Essential 8
A clear path up the Essential Eight
We benchmark your systems against the ACSC's Essential Eight maturity model, then give you a written report: where each strategy stands today, and a costed plan to reach the level you're aiming for.
Trusted by Australian organisations
The eight strategies
The ACSC's most effective ways to protect against cyber threats. We benchmark each one, and point out anything beyond them that's worth doing.
-
Application control
Only approved programs and scripts can run, so unknown software can't get a foothold.
-
Patch applications
Browsers, Office, PDF software and other apps kept up to date, and unsupported ones removed.
-
Microsoft Office macro settings
Macros from the internet are blocked, and only approved people can run the ones you need.
-
User application hardening
Browsers set up to refuse ads and risky content, with settings people can't change.
-
Restrict administrative privileges
Admin access granted only when it's needed, kept apart from email and the web, and reviewed.
-
Patch operating systems
Windows, servers and network devices patched on time, and unsupported versions replaced.
-
Multi-factor authentication
A second check on every sign-in to your online services and sensitive data.
-
Regular backups
Important data and settings backed up, kept safe and tested by restoring them.
From benchmark to roadmap
What the assessment covers, and what you'll have in hand at the end.
-
A scope that fits
Your target maturity level, the depth of evidence you want, your sites, and the computers and servers that best represent the rest. We test up to your target and no further.
-
Every control tested
Each control on your devices and internet-facing services gets one of the ACSC's outcomes, with the evidence behind it. Device management, if you have it, lets us see further.
-
Your level, strategy by strategy
The maturity level each strategy reaches today, beside the level you're aiming for, with every control marked as met or not.
-
A costed roadmap
Recommendations in the order that makes most sense, quick wins first, including any beyond the Essential Eight, with one-off and ongoing costs for each.
A clear answer, quickly
The assessment is built around the ACSC's maturity model, so you know exactly what was tested and why.
-
8
strategies benchmarked against the Essential Eight maturity model
-
4
weeks or so, from the start of the assessment to your report
-
3
maturity levels, tested up to the one you're aiming for
-
4
levels of evidence, from a written policy to a simulated test
From first conversation to final report
Three stages, then a roadmap you can take at your own pace.
-
Step 1
Scope
A short pre-assessment form and a conversation: your sites, representative devices, what's out of scope, your target level and the evidence you want.
-
Step 2
Assess
With access to the systems in scope, we test each control and record what we found and the evidence behind it.
-
Step 3
Report
Your written report goes to the people you named, with your maturity levels, recommendations and costs.
-
Step 4
Lift
Work through the roadmap when it suits you. We can scope and quote any recommendation, or hand it to your own provider.
Act on what you find
Services that deliver many of the strategies, set up and looked after for you.
-
Cyber security
Protection for every device, inbox and person, built into the service.
-
Backup and disaster recovery
Backed up, checked every day and ready to restore.
Questions, answered
Anything else? Ask us directly.
Is this a certification?
No. It's a benchmark of your environment against the ACSC's Essential Eight maturity model, not an audit, a certification or legal advice. It shows where you stand today and what it would take to go further.
How is it priced?
We give you an estimate before we start, once we've scoped it together. It depends on the size of your environment, the maturity level you're aiming for and the quality of evidence you want.
Which maturity level should we aim for?
It depends on what's at stake for your business, and we'll talk it through when we scope the assessment. Each level builds on the last, and we test every control up to your target and stop there.
What does evidence quality mean?
It's how each finding is proven. Minimum quality is a policy or statement of intent. Fair quality is a report or screenshot of a system's settings. Good quality is checking those settings in the system itself. High quality is a simulated test that shows a control works. Each level adds depth, and time.
What do you need from us?
The pre-assessment form, access to the systems in scope, introductions to any third parties involved, and someone who can answer our questions within a couple of working days.
How long does it take?
About four weeks from the start of the assessment to your report. Quick answers to our questions keep it on track.
Who sees the report?
Only the people you name before we start. The report details where your business could be exposed, so we keep it to them.
Do we need to be an Eightstep client?
No. The assessment stands on its own, and the report is yours to act on however you choose. If you'd like our help, we can scope and quote any recommendation, and Cyber security and Managed IT Services deliver many of them.