Skip to content
Cyber Guys

Improve

Essential Eight uplift

Know your Essential Eight maturity, and lift it to the level you choose.

We assess where you stand against the current ASD Essential Eight Maturity Model, agree the maturity level you want to reach, then plan, make and verify the changes to get there. Maturity is assessed for each of the eight strategies separately, and your overall level is the lowest level across the eight — never an average. The result is an evidenced assessment, not a certification.

Request a quote
Price
Quoted on scope
How you can engage us
One-off project · Ongoing service · Project, then ongoing
Delivered by
Cyber Guys
Review cadence
Quarterly when continued as an ongoing service, and when ASD updates the Maturity Model

Who it is for

Businesses asked by clients, insurers or their board to show where they stand against the Essential Eight, and to improve it.

Scope

The eight mitigation strategies — patch applications, patch operating systems, multi-factor authentication, restrict administrative privileges, application control, restrict Microsoft Office macros, user application hardening and regular backups — across the systems and devices agreed in the scope.

What is included

  • A baseline assessment against the current ASD Essential Eight Maturity Model, with the version recorded
  • Maturity assessed for each of the eight strategies separately
  • An agreed target maturity level
  • Gap analysis between current and target maturity, for each strategy
  • An implementation plan, ordered by risk and dependency
  • Technical changes you approve, within the agreed scope
  • A register of exceptions you accept, with the reason and review date for each
  • Evidence collected for each requirement
  • Verification of each change against the Maturity Model requirement it addresses
  • Maintenance reviews when continued as an ongoing service

What is not included

  • Work outside the agreed scope, which is quoted separately
  • Certification of any kind: ASD does not certify Essential Eight maturity, and neither does Cyber Guys
  • Purchasing or licensing application control, patching, backup or device management tools
  • Hardware replacement or upgrading unsupported operating systems
  • Remediating line-of-business applications that block a control, beyond identifying the issue
  • Penetration testing (available as a separate service)

How delivery works

  1. 01

    Assess

    We assess each of the eight strategies against the current Maturity Model, collecting evidence from your systems rather than relying on answers alone.

  2. 02

    Agree the target

    We agree a target maturity level with you, show the gaps for each strategy and order the work by risk and dependency.

  3. 03

    Implement

    We make the agreed changes, or coordinate your IT provider where they own the system, inside agreed change windows.

  4. 04

    Verify

    Each change is checked against the requirement it addresses. Requirements that cannot be met are recorded as exceptions you accept, not marked as done.

  5. 05

    Maintain

    Optional: an ongoing service re-checks maturity on a schedule, updates evidence and reassesses when ASD updates the Maturity Model.

Who does what

You

  • Name a decision-maker who can approve the target maturity, changes and exceptions
  • Provide named, least-privilege administrator access (never a shared password)
  • Tell us about applications and workflows a change might affect
  • Approve or decline each proposed change and exception

Cyber Guys

  • Assess each strategy against the current Maturity Model and explain the result
  • Report maturity per strategy and the overall level as the lowest across the eight
  • Plan each change with its business impact and rollback
  • Make or coordinate the agreed changes and verify them
  • Keep the exception register and evidence up to date

Your IT provider or partner

  • Your IT provider, where they manage a system, makes or approves changes to it and confirms the result

Access we need

  • A named administrator account in your identity platform
  • Access to device management, patching and backup consoles
  • A sample of devices for verification checks

We never ask for your password. Access is through a named account that you or your IT provider create for the engagement, and can remove at any time.

Dependencies and licences

  • Application control, macro settings and user application hardening are usually enforced through device management, which needs suitable licensing and enrolled devices
  • Higher maturity levels require phishing-resistant multi-factor authentication, which may need compatible devices or security keys
  • Unsupported operating systems or applications cannot meet patching requirements until they are replaced

What you receive

  • Baseline maturity assessment, per strategy, with the Maturity Model version recorded
  • Gap analysis and implementation plan
  • Change log with verification results
  • Exception register
  • Evidence pack
  • Updated maturity statement, per strategy and overall

How we know it is finished

  • Every in-scope requirement is verified as met, recorded as a gap with a plan, or recorded as an exception you accepted
  • Maturity is reported for each strategy, with the overall level stated as the lowest of the eight
  • The evidence pack and updated maturity statement are delivered

Related services

Request a quote for Essential Eight uplift

Tell us a little about your business. We will arrange a short scoping call to agree what is in scope and send a written quote. The call is about scope and price — it is not free security advice.

Please do not include passwords or other access details.

This asks us to scope Essential Eight uplift. The scoping call is a sales conversation, not a free security review, and nothing is ordered until you accept a written quote.