Essential Eight Readiness Assessment
Understand your Essential Eight readiness and what to improve next.
A structured assessment for SMEs that need clearer evidence for customers, insurers, tenders and internal governance.
Fixed quote based on your agreed systems, evidence and assessment depth.
Choose the right starting point
A specialised framework review, not a general security check.
The Essential Eight assessment is designed when alignment with the framework is a stated business requirement. For broader visibility across common cyber risks, the Cyber Risk Health Check may be the more suitable entry point.
| Service | Primary focus | Best suited to | Output |
|---|---|---|---|
| Cyber Risk Health Check | Broad business cyber risk | General risk visibility | Business risk roadmap |
| Essential Eight Readiness Assessment | The eight mitigation strategies | Framework-specific requirements | Essential Eight-aligned roadmap |
The eight strategies
Review the controls that form the Essential Eight.
Each area is considered within the systems and business environment included in your written scope.
Patch applications
Apply security updates to software promptly.
Patch operating systems
Keep OS versions updated to reduce vulnerabilities.
Multi-factor authentication (MFA)
Require additional verification for logins.
Restrict administrative privileges
Limit admin rights to reduce misuse.
Application control
Allow only approved applications to run.
Restrict Microsoft Office macros
Block or tightly control macro execution.
User application hardening
Disable risky features in applications.
Regular backups
Maintain and test backups to ensure data recovery.
Assessment approach
Move from framework questions to an actionable plan.
Review the agreed scope
Confirm the systems, users, locations and business areas included in the assessment.
Examine available evidence
Review relevant configurations, records, procedures and supporting documentation.
Identify control gaps
Record controls that appear incomplete, inconsistent, unsupported by evidence or outside scope.
Discuss the target
Consider the organisation’s risk, contractual needs and practical improvement objectives.
Prioritise remediation
Order recommended improvements by risk, urgency, dependency and implementation effort.
Clarify next steps
Decide whether remediation will be handled internally, by an existing provider or under a separate quote.
What you receive
Practical findings for decision-makers and technical providers.
Executive readiness summary
A plain-English overview of the current position and important priorities.
Control-by-control observations
Findings organised around the Essential Eight strategies included in scope.
Evidence gaps
Areas where implementation could not be demonstrated from the information available.
Prioritised findings
Observations ranked according to potential impact and urgency.
Remediation roadmap
A staged improvement plan that accounts for dependencies and practical constraints.
Findings review
A guided discussion of the report, questions and implementation options.
How it works
A defined engagement from scoping to roadmap.
Confirm scope
Define the systems, users, evidence, business requirements and assessment depth.
Collect evidence
Provide the agreed technical information, records and procedural documentation.
Assess readiness
Review the supplied evidence and document observations against the agreed framework scope.
Plan improvement
Receive the report, discuss priorities and agree how remediation will be approached.
Commercial approach
A fixed quote before assessment work begins.
Pricing depends on the size and complexity of the environment, the systems included, evidence availability and the depth of review required.
Your written proposal confirms:
- Systems, users and locations included
- Evidence and access requirements
- Assessment depth and reporting format
- Expected delivery schedule
- Deliverables and findings review
- The fixed price for the agreed scope
Technical remediation, penetration testing and formal certification are not automatically included.
Who it’s for
Useful when Essential Eight questions have a business consequence.
The assessment is particularly relevant when your organisation must understand or demonstrate its current readiness to another party.
Government suppliers
Prepare for procurement questions and identify evidence or control gaps before responding.
Customer due diligence
Build a clearer view of your controls when customers or larger partners ask security questions.
Cyber insurance discussions
Understand relevant controls before completing questionnaires or renewal discussions.
Contractual obligations
Review readiness when agreements refer to the Essential Eight or security requirements.
Internal governance
Give owners and leaders a structured improvement target and clearer accountability.
Existing IT providers
Provide a prioritised framework that your current technical partner can help remediate.
Frequently asked questions
What to know before requesting an assessment.
What evidence will we need?
Evidence depends on the scope and may include relevant configurations, system records, policies, procedures and information from your IT provider. Requirements are agreed before work begins.
Do we need to target a particular maturity level?
Not necessarily. Your business requirements, risk profile and contractual obligations should inform the target. Scoping helps clarify what level of assessment is appropriate.
Is this a formal maturity assessment or certification?
It is a readiness assessment unless the written proposal explicitly defines another form of engagement. It is not government certification or accreditation.
How long will the assessment take?
The schedule depends on scope, environment complexity and evidence availability. The expected delivery timeframe is documented in your proposal.
Can you work with our existing IT provider?
Yes. With your approval, your provider can assist with evidence collection, clarify current controls and implement recommendations.
Is remediation included?
No. Remediation is separate from the assessment unless it is explicitly included in the written scope. Any additional implementation work is quoted before it begins.
Will the report satisfy an insurer, customer or tender?
Requirements vary between organisations. The report can support your understanding and response preparation, but acceptance by another party cannot be guaranteed.
Essential Eight resources
Understand the framework before you begin.
Use these plain-English resources to explore common requirements and related decisions.
Turn requirements into a plan
Request an Essential Eight Readiness Assessment.
Tell us why you need the assessment, what systems are involved and whether a customer, insurer or tender has specified particular requirements. We’ll confirm the appropriate scope and fixed quote.