Essential Eight compliance you can evidence
We assess your environment against the ASD Essential Eight Maturity Model, show you exactly where you sit on each of the eight strategies, and implement the controls to reach the maturity level you need.
Essential Eight assessments, roadmaps and implementation
The Essential Eight is the Australian Signals Directorate's baseline set of mitigation strategies against cyber threats: patch applications, patch operating systems, multi-factor authentication, restrict administrative privileges, application control, restrict Microsoft Office macros, user application hardening and regular backups. Commonwealth entities are required to implement it, and it increasingly appears in government tenders, enterprise supplier questionnaires and cyber insurance renewals.
Orbit3 tests where you actually sit against each strategy using ASD's maturity model, rather than a self-assessment spreadsheet, then builds a prioritised roadmap and implements the controls with your team. The work overlaps heavily with good cloud security and day-to-day managed IT and cloud operations, so once you reach your target level we can keep you there.
New to the maturity levels? Read Essential Eight maturity levels explained.
- Maturity assessmentEach of the eight strategies tested against ASD's maturity model, with the evidence recorded.
- Gap report and roadmapWhat stands between you and your target maturity level, ranked by risk and effort.
- ImplementationPatching, MFA, privileged access, application control, macro and hardening policies, and backups put in place.
- Ongoing evidenceControls monitored and re-assessed so your maturity level holds after the project ends.
For organisations that have been asked about the Essential Eight
The question usually arrives from outside: a government tender, a customer's security questionnaire, an insurer, or a board member who read about a breach.
Suppliers to government
Agencies have to meet the Essential Eight themselves and increasingly ask the same of their suppliers. You need a credible maturity statement and the evidence behind it.
Businesses renewing cyber insurance
The insurer's questionnaire asks about MFA, patching, admin rights and backups. Answering confidently and accurately affects both cover and premium.
Growing companies without a security team
IT grew one laptop and one admin account at a time. You want an honest baseline and a plan that fits a business your size.
From an honest baseline to the maturity level you need
An Essential Eight assessment is only as useful as the evidence behind it and the work it leads to. Every engagement covers both.
- ScopingWhich systems, users and environments are in scope, your target maturity level, and who needs the result, from the board to a customer.
- Technical assessmentEach strategy tested on real endpoints, servers and identities, following ASD's assessment approach rather than relying on policy statements.
- Maturity statementYour assessed maturity level for each of the eight strategies, with the evidence and the specific requirements not yet met.
- Prioritised roadmapGaps ranked by risk reduction and effort, sequenced so all eight strategies reach the same level before you aim higher.
- Patching and vulnerability managementAutomated patching of operating systems and applications within ASD's timeframes, with scanning to prove it.
- Identity and privileged accessMulti-factor authentication, phishing-resistant where required, separate privileged accounts and time-limited administration.
- Application control and hardeningApplication control policies, Office macro restrictions, browser and application hardening, and the logging the higher levels require.
- BackupsImportant data, software and settings backed up, protected from change or deletion and tested by restoring. See our cloud backup service.
- Re-assessment and reportingA follow-up assessment once the work is done, and a plain-English report you can hand to a customer, insurer or board.
Assess, uplift, maintain
ASD's guidance is to bring all eight strategies to the same maturity level before aiming higher. Our roadmap follows that, so effort goes where it lifts your overall level.
Assess
We test each strategy against the maturity model and give you an evidenced maturity level per strategy, plus the gap list. You keep the report whether or not you continue.
Uplift
We implement the controls in priority order with your team, using Microsoft Intune, Defender, Entra ID and the tooling you already pay for wherever possible.
Maintain
Controls are monitored, exceptions reviewed and evidence kept current under managed services, with a re-assessment at least annually.
Windows, Microsoft 365 and the cloud
Most Essential Eight controls live in Windows, Microsoft 365 and your identity provider. We implement them with the tools you already license, and extend equivalent controls to your cloud workloads.
Windows and Microsoft 365
Intune for patching and configuration, Defender for Endpoint, Entra ID Conditional Access and Privileged Identity Management, App Control for Business and AppLocker, and Office macro policy. This is where most of the Essential Eight lives.
Microsoft Azure
Azure Update Manager, Defender for Cloud, Azure Policy and Azure Backup for servers and workloads running in Azure, with privileged roles managed through PIM.
AWS and Google Cloud
Systems Manager Patch Manager and AWS Backup, or Google Cloud's VM Manager and Backup and DR, with MFA enforced through your identity provider. ASD designed the Essential Eight for Windows networks, so cloud workloads often need equivalent controls rather than a literal match.
Frequently asked questions
What is the Essential Eight?
A set of eight mitigation strategies published by the Australian Signals Directorate (ASD) as a baseline against cyber threats: patch applications, patch operating systems, multi-factor authentication, restrict administrative privileges, application control, restrict Microsoft Office macros, user application hardening and regular backups. The accompanying maturity model defines what each strategy looks like at Maturity Levels One to Three.
Which maturity level do we need?
It depends on who is asking. Non-corporate Commonwealth entities must reach Maturity Level Two under the Protective Security Policy Framework, and many government tenders and enterprise customers ask suppliers for the same. For most private businesses, Maturity Level One across all eight strategies is the sensible first target, with Level Two where the threat or the contract warrants it.
Can we get Essential Eight certified?
There is no formal Essential Eight certification. What you can have is an assessment against ASD's maturity model that states your maturity level for each strategy, with the evidence behind it. That is what customers, insurers and boards usually want to see.
Does the Essential Eight apply to cloud and SaaS?
ASD designed the Essential Eight to protect Microsoft Windows-based, internet-connected networks. Cloud services, Linux servers and SaaS platforms still need equivalent protections such as MFA, patching, least privilege and backups, and we assess and implement those alongside the eight strategies rather than forcing a literal fit.
How long does an Essential Eight uplift take?
The assessment takes days to a couple of weeks, depending on size. Reaching Maturity Level One is commonly a matter of weeks; Level Two usually takes months, because application control and privileged access changes need careful rollout. The roadmap gives you a realistic timeline for your environment.
How does the Essential Eight relate to ISO 27001 or SOC 2?
They overlap. The Essential Eight is a prescriptive technical baseline; ISO 27001 and SOC 2 are broader frameworks that expect controls like these to exist. Work done for one counts towards the others, and we map it so you only do it once.
Often combined with this
The Essential Eight sits alongside broader security and compliance work. These services are the usual companions.
Cloud Security
Security reviews, risk assessments and hardened target-state controls mapped to the standards you need to meet.
Learn moreSOC 2 Compliance
SOC 2 readiness and remediation in Vanta: we fix the failing tests, implement the controls and keep them green through the audit.
Learn moreCloudOps Managed Services
24/7 monitoring, patching, security and cost control for your AWS, Azure or Google Cloud environment, run by us.
Learn moreBeen asked about your Essential Eight maturity?
Book a free 30-minute call. We'll ask a few questions about your environment, give you an honest view of where you're likely to sit, and outline what an assessment would involve.