I keep seeing "what E8 maturity level should we target?" — here's the practical answer no one tells you

I keep seeing variations of this question in here and r/cybersecurity : "Our procurement team is asking about Essential Eight Maturity Level 2 — what do we actually need to do?" There's a lot of consultant-speak floating around. Here's the practical version, from an ASD-endorsed IRAP assessor who l