Maturity Level Three targets adversaries who are adaptive, much less reliant on public tools, and specifically interested in evading your detection. They exploit weak configuration and inadequate monitoring rather than unpatched software, and once inside they work to solidify access. Level Three is built around that behaviour.
Two themes run through the whole level: remove the legacy attack surface entirely rather than configuring around it, and make your telemetry survive an intruder who already has privileges.
Authentication extends to data repositories
Phishing-resistant MFA is already required at Maturity Level Two, so it is not new here. What Level Three adds is reach:
- MFA extends to users and privileged users of data repositories, not only systems and online services.
- MFA logs centrally logged, analysed in a timely manner, and protected from unauthorised modification and deletion.
If you arrive at Level Three without phishing-resistant authentication already in place, you did not meet Level Two — this is one of the most common places an overstated maturity claim comes apart.
Administration becomes just-in-time
- Just-in-time administration — privilege granted for the task and withdrawn afterwards, rather than held standing.
- Windows Defender Credential Guard and Remote Credential Guard enabled.
- Privileged access and privileged account management logs protected from modification and deletion.
Standing administrative access is the thing an adaptive adversary is looking for. Just-in-time removes the prize rather than defending it.
Application control everywhere
- Implemented on workstations, internet-facing servers and non-internet-facing servers.
- Drivers added to the restricted set.
- Microsoft's recommended application blocklist and vulnerable driver blocklist implemented.
- Rulesets validated annually; events centrally logged and protected.
The driver blocklist matters more than it sounds. Bring-your-own-vulnerable-driver is a standard technique for disabling security tooling from kernel space, and it is exactly the move a Level Three adversary makes.
Assess against the full Level Three requirement set
GRC Copilot ships Maturity Level Three as a complete assessment — every requirement across all eight strategies, with evidence tracking and gap reporting.
Try GRC Copilot free Generate an AI-powered assessment Download checklist Book a demo
Macros: sandboxed, trusted or signed
- Macros may only run from a sandboxed environment, a Trusted Location, or when digitally signed by a trusted publisher.
- Only privileged users responsible for validating that macros are free of malicious code may write to Trusted Locations.
- Macros signed by an untrusted publisher cannot be enabled via the Message Bar or Backstage View.
- The Trusted Publishers list validated at least annually.
- Allowed and blocked macro execution events centrally logged and protected.
Legacy runtimes removed
- .NET Framework 3.5, including 2.0 and 3.0, disabled or removed.
- Windows PowerShell 2.0 disabled or removed.
- PowerShell configured to use Constrained Language Mode.
- PowerShell script block logs and command line process creation events centrally logged.
PowerShell 2.0 is the clearest example of the level's philosophy. It exists on systems for backwards compatibility and it bypasses the logging that later versions provide. Configuring around it is not the answer; removing it is.
Logs that survive the intruder
The requirement that event logs are protected from unauthorised modification and deletion appears across application control, macros, user application hardening, privileged access and MFA. It is the quiet centrepiece of Level Three.
An adversary who reaches administrative privilege will attempt to clear or edit logs. If your logging destination accepts writes and deletes from the same credentials that were compromised, your telemetry disappears exactly when it matters. Meeting this means append-only or write-once storage, separate credentials, and ideally a separate trust boundary.
Is Level Three worth it?
ASD's own guidance is to choose a target level based on the adversaries you expect to face, not to treat Level Three as universally correct. It is expensive: hardware authenticators, just-in-time tooling, application control across every server, and a logging platform with tamper resistance. For organisations holding nationally significant data, operating critical infrastructure, or already targeted, it is proportionate. For many others, a fully met Level Two is a better use of the same budget than a partial Level Three — and partial is assessed as the lower level anyway.
Frequently asked questions
What counts as phishing-resistant MFA?
Methods where the authentication is cryptographically bound to the legitimate site or service, so a relaying attacker cannot reuse it. Hardware security keys and platform authenticators based on the same standards qualify; codes typed by a user do not, because a user can be induced to type them into an attacker's page.
Does just-in-time administration require a specific product?
No. The requirement is that privilege is granted for a task and withdrawn afterwards rather than held permanently. Several platform and third-party approaches satisfy it; what matters is that standing privilege is genuinely eliminated and that the grants are logged.
Can we reach Level Three in some strategies only?
You can, and tracking it that way is useful. But the reported maturity is the lowest level achieved across all eight, so mixed levels are reported at the lowest one. Completing Level Two everywhere beats reaching Level Three in three strategies.
How do we protect logs from a compromised administrator?
Send them to a destination that does not accept deletion or modification from the source environment's credentials — append-only storage, a separate account or tenancy, or a dedicated logging platform with its own access control. The test is simple: if the credentials an intruder is likely to obtain can also erase the evidence, the requirement is not met.
Key takeaways
- Phishing-resistant MFA rules out codes a user can be tricked into typing.
- Just-in-time administration removes standing privilege rather than defending it.
- The vulnerable driver blocklist counters a standard technique for disabling security tooling.
- Tamper-resistant logging is the theme that ties the whole level together.