Essential Eight,
aligned with a posture you own.
Australia’s eight mitigation strategies, measured against the ACSC Maturity Model. This is an assessment, not a certificate: I score where you stand today, set a target maturity level to your risk, and do the hands-on work alongside your team to get you there.
A maturity model, not a pass or fail.
The Essential Eight is the Australian Signals Directorate’s set of eight mitigation strategies, maintained by the ACSC. There is no certificate to earn. Instead you assess yourself against a maturity model and hold a scored posture that shows exactly how well each strategy is implemented, and where the gaps are.
That scored posture is what buyers, insurers and DISP-readiness reviews increasingly want to see. My job is to make the assessment honest and useful: a clear picture of where you stand, a target level matched to your risk, and the evidence to back it up when someone asks.
Eight strategies. Every one measured.
Application control
Only approved applications are allowed to run, so untrusted and malicious code cannot execute.
Patch applications
Applications kept current, with known-exploited flaws in internet-facing software patched within 48 hours, as the model requires.
Configure Microsoft Office macro settings
Office macros disabled or restricted, so a common malware delivery route is shut down.
User application hardening
Web browsers and applications configured to strip out risky features attackers rely on.
Restrict administrative privileges
Admin rights granted on genuine need, reviewed regularly and kept off everyday accounts.
Patch operating systems
Operating systems patched and supported, so known holes in the platform stay closed.
Multi-factor authentication
A second factor on the accounts and services that matter, so a stolen password is not enough.
Regular backups
Backups taken, retained and tested for recovery, so you can restore after an incident.
Four levels, zero to three. One matched to your risk.
Each strategy is measured against the model’s maturity levels, defined by the sophistication of the attacker you are defending against. Below the baseline sits Maturity Level Zero; Levels One to Three raise the bar from there. I help you set a realistic target level for your organisation, then get you there step by step, so the score reflects genuine implementation rather than intent.
Baseline defence
Guards against common, opportunistic attackers using widely available tools and known weaknesses.
- →Defends against untargeted, high-volume attacks
- →The sensible starting point for most organisations
- →Closes the weaknesses attackers try first
- →A clear, achievable first target
Capable adversaries
Stands up to more capable attackers who invest time and effort to bypass basic controls.
- →Defends against more capable, persistent attackers
- →The level many mid-sized and regulated organisations target
- →Tighter controls, verified more thoroughly
- →Stronger evidence for tenders and insurers
Maturity Level Three is the highest tier, aimed at advanced, targeted adversaries. Where your risk warrants it, we plan the path towards it rather than stretching for a number you cannot sustain.
Thinking about Essential Eight? Let’s map a realistic path in a free 20-minute call.
Start with an assessment→Done with you, not handed over a wall.
Score where you stand
We scope your systems and measure each of the eight strategies against the maturity model, so you see your real level today, strategy by strategy.
Close the gaps together
I guide your team through each fix in plain English, gathering evidence as we go, and move you towards the target level we agreed for your risk.
A posture you own
You end with a scored maturity report, a prioritised roadmap and an evidence pack, ready to show buyers, insurers and DISP-readiness reviews.
A posture you own, not a badge on a wall.
- ✓A scored Essential Eight maturity assessment
- ✓A prioritised remediation roadmap to your target level
- ✓An evidence pack you own and keep
- ✓Cross-mapping to CIS Controls and NIST CSF
- ✓A re-assessment reminder, so your posture stays current
- ✓The confidence to speak to your own security
The things buyers usually ask.
Is there an ACSC certificate at the end?
No. The Essential Eight is a maturity model, not a certification scheme, so there is no badge or certificate to earn. What you hold instead is a scored posture: a documented, evidenced record of your maturity level for each of the eight strategies, which you own and can show whenever it is asked for.
Which maturity level do we need?
It depends on your risk and who is asking. Most organisations start by targeting Maturity Level One, while regulated and higher-risk organisations aim for Level Two or Three. I help you set a target that matches your threat profile and what your buyers and insurers expect, rather than chasing a number for its own sake.
Do we need to be an Australian entity to use it?
No. The Essential Eight is used well beyond Australia as a practical, well-respected baseline, and it is also valuable for organisations seeking access to the Australian market. If a different framework is a better fit for your region, I will tell you honestly.
How does it map to other standards?
The eight strategies map closely onto other frameworks. As part of the assessment I cross-map your posture to CIS Controls and NIST CSF, so the work you do here counts towards those too and you are not starting from scratch when a buyer asks for a different standard.
How long does it take?
A typical assessment and initial alignment runs around four to six weeks. It depends on the size of your environment, your target maturity level and how quickly your team can make the changes. I set a re-assessment reminder so your posture stays current rather than drifting.
Ready to see where you stand against the Essential Eight?
Tell me a little about your environment and I’ll map a realistic path to your target maturity level. A free 20-minute call, no obligation.