Essential Eight compliance consulting for a maturity level you can defend with evidence.

What it is

What is the Essential Eight and what is it used for?

The Essential Eight is a set of eight mitigation strategies chosen by the Australian Signals Directorate (ASD), through its Australian Cyber Security Centre, from a much longer list of ways to reduce cyber security incidents. Together they close the routes most intrusions depend on: untrusted code, unpatched software, stolen credentials and unrecoverable data.

It is not a management system standard and there is no certificate. The Essential Eight Maturity Model describes how well each strategy is implemented, from Maturity Level Zero up to Maturity Level Three. ASD suggests Level One may suit small and medium enterprises, Level Two large enterprises, and Level Three critical infrastructure providers and organisations facing a high threat. Organisations choose a target level and work up to it progressively.

Current version. The Essential Eight Maturity Model as updated by ASD in November 2023. ASD has since consulted on a broader successor series; check cyber.gov.au before you set your target.

Who it is for

Who needs Essential Eight compliance?

For non-corporate Commonwealth entities subject to the Protective Security Policy Framework, Maturity Level Two is the mandatory baseline. Elsewhere it travels through supply chains. Enquiries usually start in one of four places:

• A government or enterprise customer asks for your maturity level. Confirm the level, the systems and the proof they accept.
• A tender asks you to state your Essential Eight position. Assess before you answer.
• A regulator, auditor or insurer points to it. It is the common Australian benchmark for basic cyber hygiene.
• A parent company or group entity has adopted it. Subsidiaries and offshore service centres are asked to match it.

Requirements

What are the main Essential Eight requirements?

The requirements are the eight strategies, each defined at every maturity level in ASD's model. The summary below stays at heading level.

• Application control: only approved programs, scripts and libraries are allowed to run on workstations and servers.
• Patch applications: application security updates applied within set timeframes, and unsupported applications removed.
• Configure Microsoft Office macro settings: macros blocked unless there is a business need, and those allowed limited to trusted sources.
• User application hardening: browsers, office productivity software and PDF readers configured to reduce what an attacker can exploit.
• Restrict administrative privileges: privileged access granted only when needed, validated, reviewed and kept apart from everyday accounts.
• Patch operating systems: operating system updates applied within set timeframes and unsupported versions replaced.
• Multi-factor authentication: more than one factor for users and administrators, with phishing-resistant methods expected at higher levels.
• Regular backups: important data, software and settings backed up, protected and restored in tests.
• Maturity levels and exceptions: Maturity Levels Zero to Three across all eight; where a requirement cannot be met, compensating controls must give equivalent protection.

Compliance process

How do you achieve Essential Eight compliance?

The route is an uplift followed by an assessment against the maturity model. The outcome is an assessed maturity level, not a certificate.

1. 01
   Set the target level and the scope.Agree the maturity level your customers, contracts or policy require, and the environments, devices and cloud services it covers.
2. 02
   Gap analysis: test each strategy against the maturity model.We check configuration and records, not just policy, for each of the eight.
3. 03
   Uplift, one level at a time.Close gaps in a sequence your IT team can carry, reaching each level across the eight before going further.
4. 04
   Assess internally against ASD's assessment guidance.Test controls as an assessor would, following ASD's Essential Eight Assessment Process Guide, and fix what fails.
5. 05
   Complete the independent assessment and keep the level.Where your customer or framework requires it, an independent assessor tests your implementation; patching, access reviews and restore tests then continue every month.

Check the route before you sign. ASD issues no Essential Eight certificate, so treat any offer of one with suspicion. Ask whoever requests your maturity level who may assess it, and confirm the assessor follows ASD's assessment guidance. The certification buyer's checklist

Cost

How much does Essential Eight compliance cost?

An Essential Eight budget is weighted towards technology and IT effort rather than documents. Administrator time and any tooling the gaps expose often outweigh the consulting fee.

Timeline

How long does Essential Eight compliance take?

Duration depends on the starting point, the target level and how much change your environment can absorb at once. Application control and privileged access usually take longest because they change how people work. As an estimate, moving to Maturity Level Two takes four to nine months.

Your engagement

What your Essential Eight engagement includes

Sterling OS™ runs the engagement, with each phase adapted to a maturity uplift rather than a certification project. Sterling does not certify, and no Essential Eight certificate exists: your maturity is assessed against ASD's model by your own team or by an independent assessor.

• Design™: guided support

  Your IT team makes the changes; a Sterling consultant sets the uplift sequence, reviews configurations and evidence, and coaches the people doing the work.

• Drive™: managed support

  The alternative to Design™ when your team is stretched: Sterling runs the programme with your administrators, writes the exception cases and prepares every evidence pack.

• Sustain™: after the target is reached

  Periodic internal assessments, checks on patch timeframes and privileged access, and a plan for the next maturity level.

• Automate™: Effivity

  Your security programme, risks and evidence run in Effivity, included with the engagement at no additional cost.

• Training for your people

  Internal auditor training, as applicable to your standard, and preferential Sterling Academy access, including complimentary awareness training for your people as part of the engagement.

Maturity assessments are made against ASD's model by your organisation or an independent assessor, never by Sterling as a certifier.

Often combined with

Standards organisations pair with Essential Eight

• ADHICS (Abu Dhabi)ADHICS compliance consulting for DoH-regulated healthcare entities in Abu Dhabi: patient information, systems and devices protected, with audit-ready evidence.
• CIS ControlsCIS Controls implementation and requirements: the 18 Controls and 153 Safeguards of v8.1, Implementation Groups, assessment with no certificate, cost and time.
• CMMC 2.0CMMC 2.0 certification consulting for defence contractors handling FCI and CUI: controls, SPRS score and evidence ready for self or C3PAO assessment.
• CSA STARCSA STAR certification consulting for cloud providers: CCM controls and evidence for a STAR Registry entry by self-assessment, certification or attestation.
• Cyber EssentialsCyber Essentials certification consulting: the five technical controls in place for your verified self-assessment, and Cyber Essentials Plus audit-ready.
• DESC ISR (Dubai)DESC ISR compliance consulting for Dubai government entities and suppliers: information security risks and incidents managed, with the evidence to show it.