the Protective Security Policy Framework (PSPF), non-corporate Commonwealth entities must implement Essential Eight Maturity Level Two mitigations to achieve a “Managing” maturity rating. They are also accountable for ensuring contracted providers comply with relevant PSPF requirements.
What Essential Eight maturity level do NSW government agencies need?
NSW government agencies must implement the Essential Eight across applicable ICT environments at a minimum of Maturity Level 1. Higher levels are considered based on each agency’s threats and risks.
Does APRA CPS 234 require the Essential Eight?
No. CPS 234, the information security standard set by the Australian Prudential Regulation Authority (APRA), doesn’t name the Essential Eight. It requires APRA-regulated entities to assess the information security capability of any related party or third party that manages their information assets, which is why their suppliers receive security questionnaires.
Is the Essential Eight being retired?
Yes, over time. The Australian Signals Directorate (ASD) launched its Essentials series on 15 October 2026, with Essentials for enterprise IT as an evolution of the Essential Eight. In June 2026, ASD indicated that it expected to retire the Essential Eight within two years. At the time of writing, ASD says it will advise on transition timing “in due course”.
ASD will maintain both frameworks during the transition and advises organisations to keep meeting their current regulatory obligations. Current Defence and Commonwealth requirements still name Essential Eight maturity levels.
