Essential Eight & ASD Essentials Consultant

Overview

What this service does

The Essential Eight is the Australian Signals Directorate's baseline of eight mitigation strategies, assessed at maturity levels 0 to 3. Suppliers to government, SOCI-regulated entities and organisations under RFFR or IRAP scrutiny are asked to report a maturity level and to lift it. We run an evidence-backed maturity assessment across all eight mitigations, then a prioritised, costed uplift to Maturity Level 2 or 3 that respects your budget and change capacity, with your IT team or managed service provider doing the technical work and us setting the target and verifying the result.

ASD has now launched Essentials as the successor to the Essential Eight. It replaces the single maturity score with per-area effectiveness ratings across Principles, Actions and Domains, delivered in Priority Phases, and existing Essential Eight maturity ratings do not carry across. We help organisations move from one to the other on a single evidence base: every control assessed once and reported twice, as your Essential Eight position today and your Essentials position tomorrow, so nothing is done from scratch and nothing is done twice.

A professional using a tablet showing a workflow diagram in a modern open-plan office

What's included

Scope of the engagement

Current-state maturity assessment with control-by-control evidence
Roadmap that respects budget and change capacity
Implementation oversight for application control, patching, MFA, macros, hardening and backups
Operational runbooks and uplift reporting
Environment scoping workshop, which Essentials chapters apply (enterprise IT first, OT and cloud as relevant)
Essential Eight maturity assessment against the current ACSC model (a baseline you already understand)
Mapping of existing E8 controls to Essentials Principles, Actions and Domains
Gap analysis by Priority Phase, with effectiveness ratings (addressed / partly addressed / not addressed)

Who it's for

Right for you if

Suppliers to government asked to report an Essential Eight maturity level
Organisations with an existing Essential Eight rating planning the move to Essentials
Businesses that need a practical, prioritised cyber uplift rather than a shopping list

Essential Eight

Maturity assessment and uplift

Move from ML0 or ML1 to ML2 or ML3 with confidence: ACSC-aligned, vendor-independent, and scored against your operating reality rather than a partner programme.

Who it is for

Government-aligned providers under DTA, IRAP or RFFR scrutiny
Critical infrastructure and SOCI-regulated entities
Mid-market organisations targeting cyber insurance discounts
Boards requiring an independent, evidence-based maturity opinion
NSW Government agencies and suppliers assessed under the NSW Cyber Security Policy
Commonwealth prime contractors uplifting Essential Eight across their subcontractor network

Outcomes

Evidence-backed maturity assessment across all eight mitigations
Prioritised, costed uplift roadmap to ML2 or ML3
Sustained maturity, not a point-in-time score
Defensible evidence pack ready for IRAP, RFFR or insurer review
Reduced cyber insurance premiums and shorter renewal underwriting cycles

ASD Essentials

Transition to Essentials without starting again

Baseline your current Essential Eight maturity, map it to the new Principles, Actions and Domains model, and shift to effectiveness-based reporting on one evidence base.

Who it is for

Organisations already reporting against the Essential Eight (any maturity level)
Commonwealth entities and suppliers still carrying PSPF or RFFR Essential Eight obligations
Critical infrastructure operators tracking the SOCI / CIRMP control environment
Boards and executives who need a plain-English transition plan, not another framework theory session

Outcomes

One baseline that reads as both an Essential Eight maturity position and an Essentials starting point
A prioritised transition plan sequenced against the Essentials Priority Phases 1-3
Evidence reuse: every control assessed once, reported twice, Essential Eight today, Essentials tomorrow
Per-area effectiveness ratings your board, insurers and regulators can actually read
A realistic transition timeline matched to your obligations, not ASD's indicative window alone

How a transition engagement runs

A typical engagement.

Phase	Duration	Detail
Scope	Weeks 1-2	Environments, obligations and reporting audiences defined; Essentials chapters and E8 baseline scope agreed.
Assess	Weeks 3-5	Essential Eight maturity assessment plus an Essentials readiness read against the same control environment.
Map & plan	Weeks 6-8	E8-to-Essentials control mapping, evidence reuse plan and prioritised transition roadmap by Priority Phase.
Transition	Weeks 9+	Uplift delivery, effectiveness evidence build-out and dual-framework reporting through the transition window.

FAQ

Essential Eight and ASD Essentials: common questions

Is the Essential Eight going away?

ASD has signalled a transition in which both frameworks run side by side, with the Essential Eight phased out roughly 12 to 24 months after the Essentials launch. Those are estimates, not fixed dates, your obligations stay the same until the policy or contract that cites the Essential Eight changes.

We're committed to Essential Eight ML2. Does Essentials replace that?

No. ML2 is not a universal requirement, the maturity level you need comes from your applicable policy, regulator or contract, and for non-corporate Commonwealth entities the PSPF still mandates ML2. Completing Essentials Phase 2 does not establish E8 ML2, and ML2 does not automatically establish Essentials effectiveness. This engagement sequences both so nothing is done twice.

Do we have to start our security programme from scratch?

No. The strongest work in your Essential Eight programme, patching, application control, MFA, restricted admin privileges, backups, carries directly into Essentials. What changes is how effectiveness is demonstrated: per-area ratings backed by evidence such as independent testing, rather than a single maturity score.

How long does a transition engagement take?

The assessment and planning phases run 6-8 weeks. The full transition depends on your obligations and baseline, typically 12-24 months, sequenced so the highest-risk areas move first.

Can you work with our existing MSP?

Yes. Most engagements run alongside an incumbent MSP: we focus on architecture, evidence and governance while they execute changes.

How long does a typical ML2 uplift take?

From baseline ML0/ML1, expect 6-9 months for a well-resourced mid-market organisation. The constraint is change capacity, particularly around application control and macro hardening, not the assessment itself.

Can you uplift Essential Eight across a subcontractor or supplier network?

Yes. Sagar has led Essential Eight and ACSC ISM uplift across 18 subcontractors for a Commonwealth-contracted provider under Right Fit For Risk. Programme-level rollout across a supply chain is a specific strength.