Essential Eight assessment and uplift, end to end
We measure your environment against the ACSC Essential Eight maturity model, close the gaps with your IT team, and evidence the result in a form that answers government tenders, customer security reviews and insurers. Fixed fee agreed up front.
What is the Essential Eight?
The Essential Eight is the Australian Cyber Security Centre's (ACSC, part of the Australian Signals Directorate) prioritised set of eight mitigation strategies for the most common cyber threats. Each strategy is assessed on a maturity model of four levels, from Maturity Level Zero to Maturity Level Three. It is a maturity model, not a certification: organisations assess and uplift their maturity rather than pass an audit.
Who this is for
When Essential Eight uplift is the ask
Essential Eight maturity usually arrives as someone else's requirement before it becomes your own priority. If any of these sound familiar, this is the engagement.
A NSW Government tender or panel arrangement asks you to state your Essential Eight maturity level, with evidence.
A Commonwealth customer flows Essential Eight expectations down from its own PSPF obligations into your contract.
An enterprise customer's security review wants proof of technical controls, not just policies.
A cyber insurer asks for maturity evidence at renewal, and last year's answers no longer hold.
You have had an incident or a near miss, and want the eight controls that block the most common attacks in place properly.
What you receive
What the engagement includes
From the first assessment to the evidence pack, everything built to survive scrutiny from whoever asked for your maturity level.
Maturity assessment
An evidence-based assessment of all eight strategies against the ACSC maturity model, following ASD's assessment guidance. You get a maturity level per strategy, not an average, because the weakest strategy sets your overall level.
Target level & gap analysis
The gaps between where you are and where you need to be, ranked by risk and effort, with a target maturity level set to your obligations: a tender, an insurer, or your own risk appetite.
Remediation roadmap
A prioritised uplift plan with realistic sequencing. ASD recommends reaching the same level across all eight strategies before chasing a higher one, and the roadmap is built that way.
Uplift implementation support
Hands-on help across the eight strategies, from application control and patching to macros, hardening, admin privileges, MFA and backups, delivered with your IT team or managed provider rather than around them.
Evidence pack & reporting
Documentation of what is implemented, how it is configured and how it is tested, written to stand up in tenders, customer security reviews and insurer questionnaires.
Independent re-assessment
A fresh maturity assessment once the uplift lands, producing a report of your new level that you can put in front of whoever asked for it.
The process
How the engagement runs
The maturity assessment takes two to three weeks for most organisations. Uplift to the next level typically runs three to six months, depending on your starting point and how much your own IT team or provider can take on.
Weeks 1–3
Maturity assessment
We assess your environment against all eight strategies using ASD's assessment guidance, reviewing configuration and testing evidence rather than taking policy documents at face value.
Weeks 3–4
Target level & roadmap
We agree the target maturity level with you, rank the gaps, and sequence the uplift so all eight strategies move together. The fixed-fee quote for the uplift follows from this.
Months 2–5
Uplift implementation
Controls are implemented with your IT team or provider: application control, patching cadence, macro restrictions, hardening, privileged access, MFA and backup testing.
Close out
Re-assessment & evidence pack
We re-assess against the maturity model, confirm the new level, and hand over the report and evidence pack in a form that answers tenders, reviews and insurers.
Not sure where you sit today? The free Essential 8 quiz gives you a rough read on your maturity in a few minutes, and the small business guide to the maturity model explains what each level asks.
Pricing
What Essential Eight uplift costs
One fixed consulting fee, quoted in writing after the gap assessment. No hourly billing.
Because the Essential Eight is a maturity model rather than a certification, there is no certification body fee in the budget. The cost of an uplift is our fixed consulting fee plus your own team's time, and any tooling a genuine gap calls for. The fee is fixed by scope, which is why every engagement starts with a cybersecurity gap analysis: you get a ranked remediation plan and a fixed quote for the uplift before you commit to it.
We hold no reseller agreements and take no vendor margin, so the roadmap recommends what closes the gap, not what pays a commission.
The drivers
Who asks for Essential Eight maturity
Government is the strongest driver. The NSW Cyber Security Policy requires NSW government agencies to report their Essential Eight maturity, with a minimum of Maturity Level One in the current edition, so suppliers to NSW Government encounter Essential Eight expectations in tenders and contracts. At the Commonwealth level, the Protective Security Policy Framework has required non-corporate Commonwealth entities to maintain Maturity Level Two since July 2022, and those obligations flow down to the suppliers who hold government data or run government systems.
Beyond government, enterprise security reviews increasingly ask for Essential Eight maturity as a shorthand for technical control hygiene, and cyber insurers reference it as a baseline at renewal. Our Essential Eight framework guide covers who the model applies to and what each strategy requires.
Why CyberNinja
Why organisations choose us
Assessed the way ASD writes it
Our assessments follow ASD's own maturity model and assessment guidance, strategy by strategy and level by level. No averaged scores, no inflated ratings that fall apart under a customer's own assessor.
We work with your IT provider
Most uplift lands on the people who run your environment day to day. We implement with your internal IT team or managed provider, and leave behind configuration they can maintain.
Independent advice
We hold no reseller agreements and take no vendor margin. Where a gap genuinely needs new tooling, we tell you the category, not a brand we are paid on.
Fixed scope, fixed fee
The uplift is scoped from the assessment findings and quoted as a fixed fee in writing. No hourly billing, no surprise extras.
Want the model itself first? Our Essential Eight framework guide explains the eight strategies and the maturity levels, and the knowledge base goes strategy by strategy.
FAQ
Essential Eight assessment and uplift FAQs
Prefer to read up first? Browse our Knowledge Base for compliance guides and articles.
Ready to lift your Essential Eight maturity?
Tell us who is asking for your maturity level and when they need evidence. We will scope the assessment and give you a fixed price, so you know the cost before you commit.