Essential Eight Assessment: Where You Stand, and How to Get to the Level You Need
Last updated: July 2026 · Prepared and reviewed by the Vintaris security team
The Essential Eight is the Australian Signals Directorate’s baseline of eight mitigation strategies, and it has quietly become the yardstick: tenders ask for it, insurers map their questions to it, and large customers push it down their supply chains. A Vintaris Essential Eight assessment tells you exactly where you sit today, strategy by strategy, and gives you the practical path to the maturity level you actually need.
17 questions · 2 minutes · instant snapshot score · no login
Book an Essential Eight assessmentThe eight strategies, in plain English
Application control
Only approved software can run.
Patch applications
Security updates applied fast, especially internet-facing ones.
Configure macro settings
Office macros locked down so documents can't carry attacks.
User application hardening
Browsers and apps stripped of the risky features attackers love.
Restrict admin privileges
Admin rights only for those who need them, reviewed and logged.
Patch operating systems
No device running a system that no longer gets updates.
Multi-factor authentication
The extra prompt that stops a stolen password working.
Regular backups
Tested backups an attacker can't reach or delete.
Maturity levels, decoded
The Essential Eight is measured in maturity levels, and the level you need depends on who is asking.
Significant gaps
Where most unassessed businesses discover they sit.
Common attacks covered
Protected against common, opportunistic attacks. The realistic first target.
Capable attackers covered
Protected against more capable attackers. The level tenders and insurers increasingly reference.
Sophisticated intrusions
Protection against sophisticated, targeted intrusions. Required in limited, high-assurance contexts.
Most Australian mid-market businesses are asked for Level One or Level Two. Very few genuinely need Level Three, and honest advice includes telling you when you don’t.
Not sure which level you’re at? Find out in two minutes.
Check your Essential Eight readiness, freeWhat a gap assessment shows you
An Essential Eight gap assessment measures your current maturity against your target, strategy by strategy, so uplift becomes a plan instead of a guess.
Every bar becomes a workstream: what to change, in what order, at what effort. Your roadmap is tailored to your budget and environment, with options for vendor licensing, deployment, ongoing oversight and strategic guidance where you want us involved.
Get your own snapshot, free.
Check your Essential Eight readiness, freeHow the assessment works
Scope
Your systems, size and target level. Fixed quote before anything begins.
Assess
Evidence-based review of each strategy against the ACSC maturity model, verified, not self-declared.
Report
Your maturity position per strategy, the gaps, and a prioritised uplift roadmap.
Uplift
Close the gaps with your own team, your IT provider, or with Vintaris alongside you.
The Essential Eight assessment runs standalone, or as part of a full cyber security posture assessment that also covers the areas the Essential Eight deliberately leaves out, like third-party risk, staff awareness and incident readiness. If cyber insurance is your driver, our insurance readiness work maps your controls to what underwriters ask.
Prefer an expert to run it end to end? Book an Essential Eight assessment.
Essential Eight consulting for SMEs and mid-market
You do not need an enterprise budget to take the Essential Eight seriously. Our consultants scope the engagement to your size: an SME with one office and cloud systems is assessed against the same model as a multi-site business, with an uplift plan matched to what a small team can actually execute. For smaller businesses, the small business stream and the $479 self-service assessment are honest starting points, and for ongoing help, our consulting services scale down as well as up.
Small team or SME? The free check is the honest place to start.
Check your Essential Eight readiness, freePrefer to start yourself? The toolkit question
Searching for an Essential Eight toolkit, spreadsheet or questionnaire? Here is the honest version of what a spreadsheet can check:
- Is MFA on everywhere, including admin accounts?
- Are applications and operating systems patched promptly, with nothing unsupported?
- Are Office macros blocked or restricted?
- Can unapproved software run on your devices?
- Are browsers and apps hardened against risky content?
- Who has admin rights, and when were they last reviewed?
- Do backups exist off-network, and has a restore been tested?
- Could you evidence any of the above to an assessor?
A spreadsheet can list the questions. It cannot score you, benchmark you against other Australian businesses, tailor itself to your industry, or produce evidence a tender panel or insurer accepts. Our free 2-minute check starts that properly, and the full assessment finishes it.
Frequently asked questions
What is an Essential Eight assessment?
An evidence-based review of your organisation against the ASD's eight mitigation strategies, scored using the ACSC maturity model. It identifies your current maturity level per strategy, the gaps to your target level, and the practical uplift path.
What is an Essential Eight gap assessment?
A gap assessment compares your current maturity against a defined target level, strategy by strategy, producing a prioritised list of exactly what must change to close each gap. It is the standard starting point for an uplift program.
What maturity level does my business need?
It depends on who is asking. Most tenders and insurers that reference the Essential Eight expect Level One or Level Two. Level Three applies in limited, high-assurance contexts. Part of our assessment is confirming the level you genuinely need, so you do not overspend chasing one you don't.
How long does an Essential Eight assessment take?
Typically one to three weeks from scoping to the results walkthrough, depending on your size and the number of systems in scope.
How much does it cost?
Assessments are quoted on your size and target maturity level, with a fixed quote before work begins. Smaller businesses can start with the $479 self-service assessment, which includes Essential Eight-aligned questions and credits in full toward an expert-led engagement within 30 days.
Is the Essential Eight mandatory?
It is mandated for certain Australian government entities. For private businesses it is not law, but it is increasingly required contractually, in tenders, by insurers, and by large customers managing supply-chain risk, which makes it effectively mandatory for many.
Essential Eight or ISO 27001?
They answer different questions. The Essential Eight is a focused, technical baseline; ISO 27001 is a full management-system standard. Many businesses use the Essential Eight as the technical core and add governance from ISO 27001 where customers require it. We advise on the right fit before you commit to either.
See where you stand against the Essential Eight
Check your Essential Eight readiness, free17 questions · 2 minutes · instant snapshot score · no login
Or book an Essential Eight assessment with our team.
Prepared and reviewed by the Vintaris security team. Vintaris Solutions Pty Ltd provides Essential Eight assessment and advisory services to Australian businesses.
Vintaris provides cybersecurity assessment and advisory services. General information on this page is not legal, financial or insurance advice.