Maturity Level One targets adversaries who are content to use commodity tradecraft that is widely available. They are not interested in you specifically. They scan broadly, exploit vulnerabilities that already have public exploits, and try credentials that have already leaked. Level One is the set of controls that makes that approach fail.
It is the most achievable level, and it is still where most unassessed organisations fall short. Here is what it asks for, strategy by strategy.
Patch applications
- Automated asset discovery at least fortnightly, feeding vulnerability scanning.
- A vulnerability scanner with an up-to-date vulnerability database.
- Scanning at least daily for internet-facing online services, and at least weekly for office productivity suites, browsers and their extensions, email clients, PDF software and security products.
- Patches for online services applied within 48 hours where the vendor assesses the vulnerability as critical or a working exploit exists, and within two weeks where it is non-critical and no working exploit exists.
- Patches for office productivity suites, web browsers and their extensions, email clients, PDF software and security products applied within two weeks of release.
- Anything no longer supported by its vendor removed.
Patch operating systems
- Scanning at least fortnightly for operating systems across workstations, servers and network devices.
- Internet-facing servers and network devices patched within 48 hours where the vendor assesses the vulnerability as critical or a working exploit exists, and within two weeks otherwise.
- Workstations and non-internet-facing systems patched within one month.
- Unsupported operating systems replaced — not isolated, replaced.
Multi-factor authentication
- MFA for users authenticating to your own internet-facing services.
- MFA for third-party internet-facing services that hold your sensitive data.
- MFA, where available, for third-party services holding non-sensitive data.
- MFA using either something you have plus something you know, or something you have that is unlocked by something you know or are. Two passwords is not MFA, and neither is a password plus a security question.
Work through Level One with the evidence attached
GRC Copilot ships Maturity Level One as a ready-made assessment: every requirement, evidence upload against each one, and a gap report you can hand to an assessor.
Try GRC Copilot free Generate an AI-powered assessment Download checklist Book a demo
Restrict administrative privileges
- Privileged access requests validated when first requested.
- Privileged accounts, other than privileged service accounts, blocked from the internet, email and web services.
- Privileged users operating separate privileged and unprivileged environments.
- Unprivileged accounts unable to log on to privileged environments, and privileged accounts unable to log on to unprivileged ones.
The separation requirement is the one that turns into a project. It is an architectural change, and organisations that try to satisfy it with policy alone tend to fail assessment.
Application control
- Application control implemented on workstations.
- Execution restricted to an organisation-approved set, covering executables, software libraries, scripts, installers, compiled HTML, HTML applications and control panel applets.
Two bullet points, and reliably the longest piece of work in the whole level. The requirement is not "have an allowlisting product licensed" — it is that unapproved code cannot execute.
Restrict Microsoft Office macros
- Macros disabled for users without a demonstrated business requirement.
- Macros in files originating from the internet blocked.
- Macro antivirus scanning enabled.
- Users unable to change macro security settings.
User application hardening
- Browsers not processing Java from the internet.
- Browsers not processing web advertisements from the internet.
- Internet Explorer 11 disabled or removed.
- Users unable to change browser security settings.
Regular backups
- Backups of important data, software and configuration performed and retained in line with business continuity requirements.
- Backups synchronised to enable restoration to a common point in time.
- Backups retained in a secure and resilient manner.
- Restoration tested as part of disaster recovery exercises.
- Unprivileged accounts unable to access, modify or delete backups belonging to other accounts.
The backup requirements are where organisations lose marks for the smallest reason. Backups almost always exist. A documented restoration test, and access restrictions that survive inspection, frequently do not.
The evidence to hold
For each strategy, expect to produce: current configuration exports, a report showing patch age against the required timeframe over a period rather than a point in time, the asset inventory the scanning is based on, screenshots or policy exports for enforced settings, and dated records for the restoration test. Assessors look for continuity — a control that was correct on the day of assessment but cannot be shown over the preceding months invites questions.
Frequently asked questions
Is Level One enough?
It is enough to defeat opportunistic, commodity attacks, which is a large share of what most organisations face. It is not designed to stop an adversary willing to invest effort in you specifically — that is Level Two and above.
Do we need a dedicated application control product?
Not necessarily. The requirement is about outcome, and native platform capabilities can satisfy it where they are configured and enforced properly. The effort is in defining and maintaining the approved set, whatever tool enforces it.
Does MFA on email alone satisfy the MFA strategy?
No. Level One reaches all internet-facing services you operate, plus third-party services holding your sensitive data. Email is usually the first one implemented and rarely the only one in scope.
What counts as an exploit existing, for the 48-hour timeframe?
Treat a public working exploit, or credible reporting of active exploitation, as triggering the shorter window. Define your interpretation in advance and apply it consistently, so the decision is not made under pressure during an incident.
Key takeaways
- Level One defeats opportunistic attackers using public exploits and leaked credentials.
- Two passwords is not multi-factor authentication.
- Unsupported software must be removed or replaced, not isolated.
- Application control and privileged environment separation are the long-lead items.