Know your Essential Eight maturity, and how to lift it.

The Essential Eight is a set of eight mitigation strategies published by the Australian Signals Directorate’s Australian Cyber Security Centre: application control, patching applications, Microsoft Office macro settings, user application hardening, restricting administrative privileges, patching operating systems, multi-factor authentication and regular backups. Each is assessed against a maturity model from level zero to level three.

Each level is designed to resist a more capable adversary. Level One stops opportunistic attackers using widely available tools. Level Two stops attackers willing to invest more time and better tools in targeting you. Level Three stops adaptive, targeted attackers who are less reliant on public tools. Level Zero means the requirements of Level One are not met.

No one. There is no Essential Eight certificate, and the Australian Signals Directorate does not certify organisations or accredit Essential Eight assessors. Organisations either self-assess or engage an independent assessor, usually following the ASD’s Essential Eight Assessment Process Guide, and report the maturity level they reached. IRAP assessments by ASD-endorsed assessors are a separate, broader program, mostly for government systems and cloud services.

Yes. We run independent Essential Eight assessments against the ASD’s maturity model and assessment guidance, test the evidence behind every strategy, and report the maturity level you have actually reached. If a customer or contract specifically requires an IRAP assessment, we will tell you up front and get you ready for it.

Yes. Many clients want both: an assessment to set the baseline, help lifting the weaker strategies, then a reassessment to confirm the level. We keep the roles separate, so whoever assesses your maturity is not marking their own work. If a buyer insists on an assessor with no involvement at all, we will say so at the start.

Less than starting from scratch. ISO 27001 gives you the governance, risk assessment, asset inventory, policies and evidence habits the Essential Eight relies on, and its Annex A controls cover the same eight areas in principle. What the Essential Eight adds is prescriptive technical configuration: application control, macro and application hardening settings, fixed patching timeframes, MFA coverage and restore testing. For a cloud-first business on managed devices, Level One is often close; Levels Two and Three usually need real engineering work. We plan both together so the ISO 27001 evidence is reused.

No. ISO 27001 lets you choose controls based on your own risk assessment, so a certified organisation can still be at Level Zero for some strategies. The Essential Eight sets specific technical requirements regardless of your risk appetite. Tenders that ask for both expect to see both.

They answer different questions. The Essential Eight measures specific technical mitigations; ISO 27001 certifies a whole information security management system. Some tenders accept either, many ask for both. We help you read what the tender actually requires.

It depends on who is asking. Non-corporate Commonwealth entities are required to reach Maturity Level Two under the Protective Security Policy Framework, and many of their suppliers are asked for the same, but it varies. We start by confirming what your customers or contracts actually require, so you do not over-invest.