Essential Eight Readiness
Baseline · ACSC maturity assessment
A short engagement that maps your business to the ACSC Essential Eight maturity model — and produces the evidence pack your cyber insurer is now asking for at renewal time.
The included items, listed plainly. No asterisks, no fine print.
- 01Half-day discovery interview, on site or video
- 02Per-mitigation maturity assessment (ML0 → ML2)
- 03Plain-English gap report with prioritised remediation
- 04Evidence pack formatted for cyber-insurance questionnaires
- 05Optional remediation work, by the day, after the report
Three steps, then quiet.
- Step 01
Discovery interview
We sit with whoever runs your IT for half a day and walk through the eight ACSC mitigations against your current setup — application control, patching, macros, app hardening, admin privileges, OS patching, MFA, and backups.
- Step 02
Maturity assessment
We score each of the eight mitigations against ACSC Maturity Levels 0 through 2. The scoring is conservative — if the evidence is borderline, we mark it down so the report holds up under an insurer's scrutiny.
- Step 03
Evidence pack + roadmap
You get a written gap report and a paired evidence pack formatted for the questions cyber-insurance underwriters now ask at renewal. The remediation list is prioritised by risk and cost; most SMEs reach ML1 in six to twelve weeks.
Built for these operators.
- Australian SMEs renewing cyber insurance and being asked for E8 evidence
- Government suppliers and subcontractors required to demonstrate E8 alignment
- Small operators who keep hearing "Essential Eight" and would like a plain-English read
- Boards and owners who want a defensible answer to "what is our cyber posture?"
And what it is not.
- A certification. ACSC does not certify Essential Eight — anyone selling you a certificate is overselling. We give you evidence, not a stamp.
- A long-term retainer. The assessment is fixed-fee. Remediation is optional and billed by the day.
- A Maturity Level 3 project. ML3 is appropriate for federal government and critical infrastructure, not most SMEs. We will tell you when ML2 is enough.
The questions we hear frequently.
If yours is not here, write to us. We are honest when the answer is "it depends".
- 01
Will this satisfy our cyber insurer?
Most major Australian cyber insurers now ask the same questions on renewal. The evidence pack is structured to answer those questions in the language they use. We will not promise to satisfy a specific insurer, but we will tell you honestly if the answer is "no" before you submit.
- 02
How long does the assessment take?
Two weeks from kickoff. The on-site portion is half a day. The remainder is us writing and cross-checking the evidence.
- 03
Do you remediate the gaps?
We can, by the day, after the assessment. Many clients tackle the easy wins (MFA rollout, backup testing) themselves and ask us back for the harder items (application control, admin privilege restrictions). The report is written so either path works.
- 04
What maturity level should we aim for?
ML1 is the right immediate target for most Australian SMBs. ML2 is the twelve-month roadmap. ML3 is for federal government and critical infrastructure. The roadmap will say which is right for you.
Curious about Essential Eight Readiness?
Drop us a line. We will set up a friendly, no-pressure conversation and walk you through whether this is a fit for your situation.