You opened the assessment report expecting a pass — instead you got a list of “not met” findings standing between your business and the Defence contract you were counting on.
You opened the assessment report expecting a pass. Instead, you got a list of gaps, a lower maturity level than you expected, and a sinking feeling that your DISP membership — or the prime contract sitting behind it — just got a lot further away.
If that’s where you are right now, take a breath. A failed Essential Eight Maturity Level 2 (ML2) assessment is not a dead end. It’s a diagnostic. Every year, capable Defence SMEs across Australia sit an Essential Eight assessment expecting to sail through, only to discover that “we think we’re compliant” and “we can prove we’re compliant” are two very different things. The good news is that Essential Eight remediation is a well-worn path, and most gaps that cause a failed result are fixable in weeks, not months — provided you approach them in the right order.
This post walks through why ML2 assessments trip up otherwise solid SMEs, how to read your assessment report without panicking, and the practical remediation sequence we use with Defence supply chain clients to turn a failed result into a pass.
Why Good SMEs Fail Essential Eight ML2 Assessments
Failing an Essential Eight assessment rarely means your organisation has no security controls in place. In our experience working with Defence SMEs, it almost always comes down to one of three things.
Evidence, not effort, is the problem. You might genuinely patch applications within 48 hours, but if you can’t produce a patch management log, a vulnerability scan report, or a ticketing trail that proves it happened on schedule, an assessor has no choice but to mark it as not met. Essential Eight ML2 is an evidence-based standard. Doing the right thing informally doesn’t satisfy it — you need documented, repeatable proof.
Partial implementation across all eight, rather than full implementation across most. A common mistake is spreading effort evenly across all eight controls and landing at “mostly there” on everything, rather than nailing five or six controls to ML2 standard and leaving the rest for a later phase. Assessors score against the maturity model control by control, and a scattergun approach tends to produce a scattergun result.
Scope misunderstanding. Many SMEs assess their corporate IT environment but overlook the systems that actually touch Defence data — a separate project server, a contractor’s laptop, a cloud environment stood up for one contract. If the assessment scope doesn’t match where Official: Sensitive or classified information actually lives and moves, the result won’t hold up under scrutiny even if it technically passes.
Recognising which of these applies to your organisation is the first step in an effective Essential Eight ML2 remediation plan, because it changes where you spend your time and budget.
Reading Your Assessment Report Without Losing the Plot
An assessment report can look alarming at first glance — rows of “not met” or “partially met” against controls you thought were solid. Before you react, separate the findings into three buckets.
Quick wins: configuration gaps that can be closed in days — enabling multi-factor authentication (MFA) on an application, tightening macro settings, adjusting application control rules. These often make up more of the report than people expect.
Documentation gaps: controls that are technically in place but not evidenced. This is a process fix, not a technical one — building the logging, reporting, and audit trail that proves the control is operating.
Structural gaps: genuine deficiencies that require investment — no patch management tooling, no application control solution, no centralised logging. These take longer and usually need a budget conversation.
Most failed assessments we see are weighted heavily toward the first two categories. That matters, because it means remediation timelines are usually shorter than the initial report makes them feel.
The Eight Controls, and Where Gaps Cluster
Not all Essential Eight gaps are created equal. Across the Defence SME clients we work with, gaps cluster consistently around a handful of controls.
Application control is the most commonly failed control at ML2. It requires application control on workstations and servers, covering a defined set of executable types, not just the well-known ones. Many SMEs implement it partially — workstations only, or executables only — which won’t satisfy ML2.
Patch applications and patch operating systems trip organisations up on timeframes, not intent. ML2 requires patching of internet-facing services within 48 hours of a critical vulnerability being identified, and everything else within two weeks. Without automated patch management and reporting, hitting these windows consistently — and proving it — is genuinely hard to do manually.
Restrict administrative privileges is a perennial gap because it’s organisationally uncomfortable. It means separating admin accounts from standard user accounts, restricting what admin accounts can access (no internet, no email), and revalidating admin access regularly. SMEs with small IT teams often resist this because it feels like it slows people down.
Multi-factor authentication should be the easiest control on the list, and increasingly is — but ML2 requires MFA for all users, for all remote access, and for privileged actions, which catches out organisations that enabled it for email but stopped there.
Regular backups fails almost as often on the testing requirement as on the backup itself. ML2 expects restoration testing performed and documented, not just a backup job that runs silently in the background.
A Practical Essential Eight ML2 Remediation Sequence
Once you know where your gaps sit, sequence the remediation work rather than trying to fix everything simultaneously. Here’s the order that consistently gets Defence SMEs back to a pass fastest.
1. Fix the quick configuration wins first. MFA rollout, macro restrictions, and Office hardening settings can usually be closed within one to two weeks and immediately reduce the number of open findings.
2. Build the evidence trail for what’s already working. If a control is functionally in place but undocumented, this is often the fastest category to close. Standardise your patch logs, your vulnerability scan cadence, your backup testing records, and your admin access reviews into a format an assessor can actually review.
3. Tackle application control and administrative privilege restrictions. These are the structural gaps that take longest, so start them early even though they’ll finish last. Application control in particular benefits from a staged rollout — pilot group first, then broader deployment — rather than a big-bang change that breaks business-critical software.
4. Re-scope if needed. If your original assessment covered the wrong environment, correct the scope definition before you re-test. There’s no point remediating gaps in a system that was never the right target in the first place.
5. Conduct an internal validation pass before re-assessment. A dry run against the Essential Eight ML2 criteria, ideally by someone other than whoever implemented the fixes, catches the gaps that get missed when you’re too close to the work.
This sequence typically compresses a “start from scratch” mindset into a focused six-to-ten week program for most SMEs — assuming the structural gaps aren’t extensive.
Don’t Let a Failed Assessment Sink the Contract
A failed Essential Eight assessment feels like a setback, but Defence primes and the Australian Signals Directorate both understand that remediation is a normal part of the compliance journey. What matters more than a clean first attempt is how quickly and credibly you close the gaps afterward. SMEs that treat a failed result as useful diagnostic information — rather than a crisis to be hidden — are almost always the ones who come back with a stronger, more defensible security posture the second time around.
The Bottom Line
A failed Essential Eight ML2 assessment tells you exactly where your compliance program is thin — it doesn’t tell you your organisation is unfit for Defence work. The SMEs who recover fastest are the ones who separate quick wins from structural fixes, build the evidence trail alongside the technical work, and re-test with a validated program rather than guesswork.
Where does your organisation’s Essential Eight gap most likely sit — evidence, implementation, or scope? Take the 5-minute assessment or book a strategy call to find out where the right level fits your business.
Book a Strategy Call — a focused conversation with one of our advisors to talk through your situation and identify the fastest compliant pathway into the defence supply chain. No jargon, no sales pitch — just a straight assessment of where you stand and what needs to happen next.
Start with a DISP Quick Start Assessment — a structured review of your current security posture across the four DISP domains, giving you a clear baseline, a prioritised gap list, and a practical roadmap before you commit to anything further.
Both options are designed to give you clarity quickly — so you can move forward with confidence rather than sit on the sidelines while contracts go elsewhere.
DefencIQ is a Brisbane-based cybersecurity and defence compliance consultancy specialising in DISP membership and Essential Eight Maturity Level 2 compliance for Australian SMEs. Visit defenciq.com.au to learn more.
