Essential Eight
Essential Eight assessment, maturity tracking and evidence — in plain English.
The ASD Essential Eight is the baseline Australian insurers, tender panels and grant programmes increasingly ask about. Cyber Guys assesses you against all eight strategies at every maturity level, turns the gaps into owned work, and shows the movement between assessments.
- All eight strategies across 24 assessed requirements
- Maturity Levels 1, 2 and 3, assessed per strategy
- Gaps become recommendations with an owner and a decision
- Answers count towards NIST CSF, ISO 27001, CIS and insurer questions too
A structured self-assessment, clearly labelled as one. Cyber Guys is not a certification body and issues no Essential Eight accreditation.
Current assessment, all eight strategies
- Application controlLevel 1
- Patch applicationsLevel 2
- Office macro settingsLevel 2
- User application hardeningLevel 1
- Restrict admin privilegesLevel 0
- Overall maturityLevel 0
The overall level is held by the weakest strategy — which is exactly where the next piece of work should go.
The basics
What the Essential Eight is.
Eight mitigation strategies published by the Australian Signals Directorate, chosen because together they stop or limit the overwhelming majority of the intrusion techniques Australian organisations actually encounter. They are not a legal obligation for most private businesses — they are the practical baseline everyone has started measuring against.
Application control
Only approved applications are allowed to run, so an executable that arrives by email cannot simply start.
Patch applications
Internet-facing applications patched within two weeks, or within 48 hours where a vulnerability is being actively exploited.
Configure Microsoft Office macro settings
Macros blocked for people who do not need them, and blocked outright when they arrive from the internet.
User application hardening
Browsers, PDF readers, Office and PowerShell configured to remove the features attackers rely on.
Restrict administrative privileges
Admin rights validated, separated from day-to-day accounts and revalidated on a schedule.
Patch operating systems
The same patch discipline as applications, applied across workstations, servers and network devices.
Multi-factor authentication
MFA on internet-facing services, extended to privileged users and important data, and ultimately phishing-resistant.
Regular backups
Backups performed, retained and — the part people skip — actually tested, with restoration proven rather than assumed.
Why it matters here
Why Australian organisations keep being asked about it.
- Cyber-insurance questionnaires increasingly ask questions that map directly onto it.
- Government and enterprise procurement often asks for a maturity position.
- Grant programmes and industry bodies use it as a common reference point.
- Larger clients push their own security expectations down to smaller suppliers.
- It is specific enough to act on, unlike “do you take security seriously”.
- It is published by the ASD, so nobody has to argue about whose framework to use.
The maturity model
Four levels, assessed strategy by strategy.
Weaknesses in the organisation’s overall posture. Not a failing grade — a starting point, and an honest one.
Mitigates techniques used by attackers who take whatever opportunity is available, using widely known methods.
Mitigates attackers willing to invest more time and effort in a specific target, and to bypass basic controls.
Mitigates adaptive attackers who focus on a particular target and are less reliant on widely available tooling.
How Cyber Guys helps
Assess it, fix it, evidence it, then show the movement.
- 1
Assess against the maturity model
Work through each of the eight strategies at Maturity Level 1, 2 and 3. Every requirement records a status, a note and the evidence behind it.
- 2
See where the level actually sits
Maturity is assessed per strategy, and the overall level is constrained by the weakest one — which is how the model is designed to work, and why a single averaged score would be misleading.
- 3
Turn gaps into owned work
Unmet requirements become recommendations in business language, with urgency, effort, indicative cost and a named owner. Declines become recorded risk acceptances.
- 4
Reassess and show the movement
The next assessment sits alongside the last one. Going from Level 1 to Level 2 becomes a dated comparison you can hand to an insurer, a board or a tender panel.
Self-assessment, readiness and independent assurance are three different things
This distinction matters more than any feature on this page, because presenting one as another is how organisations end up with a problem at claim time or tender time.
- Self-assessment
- You or your IT provider record the answers. Cyber Guys structures, maps, evidences and tracks them. This is what the platform produces, and every export says so on its face.
- Readiness
- A judgement about how well-positioned you are — useful for prioritising work and for answering an insurer honestly. It is not a pass, and it is not conferred by anyone.
- Independent assurance
- An external assessor examines your environment and forms their own opinion. Cyber Guys does not do this and cannot substitute for it. What it can do is make that engagement much cheaper, because the evidence is already collected and organised.
For IT providers
The Essential Eight across a whole client base.
One assessment per client is a spreadsheet. Forty is a service line — but only if the answers, the evidence and the client decisions live somewhere structured.
- Assess every client against the same model, with their own history and evidence.
- Compare maturity across the client base to find where the portfolio risk sits.
- Run one remediation campaign — MFA, backup testing, admin separation — across many clients.
- Publish recommendations to each client’s portal in your branding, and capture their answer.
- Record the risks a client declines, with a named person and a review date.
- Produce a per-client maturity report for their board, insurer or tender response.
12 of 40 clients assessed this quarter
- Northside LegalLevel 2
- ABC DentalLevel 0
- Harbourview ConstructionLevel 1
- Weakest strategy across bookApplication control
- Campaign in flightMFA enforcement
- Risks accepted this quarter7
Illustrative. Every client is a separate tenant, and access is scoped to the clients on your plan.
Questions
Essential Eight, answered honestly
See your Essential Eight position in fifteen minutes.
We will walk an assessment through from scoping to the maturity view, the gap list and the report you would hand to an insurer.