Services / Essential Eight readiness
Essential Eight readiness assessments
When an insurer or a tender panel asks what security controls you have, the answer needs to be evidence, not assurance.
Why small businesses are being asked
The Essential Eight is the Australian Signals Directorate’s set of eight mitigation strategies for protecting systems against the most common attacks. It was written with larger organisations in mind, but it has become the shorthand question that insurers, government buyers and enterprise clients put to their suppliers.
Small businesses usually have more in place than they think. What they lack is the documentation proving it, which is the thing actually being asked for.
The eight strategies
- Application control
- Patching applications
- Configuring Microsoft Office macro settings
- User application hardening
- Restricting administrative privileges
- Patching operating systems
- Multi-factor authentication
- Regular backups
Each is assessed against maturity levels from Level 0 to Level 3. Most small businesses do not need Level 3, and chasing it wastes money. What matters is knowing your real level and being able to show your working.
What I assess
- Current state against each of the eight strategies, with the evidence for each rating recorded.
- Target level: what maturity your business realistically needs, based on who is asking and why.
- Gaps worth closing, separated from gaps that are not worth the money at your size.
- Existing controls you are not getting credit for, which is frequently the quickest win.
- The questionnaire answers you will need for insurers and tender responses.
What you get
An evidence pack: your current maturity level for each strategy, what supports that rating, and a prioritised list of what would raise it. Written so you can attach it to an insurance renewal or a tender response without rewriting it.
This is documentation and assessment work, not certification. Nobody can certify you against the Essential Eight, and anyone offering to should be asked how.
Assessed against: ASD Essential Eight Maturity Model
Common questions
Is this a certification?
No. The Essential Eight has no certification scheme. What exists is a maturity model, and what you can produce is a documented, evidence-backed assessment of where you sit against it. That is what insurers and panels are actually asking for.
We are a three-person business. Is this overkill?
The framework scales down further than people expect. Multi-factor authentication, patching and backups are as relevant to three people as to three hundred. The assessment is about documenting what you already do and fixing the few things that genuinely matter at your size.
Do you implement the fixes as well?
I document what is in place, identify the gaps and quote a fixed price for the documentation and evidence work. Where a gap needs hands-on technical change to your systems, I will tell you exactly what needs doing and can work alongside whoever maintains them.
Related services
Start with a free check
I run a short external diagnostic and send you what I find. No obligation, and no pitch if there is nothing worth fixing.
I assess your systems and documents against published standards, identify where the gaps are, and give you the documentation to show you have addressed them. This is not legal advice.