ASD Essential Eight · SMB1001 · Maturity Level 2
Essential Eight assessment and uplift
Find out exactly where you sit against the Australian Signals Directorate Essential Eight, which gaps matter most, and a costed path to the maturity level that fits your risk.
What is an Essential Eight assessment?
An Essential Eight assessment measures how well your organisation implements the eight mitigation strategies recommended by the Australian Signals Directorate: patching applications and operating systems, multi-factor authentication, restricting admin privileges, application control, restricting Office macros, user application hardening and regular backups. Each is rated from Maturity Level 0 to 3, and you get a roadmap to close the gaps.
// The framework
The Essential Eight, explained simply
The Essential Eight are the eight mitigation strategies the Australian Signals Directorate considers the most effective baseline for protecting Windows-based networks against common attacks. Each is assessed at Maturity Level 0 to 3.
| Strategy | What it means in practice |
|---|---|
| Patch applications | Apply security updates to internet-facing services, browsers, Office, PDF readers and other common software quickly; remove unsupported software. |
| Patch operating systems | Keep Windows, macOS, servers and network devices patched, and replace operating systems that no longer receive security updates. |
| Multi-factor authentication | Require MFA for email, remote access, cloud services and privileged accounts, preferably phishing-resistant methods. |
| Restrict administrative privileges | Give admin rights only to those who need them, review them regularly, and keep admin accounts away from email and web browsing. |
| Application control | Allow only approved programs and scripts to run on workstations and servers, so malware cannot simply execute. |
| Restrict Microsoft Office macros | Block macros from the internet and allow only trusted, vetted macros for users who need them. |
| User application hardening | Lock down web browsers, Office and PDF software, and disable risky features attackers rely on. |
| Regular backups | Back up important data, software and settings, keep copies attackers cannot change, and test restores. |
// Maturity levels
What each maturity level means
| Level | What it protects against |
|---|---|
| Maturity Level 0 | Weaknesses in the overall implementation. Most organisations that have never been assessed have several strategies at Level 0. |
| Maturity Level 1 | Opportunistic attackers using widely available tools and known exploits. |
| Maturity Level 2 | Attackers willing to invest a little more time and effort, including targeted phishing. The recommended target for most organisations. |
| Maturity Level 3 | Capable adversaries who are more adaptive and persistent. Typically for higher-risk organisations. |
What you get
- Maturity rating for each of the eight strategies, with evidence
- Summary for leadership and the board
- Risk register of the gaps that matter most
- Prioritised remediation roadmap to your target level
- Practical fixes you or your IT provider can action
- Optional SMB1001 mapping and certification support
We work with your IT provider during the assessment. Where remediation is needed on office networks, devices and Microsoft 365, we work with them or with our trusted Australian MSP partners.
Typical timeline
- 01
Scoping call
Systems, sites, users and your target maturity level.
- 02
Assessment
1 to 3 days of evidence gathering and testing.
- 03
Report
Maturity scores, risk register and roadmap within 5 business days.
- 04
Uplift
Optional help closing the gaps and re-assessing.
// FAQ
Common questions
Is the Essential Eight mandatory?
It is mandatory for non-corporate Commonwealth entities, which must reach Maturity Level 2. For private businesses it is not a legal requirement, but it is the baseline insurers, government buyers and larger customers increasingly expect.
Which maturity level should we aim for?
The Australian Signals Directorate recommends Maturity Level 2 as a sensible target for most organisations, because it addresses adversaries who are willing to put in modest effort. Many small businesses start by reaching Level 1 across all eight strategies, then move up.
How long does an assessment take?
For most small and medium organisations, the hands-on assessment takes one to three days depending on size and how many systems are involved. You receive the report and roadmap within five business days after that.
We use Microsoft 365. Does that cover us?
Microsoft 365 includes many of the tools, but most of the protections are off or only partly configured by default. Settings for MFA, macros, admin roles and backups need to be configured deliberately and checked.
What is the difference between the Essential Eight and SMB1001?
The Essential Eight is a set of technical mitigation strategies from the Australian Signals Directorate. SMB1001 is an Australian certification standard for small and medium businesses with tiered levels, covering technical controls plus policies and staff practices. We can assess against either, and many controls overlap.
// Keep going
Related services
Cyber Security Consulting
Independent cyber security consulting in Perth: risk assessments, Essential Eight, Privacy Act, incident readiness and board reporting. From $1,500.
Cyber Insurance Readiness
Get your cyber insurance questionnaire right. We verify MFA, backups, patching and email security, close gaps before renewal and document the evidence.
Vulnerability Scanning & Pen Testing
Vulnerability scanning, web app testing and penetration testing for Perth organisations, with clear reports, fixes and retests.
// Next step
Talk to us about Essential Eight Assessment
Tell us what you run and what you are worried about. We will come back within one business day and, if it helps, send you a fixed-price quote.
- No-obligation first consult
- Fixed scope and price before work starts
- A clear written report and next steps
Written and reviewed by Noah Greenstone, Founder and Principal Consultant. Last reviewed 22 October 2026.
Tell us what is going on
We read every enquiry and reply within one business day. If it is urgent, call 1300 566 652.
Organisations Noah and the team have built, secured and supported
