Essential Eight assessment
Know your Essential Eight maturity, with the evidence to back it.
We test each of the eight strategies against evidence and tell you where you stand, what it will take to reach your target, and in what order.
Talk to an Engineer- What's tested: all eight strategies, against evidence, to ASD's maturity model.
- How long: about one week for up to 50 staff, about two weeks for up to 200.
- Fixed scope and fixed fee, credited against the uplift if you go ahead within 60 days.
- Fixed scope, fixed fee
- Microsoft Partner
- AZ-104 and AZ-305 certified engineers
- Senior engineers only
- Brisbane-based, working across Australia
Who it is for
Any organisation that needs to know or show its Essential Eight maturity: suppliers with a contract clause, SOCI entities, APRA-regulated entities, and anyone whose insurer or board has started asking. We assess Microsoft-centred, hybrid and cloud-only environments, from ten staff to several thousand.
How long it takes
- Up to about 50 staff: around one week, based on configuration evidence from your tenant.
- 50 to 200 staff: around two weeks.
- 200 to 2,000 staff: three to four weeks, including sampling across devices, servers and accounts.
- Larger organisations: scoped to the systems in question.
What we test
All eight strategies against ASD's Essential Eight Maturity Model, following ASD's assessment process guidance. Stronger evidence wins: a test that shows a control working counts for more than a screenshot of a setting, and a setting counts for more than a policy document.
What you receive
- A maturity level for each strategy, with the evidence behind it
- The gaps to your target level, written so an engineer can act on them
- A recommended target, with the reasoning
- A dated uplift plan with effort, dependencies and business impact
- The Microsoft licences you would need, if any
- A one-page summary for leadership and the board
What we need from you
- Read-only administrative access to Entra ID, Intune, Defender and Microsoft 365, plus Active Directory and your patch and backup tools where you have them
- About three hours across a kick-off, interviews and the readout
- An application owner for the application control conversation, in larger organisations
After the assessment
The findings are yours to use with any provider. If you ask us to deliver the uplift within 60 days, the assessment fee is credited against it. The uplift is a fixed fee, paid by milestone once each milestone's evidence is accepted.
How it runs
- Scoping: we agree the systems in scope, the target you are working towards and the version of the maturity model your contract or auditor refers to.
- Assessment: evidence collection, testing and sampling across the environment.
- Readout: results and the uplift plan, walked through with your leadership and technical team.
- Uplift, if you want it: controls delivered in planned phases, piloted and rolled out in rings.
- Reassessment: evidence refreshed against your target level.
Questions buyers ask
Is this an IRAP assessment?
No. IRAP assessments are carried out by assessors registered under ASD's Infosec Registered Assessors Program. If your contract requires IRAP, tell us and we will help you prepare for it. For most organisations, an evidence-based assessment and uplift is what the contract, insurer or board is asking for.
Which maturity level should we aim for?
It depends on your obligations and the threats you face. Maturity Level One is the usual first target, and Level Two is common for government suppliers and regulated entities. ASD advises reaching the same level across all eight strategies before going higher.
Will application control break our applications?
Not if it is rolled out properly. Policies run in audit mode first, rules are built from what your people use, and enforcement is rolled out in rings with a quick exception process.
Is it worth assessing against the Essential Eight if it is being replaced?
Yes. Contracts, the SOCI rules and insurers still ask for Essential Eight levels, and ASD has said the work stays relevant under its new Essentials guidance.
Can we use the results with another provider?
Yes. The findings and plan are yours to use with anyone.
Do you certify us as Essential Eight compliant?
There is no Essential Eight certification. We measure maturity against evidence and give you an evidence pack you can show to a contracting agency, insurer or auditor.
Start a conversation
Find out where you stand before someone else asks.
Tell us what is driving the question and the level you need.
Talk to an Engineer