What does Essential Eight Maturity Level 0 mean?

Maturity Level 0 means a control has gaps an attacker could exploit without much effort; it is the model's way of saying materially exposed, not negligent. Most businesses score at least one zero on their first assessment. The score's job is to set the starting line truthfully, and the right response is a sequence, not shame.

Zeros are common for two structural reasons, and knowing them takes the sting out. First, the bar for Level 1 is deliberately real: the model was built to defeat actual attack techniques, not to hand out participation scores, so partially implemented rounds down. Second, the weakest-control rule means overall maturity sits at your lowest control, so a business with solid MFA and tested backups can still be an overall Level 0 because Office macros were never restricted. That is not the model being unfair; it is the model refusing to let strong doors excuse an open window.

The useful move is to read what each zero is actually saying, because they rank themselves. A zero on multi-factor authentication means stolen passwords currently work, which is urgent. A zero on backups means ransomware currently has all the cards, equally urgent. A zero on macro settings or application hardening is a real gap with a smaller blast radius, fixable in configuration. Same score, very different priority, which is why a bare number without a per-control breakdown tells you almost nothing.

What to do with a zero: nothing about the score, everything about the gap. Negotiating with an assessor over the number is energy the fix could have used. Take the two highest-risk zeros, put the first-fortnight moves against them, and note the quiet gift the assessment handed you: a dated baseline, which is the thing that makes every improvement afterwards provable to insurers, panels and yourself. And if a score arrives you believe is wrong, ask for the evidence behind it; a real assessor can show you, and the conversation stops being about feelings either way. Measured and improving beats unmeasured and confident: the free Scorecard is how the measuring starts, or call 1800 456 567.