Search traffic around Essential Eight Maturity Level 2, Essential Eight ML2, and DISP membership has climbed for a reason: the cyber bar moved, and many suppliers are still planning against an older mental model.
The short answer
For organisations seeking or holding DISP membership, the ICT/cyber conversation increasingly centres on implementing the Essential Eight to Maturity Level 2 across the corporate IT environment. That is broader and deeper than "we enabled MFA" or "we patch sometimes."
Maturity Level 1 vs Maturity Level 2
Maturity levels describe how completely each Essential Eight strategy is implemented.
- Lower maturity often means partial coverage, weaker enforcement, or controls that exist mainly on paper.
- Essential Eight Maturity Level 2 means the strategies are implemented to ASD's ML2 intent — including timing, coverage, and operational discipline.
If your roadmap still reads like a Top-4 / ML1 uplift from years ago, you are planning for a DISP cyber domain that no longer matches current expectations.
Why primes care about Essential Eight ML2
Large primes do not only ask "are you DISP?" They ask whether you can sit in a supply chain without becoming the soft target. Essential Eight ML2 is a shared language for that conversation. A supplier who can evidence ML2 controls is easier to onboard than one who can only evidence good intentions.
What DISP membership does not waive
DISP membership is not a substitute for cyber hygiene, and cyber tooling is not a substitute for the other three DISP domains. You still need governance, personnel security, and physical security scoped correctly. But when applications stall late, cyber — specifically incomplete Essential Eight Maturity Level 2 work — is a frequent cause.
Priorities if you are starting from a cold estate
1. Identity and MFA coverage for remote and privileged access 2. Admin privilege separation 3. Patch visibility and cadence for OS and key applications 4. Backup integrity and restore testing 5. Application control design that can survive contact with real users
Those five themes unlock most early Essential Eight ML2 progress for DISP membership candidates.
Keep one eye on the Essentials series
ASD has signalled that Essential Eight will be retired over a multi-year transition and replaced by the broader Essentials series. That matters for long-range planning. It does not mean you should pause ML2 work today. For current DISP membership cyber requirements, Essential Eight Maturity Level 2 remains the live, practical target.
Bottom line
If your board pack says "DISP membership — cyber green" but your estate cannot evidence Essential Eight ML2, the status is wrong. Fix the status, then fix the systems.