Essential Eight Assessment · Australia
Retiring soon — The ASD has announced the Essential Eight framework will be retired. Read what this means for your business →
Know exactly where you stand on the Essential Eight.
A formal Essential Eight maturity assessment for Australian businesses. We rate you against all eight ACSC controls, show you the gaps that matter, and hand you a prioritised plan to reach the maturity level your contracts, insurer, or board require.
- Rated against all eight ACSC controls
- Clear maturity level (ML0–ML3)
- Prioritised remediation plan
- Australian assessors, no offshoring
Book your assessment
Tell us a little about your environment. We'll reply within one Australian business day to scope it with you.
Why IronSights
A specialist, not a generalist.
IronSights is an Australian cyber security firm. Your assessment is run by the same Sydney team that monitors and defends Australian organisations every day — so the findings come with advice that actually fits how your business runs.
- Australian assessors, no offshoring
- Vendor-independent advice
- Hands-on security engineers
- ISO 27001 certified practice
- Plain-English board reporting
- Backed by Fortify, our managed service
Why it matters
The Essential Eight is becoming the price of doing business.
Cyber insurers, government contracts, and enterprise customers increasingly ask the same question: what Essential Eight maturity level are you at? Guessing is risky. An assessment replaces the guess with an evidence-based answer — and a plan to close the gap.
What we assess
All eight ACSC mitigation strategies.
Application control
Whether unapproved programs — and the malware that hides among them — can run on your systems.
Patch applications
How quickly known holes in apps and browsers are closed before they can be exploited.
Restrict Office macros
Whether the macro-borne malware still landing in inboxes is actually blocked.
User application hardening
How well browsers, Office, and PDF readers are locked down against common attack paths.
Restrict admin privileges
Whether one compromised account can quietly take over your whole environment.
Patch operating systems
How current your Windows and server fleet is, and how long unpatched holes stay open.
Multi-factor authentication
Whether a stolen password is enough to get in — across staff, admins, and remote access.
Regular backups
Whether your backups are complete, tested, and able to bring you back after ransomware.
The maturity model
Four levels. We tell you which one you're at.
The ACSC rates Essential Eight maturity from ML0 to ML3, based on how determined an attacker your controls can withstand. We assess each of the eight controls against this model.
Significant gaps
Controls are missing or not working. Common, and usually invisible until something goes wrong.
Baseline protection
Defends against opportunistic, untargeted attacks. The minimum many contracts and cyber insurers now expect.
Stronger posture
Holds up against attackers willing to put in more effort and target your business specifically.
Hardened
Resilient against adaptive, determined adversaries who adjust to get past your defences.
What you walk away with
A clear rating, and a plan to lift it.
Maturity rating per control
Where you sit on the ACSC model (ML0–ML3) for each of the eight strategies, with the evidence behind it.
Prioritised gap register
Every gap ranked by real risk and how easily it can be closed — not a flat checklist.
Immediate quick wins
The changes you can make this week to lift your weakest controls fast.
Roadmap to your target level
A sequenced plan to reach the maturity level your contracts, insurer, or board require.
Board-ready summary
A one-page read of where you stand and what it means, written for leadership — not the helpdesk.
Evidence-based findings
Conclusions drawn from your real configuration and your IT team, not a generic questionnaire.
How it works
From scoping call to roadmap.
Scoping call
A short call to confirm your environment, your target maturity level, and what's driving the assessment.
Evidence review
We examine your real configuration across all eight controls — with your IT team, not a tick-box survey.
Maturity rating
Each control is rated ML0–ML3 against the ACSC model, and gaps are ranked by business risk.
Executive walkthrough
We walk your leadership through what we found, in language the board understands.
Roadmap
You leave with quick wins and a sequenced plan to reach and hold your target level.
Common questions
Before you book.
The questions we hear on nearly every scoping call, answered before we ask you to book anything.
How much does an Essential Eight assessment cost?
It depends on the size and complexity of your environment: the number of users, sites, and systems in scope. Most SME assessments are a fixed, quoted fee agreed on the scoping call, so there are no surprises. As a guide, a single-entity SME assessment is a fraction of the cost of the incidents it helps prevent, and far less than a full penetration test.
What is the difference between an Essential Eight assessment and an audit?
In practice the terms are used interchangeably. Formally, an assessment rates your maturity against the ACSC model and gives you a roadmap, while an audit implies independent verification of evidence, which is how we work anyway. If a contract, insurer, or government buyer has asked you for an 'Essential Eight audit', this assessment is what they mean.
Is there an official Essential Eight certification?
No. The ASD does not certify Essential Eight compliance: there is no government-issued certificate. What buyers and insurers accept is an independent, evidence-based assessment report stating your maturity level per control. If you need a certifiable credential for tenders, SMB1001 certification is the recognised alternative for Australian SMEs, and we can advise which fits your situation.
What maturity level does my business need?
Most SMEs are asked for Maturity Level 1 by insurers and supply-chain questionnaires. Organisations handling sensitive data, government contracts, or Defence-adjacent work are increasingly asked for ML2. The honest answer comes out of the scoping call: we look at what your contracts, insurer, and risk profile actually require rather than defaulting to the highest level.
Isn't the Essential Eight being retired?
The ASD has announced the Essential Eight will be retired by 2027 in favour of the broader ASD Essentials. The eight controls are not going away; they carry forward into the new framework, so an assessment now is not wasted work. We rate you against the current model and flag exactly what changes in the transition, so you're ready for both.
How long does the assessment take?
Typically one to two weeks from scoping call to executive walkthrough, depending on how quickly evidence can be gathered with your IT team. You get the quick-wins list as soon as we find them, so you don't have to wait for the final report to start improving.
Not ready to talk yet?
Try the free 5-minute self-assessment.
Forty plain-English questions, an instant maturity estimate on screen, and no signup. It's a useful starting point — though a formal assessment is what insurers and contracts actually ask for.
Get started
Book your Essential Eight assessment.
A short scoping call, an evidence-based maturity rating, and a clear plan to reach your target level. We reply within one Australian business day.
- Rated against all eight ACSC controls
- Australian assessors, no offshoring
- Board-ready findings within days