Essential Eight ready for an independent audit
We score your business against the Essential Eight, close the gaps in order of risk and keep the evidence your insurer, clients or auditor will ask for. Most businesses start at Maturity Level One.
Your price in two minutes, no email needed. Or call 1300 787 429.
Not sure where you stand? Take the five minute scorecard.
★★★★★ 4.9 on Google from 60+ reviews
- 150+Organisations protected by Austin SecureShield
- ML1Essential Eight Level 1 for InterContinental Energy, on our assessment
- ML2Essential Eight alignment for Powertech, helping win a defence client
- $60Per person a month for SecureShield Control, ex GST
Trusted by 300+ organisations, including
When the Essential Eight stops being optional
For most private businesses, Essential 8 compliance is not a legal requirement. It becomes one the day a client, insurer or Defence contract asks for your maturity level.
Someone has asked for your maturity level
Questionnaires now ask how you meet each strategy, not whether you have antivirus. A confident guess is a problem if you are later asked for proof.
FixA score for each strategy against Maturity Level One and Two, with the evidence behind every answer.
Everyone is a local administrator
Admin rights make software installs easy for staff and just as easy for malware that lands on their laptop.
FixSeparate admin accounts, no admin rights on daily accounts and a quick approval path when someone needs a new application.
Your team depends on Office macros
Blocking macros outright can stop finance or engineering work, so the control gets switched off and forgotten.
FixMacro rules tested with the people who use them. InterContinental Energy reached ML1, on our assessment, and its macro users kept working.
Backups exist but nobody has restored one
A backup that has never been restored cannot be relied on. Attackers also look for backups to delete.
FixBackups kept out of an attacker's reach, with restores tested on a schedule and the results recorded.
Tell us who is asking about your security. A technical consultant will scope it with you and send a fixed quote.
What each control stops and how we deliver it
The Essential Eight is a set of mitigation strategies from the Australian Signals Directorate (ASD). This is what each one does and the tools we use to put it in place.
| Strategy | What it stops | How we deliver it |
|---|---|---|
| Application control | Unapproved programs, scripts and installers running on your devices | ThreatLocker allow listing, built from the software your team uses |
| Patch applications | Attacks on known holes in browsers, Office, PDF readers and other apps | NinjaOne patching, with ConnectSecure scans to catch anything missed |
| Office macro settings | Malicious macros in documents from the internet or unknown senders | Macro policies set centrally and tested with the teams that rely on macros |
| User application hardening | Browsers and Office running risky content such as old plugins and ads | Hardening from the Microsoft 365 CIS baselines |
| Restrict admin privileges | An attacker taking full control with one stolen account | Separate admin accounts and no local admin rights for daily users |
| Patch operating systems | Attacks on known holes in Windows, macOS and servers | Scheduled patching, with unsupported systems flagged for replacement |
| Multi factor authentication | A stolen password being enough to log in | Entra ID MFA and conditional access, with 24/7 identity threat detection |
| Regular backups | Permanent data loss after ransomware, deletion or failure | Veeam backups kept out of reach, with restores tested |
Swipe the table sideways to see every column.
Application control is the strategy that changes daily work the most, so it gets the most care in a rollout. See application control.
The Essential Eight maturity model: which level to aim for
The ASD Essential Eight maturity model scores each of the eight strategies from Maturity Level Zero to Three. ASD says Level One may suit small to medium enterprises, Level Two large enterprises and Level Three critical infrastructure providers. Contracts can set a higher bar.
Maturity Level One
Protects against opportunistic attackers using common tools and techniques. The right first target for most small and medium businesses. Control maintains ML1 and adds logging and an incident response plan.
SecureShield Control, $60 per person per month ex GST
Maturity Level Two
Raises the bar against attackers who put in more time and effort, with tighter patching timeframes, stronger authentication and more logging. Defence asks DISP members to meet it on the systems they use with Defence.
SecureShield Command, $100 per person per month ex GST
Maturity Level Three
Aimed at adaptive attackers and high threat environments. Very few small and medium businesses need it.
Only where a contract or regulator requires it
From gap assessment to a level you can prove
Controls go in by risk, not in framework order. Your team keeps working throughout.
- 01
Gap assessment
We score each of the eight strategies against ML1 and ML2 and show you the evidence behind each score.
- 02
Plan and fixed quote
You get the gaps in order of risk, a fixed price project to close them and the monthly price to maintain your level.
- 03
Staged rollout
MFA, patching and detection go first. Application control and admin changes follow, tested with each team before anything is enforced.
- 04Ongoing
Evidence and review
We keep the evidence an assessor asks for and review your score with you at your regular reviews. If you want an independent audit, we prepare you for it.
The Essential Eight is changing. Your work still counts.
On 15 October 2026 ASD published ASD Essentials, the framework that will replace the Essential Eight, with chapters for enterprise IT, cloud and operational technology. ASD will maintain both frameworks while organisations move across.
- 01
The current model still applies
Insurers, contracts and regulators that name an Essential Eight maturity level still expect it. ASD says to keep current uplift work going while you assess the new framework.
- 02
Ratings replace maturity levels
ASD Essentials rates each action as not effective, partially effective or fully effective, and orders the work in three priority phases instead of target levels.
- 03
No retirement date yet
ASD says it will advise on transition expectations in due course. An ACSC official told iTnews in June 2026 that retirement could come in about two years.
- 04
We will map you across
Your maturity level does not convert automatically. We map your controls and evidence to ASD Essentials and show you what, if anything, needs to change.
Every Essential Eight strategy maps to at least one ASD Essentials principle, so the controls you put in now carry across. Ask for an Essential Eight gap assessment
We prove it in 90 days, or you walk away
Changing IT provider is a big decision, so the risk should sit with us. If we haven’t earned your trust in the first 90 days, you can walk away with nothing owing on the rest of your agreement.
- Day 1
No onboarding fee
You start on your plan with nothing extra to pay.
- Any time
14 days to fix it
Tell us in writing what is not working and we put it right.
- Up to day 90
Walk away if we have not
Nothing owing on the rest of your agreement.
- If you go
A clean handover
Admin access, passwords and documentation handed over at no charge.
A top 50 MSP in Australia, three years running
Rated by our clients on Cloudtango, and audited every year on security, quality and cyber controls.
Top 50MSPs in Australia
- 2024
- 2025
- 2026
Ranked on client satisfaction and service depth.
Read our 25 client reviews on Cloudtango
ISO 27001
Information securityHow we handle your data, passwords and access, audited every year.
How we protect your data
ISO 9001
Quality managementDocumented processes, so every engineer works to the same standard.
How we work
SMB1001 Gold
Cyber security, Level 3The 27 control cyber standard we take clients through, held ourselves.
Check our certificate- Energy
InterContinental Energy
ML1, on our assessment, reached using the Microsoft 365 Business Premium licences they already had. Staff who rely on Office macros kept working.
- Professional services
Palisades
Intune, conditional access, Defender, BitLocker and governance documents aligned to ML1. The work met a prospective client's security requirements and won the partnership.
- Engineering
Powertech
Aligned to ML2 with ThreatLocker, Huntress, conditional access, BitLocker and training, then progressed towards DISP and ISO 27001 and won a defence grade client.
- Client stories
All client stories
Sixteen stories with the numbers.
Essential Eight questions
What owners and IT managers ask us before they start. Anything else, call 1300 787 429.
Is the Essential Eight mandatory for private businesses?
Not by law for most. ASD treats Maturity Level Two as a mandatory baseline for many federal government entities, but private businesses usually meet it through a contract, an insurer or DISP. If a contract names a level, your advisers can confirm what it requires.
Which maturity level should we target?
Start with Maturity Level One unless someone has asked for more. ASD suggests ML1 may suit small to medium enterprises. Aim for ML2 if a contract, DISP or your risk profile calls for it. The gap assessment shows how far you are from each.
How long does it take and what does it cost?
Application control and admin rights take the longest because they change how people work. You get a timeline with the fixed quote. SecureShield Control maintains ML1 at $60 per person per month ex GST, and Command maintains ML2 at $100.
Will application control and macro rules stop our staff working?
Not if they are rolled out with care. We learn what each team runs before anything is blocked, test macro rules with the people who depend on them and give staff a quick way to request new software.
Is the Essential Eight being replaced?
Yes, over time. ASD published ASD Essentials on 15 October 2026 as the framework that will replace it, and will maintain both during the transition. No retirement date has been set, so the Essential Eight maturity model is still what assessors, insurers and Defence use today.
We already have an IT person. Can you work with them?
Yes. We can run SecureShield alongside your internal IT and agree who owns what. The gap assessment also gives your IT person an independent view to take to the directors when they need budget.
Know your level
before someone asks.
Tell us which level you need and who is asking. A technical consultant will scope the gaps with you and send a fixed quote to close them.
- A reply within two business hoursA technical consultant reads every enquiry and comes back to you.
- Proven in 90No onboarding fee, 14 days to fix anything you raise and nothing owing if you leave in the first 90 days. How it works
Or call 1300 787 429 or email sales@austintechnology.com.au