Essential Eight maturity assessment and uplift plan

Aegentra assesses your environment against the Australian Signals Directorate’s Essential Eight Maturity Model, strategy by strategy, against the maturity level you need to reach. You receive a prioritised uplift plan with owners and evidence, and the Microsoft 365 work can be delivered through our Harden practice. There is no Essential Eight certificate; the outcome is an evidenced maturity position you can show a customer, an insurer or a regulator.

A maturity level you can evidence, not a tooling dashboard.

We assess each of the eight strategies against the requirements of your target maturity level, read configuration from the systems where that is possible and corroborate it with records. You receive a current maturity level per strategy, the gap behind each one and a prioritised uplift plan with owners and the evidence that will show each gap is closed. There is no Essential Eight certificate; what you can show a customer, an insurer or a regulator is an evidenced position at a point in time.

At a glance

Each strategy assessed against the requirements of your target maturity level.

ASD publishes the Essential Eight Maturity Model, which describes what each strategy looks like at each maturity level. We read configuration from the systems where that is possible and corroborate it with records, so the level we report rests on evidence rather than on what a policy says should happen.

Application control

Coverage across the assessed environment is tested rather than assumed from tooling, with the application control policies and logs as the evidence.

Patch applications

Patching deadlines are checked against patch and update reports for the applications in scope, not against what a policy says should happen.

Configure Microsoft Office macro settings

Macro settings are read from the platform; where Microsoft 365 is the environment, the findings map to the settings in our hardening checklist.

User application hardening

Hardening settings are read from the systems and corroborated with records, with the gap against the target level stated per requirement.

Restrict administrative privileges

Administrative access is tested through account lists and reviews, so privileged access is evidenced rather than described.

Patch operating systems

Operating system patching deadlines are checked against update reports for the workstations and servers in scope.

Multi-factor authentication

Multi-factor authentication configuration is examined where the identity platform enforces it, against the requirements of the target level.

Regular backups

Backup schedules and restoration tests are examined; restoration is tested rather than assumed from the backup tooling.

What the assessment covers

We assess each of the eight strategies against the requirements of your target maturity level, across the environment you nominate: workstations, servers, Microsoft 365 and the identity platform, and the processes behind them. Configuration is read from the systems where that is possible and corroborated with records, so the result rests on evidence rather than on what a policy says should happen.

• Scope and target level agreed first: which systems, which users and which maturity level, with the reason for that target recorded
• Each strategy assessed against the requirements of the target level, with the evidence examined and the gap stated
• Patching deadlines, administrative access, application control coverage and backup restoration tested rather than assumed from tooling
• A current maturity level per strategy and an overall position, with the limitations of the assessment stated
• Where the environment is Microsoft 365, the findings are mapped to the settings in our Microsoft 365 hardening checklist so the uplift work starts from a known configuration

Who it applies to

The request usually arrives from outside the organisation: a tender, an insurer at renewal, a board after a public incident, or the CIRMP Rules for a SOCI responsible entity.

• Suppliers to Australian, state and territory government agencies asked to state a maturity level
• Organisations whose cyber insurer or enterprise customers ask for Essential Eight evidence
• Responsible entities under the SOCI Act that adopt the Essential Eight Maturity Model as their CIRMP cyber security framework
• Boards that want a defensible answer to “what is our maturity level” rather than a tooling dashboard
• Microsoft 365 organisations that have switched on security features and want to know whether they meet the strategy requirements

What we deliver

Scope and target level are agreed first; every strategy is then assessed against the requirements of that level across the environment you nominate.

• A scope record: which systems, which users and which maturity level, with the reason for that target written down
• Each strategy assessed against the target level, with the evidence examined and the gap stated
• Patching deadlines, administrative access, application control coverage and backup restoration tested rather than assumed from tooling
• A current maturity level per strategy and an overall position, with the limitations of the assessment stated
• A prioritised uplift plan: each gap with an owner, the change required, its dependencies and the evidence that will show it is closed
• A results walkthrough, and a re-assessment after uplift on the same basis as the first when you want one

What we do not do

The boundary is stated on the report so it is not misread by a customer or a regulator.

• No certification: ASD does not certify organisations against the Essential Eight and neither does Aegentra
• No guarantee of a maturity level, and no assessment of systems we were not given access to
• No penetration test, ISO 27001 internal audit or IRAP assessment: each answers a different question and is a separate service
• Microsoft 365 configuration work is delivered by the Harden practice as a separately scoped engagement, never folded into the assessment
• Passwords and tokens are never requested through email; evidence handling is agreed at scoping

How the engagement runs

Named steps, each with what happens and what you receive.

Scope: Agree the environment and the target level

A scoping call settles which systems and users are in the assessment, which maturity level you are measuring against and why, the evidence access you can provide and whether uplift delivery is included.

What you receive:

• A written scope with the target level and its reason recorded
• A fixed-fee quote for the agreed scope
• An evidence request list and the agreed secure-handling arrangements

Who is asking, and for what level → Systems, users and platforms in scope → Written scope and fixed fee

Assess: Read the configuration, corroborate it with records

Each of the eight strategies is assessed against the requirements of the target level. Configuration is read from the systems where possible and corroborated with patch reports, policies, logs, account reviews and short owner interviews.

What you receive:

• The evidence examined per strategy
• The gap against each requirement of the target level
• Where Microsoft 365 is the platform, findings mapped to the settings in our hardening checklist

Configuration read from the systems → Records and owner interviews → Gap per strategy

Position: State the maturity level per strategy

The findings become a current maturity level for each strategy and an overall position, with the limitations of the assessment and the boundary of the environment it was measured across stated plainly.

What you receive:

• A maturity level per strategy and an overall position
• A report that says what was examined and what was not
• A results walkthrough with the people who own each area

Findings → Maturity level per strategy → Report with its limitations stated

Plan: Order the gaps into an uplift sequence

Gaps are ordered by the maturity level they unlock and the effort they need. Each carries an owner, the change required, its dependencies and the evidence that will show it is closed; process and record changes stay with your team.

What you receive:

• A prioritised uplift plan that reads as a sequence, not a backlog
• Microsoft 365 work identified for the Harden practice as a separate scope
• The evidence each process change must produce, written down

Gaps → Owner, change, dependency, evidence → Uplift plan

Uplift and re-assess: Deliver the Microsoft 365 work, then measure again

Where you want it, the Harden practice delivers the Microsoft 365 configuration work as a separately scoped engagement. A re-assessment then records the new maturity level per strategy on the same basis as the first, and the scope says who did which part.

What you receive:

• Uplift delivery through Harden, quoted separately
• A re-assessment on the same basis as the first
• A record of who assessed and who configured, so the result is not self-marked

Uplift plan → Harden delivery, separately scoped → Re-assessment on the same basis

The uplift plan, and who delivers it

The assessment ends in a prioritised plan, not a list of findings. Each gap carries an owner, the change required, its dependencies and the evidence that will show it is closed. Where the work is Microsoft 365 configuration, our Harden practice delivers it as a separately scoped engagement; where it is a process or a people change, your team owns it with the plan as the record.

• Gaps ordered by the maturity level they unlock and the effort they need, so the plan reads as a sequence rather than a backlog
• Microsoft 365 uplift through the Harden practice: Conditional Access, Intune update rings, macro and application control settings, privileged access and backup validation
• Process and record changes stay with your team, with the evidence each one must produce written down
• A re-assessment after uplift records the new maturity level per strategy on the same basis as the first
• Assessment and uplift are separate scopes, so the person who assesses the result is not marking their own configuration work unless you choose that and it is recorded

What the Essential Eight is

The Essential Eight is a set of eight mitigation strategies published by the Australian Signals Directorate (ASD) as a baseline against common cyber threats. ASD publishes the Essential Eight Maturity Model, which describes what each strategy looks like at each maturity level, and organisations assess themselves, or are assessed by a third party, against the level they have chosen as their target. It is referenced by Australian customers, insurers and tenders, and the Security of Critical Infrastructure (Critical infrastructure risk management program) Rules name the Essential Eight Maturity Model as one of the cyber security frameworks a responsible entity may adopt.

• Application control, patch applications, configure Microsoft Office macro settings and user application hardening
• Restrict administrative privileges, patch operating systems, multi-factor authentication and regular backups
• Maturity is assessed per strategy against the level the organisation targets; the CIRMP Rules, for example, require Maturity Level One for most critical infrastructure assets and Maturity Level Two for assets under the enhanced requirements
• There is no certification. ASD does not certify organisations against the Essential Eight, and neither does Aegentra; an assessment records a maturity position at a point in time
• In October 2026 ASD released the Essentials series as the evolution of the Essential Eight; ASD states that existing Essential Eight investment carries forward, and most Australian tenders and insurers still ask for Essential Eight evidence

Who asks for an Essential Eight assessment

The request usually arrives from outside the organisation. A government customer or a prime contractor asks for a maturity level in a tender, a cyber insurer asks for it at renewal, a board asks where the organisation stands after a public incident, or a responsible entity under the SOCI Act chooses the Essential Eight as the cyber security framework in its risk management program. The useful question is not whether the eight strategies exist in some form, but what maturity level each strategy actually reaches across the whole environment.

• Suppliers to Australian, state and territory government agencies that are asked to state a maturity level
• Organisations whose cyber insurer or enterprise customers ask for Essential Eight evidence
• Responsible entities under the SOCI Act that adopt the Essential Eight Maturity Model as their CIRMP cyber security framework
• Boards that want a defensible answer to "what is our maturity level" rather than a tooling dashboard
• Microsoft 365 organisations that have switched on security features and want to know whether those features meet the strategy requirements

Where the Essential Eight fits beside ISO 27001 and the SOCI Act

The Essential Eight is a focused set of technical mitigations with maturity levels. ISO 27001 is a management-system standard whose controls are selected by risk assessment. They overlap but are not interchangeable, and a maturity level does not establish ISO 27001 conformity any more than a certificate establishes a maturity level. For SOCI responsible entities, the Essential Eight Maturity Model is one of the frameworks the CIRMP Rules allow, so the maturity assessment can become the evidence behind the cyber and information security hazard section of the program.

• An ISO 27001 ISMS can treat the eight strategies as risk-selected Annex A controls, with the maturity assessment as the operating evidence
• Under the CIRMP Rules a responsible entity may comply with the Essential Eight Maturity Model, AS ISO/IEC 27001, the NIST framework or the other listed frameworks, or an equivalent framework
• A maturity assessment does not replace an ISO 27001 internal audit, a penetration test or an IRAP assessment; each answers a different question
• We state which question the assessment answers so the report is not misread by a customer or a regulator

Frequently asked questions

Is there an Essential Eight certification?

No. The Australian Signals Directorate publishes the Essential Eight and its maturity model; it does not certify organisations against them, and no accreditation body issues an Essential Eight certificate. An organisation either self-assesses or engages a third party to assess its maturity level per strategy. Aegentra provides that assessment and the uplift plan. If a provider offers to "certify" you against the Essential Eight, ask what body stands behind the certificate.

What maturity level should we target?

The target depends on who is asking and what the environment protects. A tender or a contract often states a level. For responsible entities under the SOCI Act that adopt the Essential Eight Maturity Model, the CIRMP Rules require Maturity Level One, or Maturity Level Two for assets under the enhanced requirements. Where nobody has set a level, we agree one with you at scoping and record the reason, so the assessment measures against a stated target rather than an assumed one.

Does the assessment cover the whole organisation or just Microsoft 365?

It covers the environment you nominate at scoping. Several strategies, such as application control, patching of operating systems and backups, reach well beyond Microsoft 365 into workstations, servers and operational systems. Microsoft 365 is often where the identity, email and endpoint controls live, so it is assessed in detail, but a maturity level is only meaningful for the environment it was measured across, and the report states that boundary.

We have Microsoft 365 Business Premium. Does that give us a maturity level?

No. Business Premium includes tooling that supports several strategies, such as Conditional Access, Intune and Defender, but enabling a feature does not establish Maturity Level One or Two. The requirements include implementation across the assessed environment, effectiveness, patching timeframes, administrative access and tested recovery. The assessment checks those requirements, not the presence of a licence.

Has the Essential Eight been replaced by the Essentials series?

It is being evolved. In October 2026 ASD released the Essentials series as a principles-based successor with chapters for enterprise IT, operational technology and cloud, and stated that existing Essential Eight investment carries forward, with transitional arrangements to be discussed into 2027. Most Australian tenders and insurers still ask for Essential Eight evidence, and the CIRMP Rules still name the Essential Eight Maturity Model. We assess against the model your customer or regulator cites and note where the Essentials series changes the picture.

Can Aegentra assess our maturity and then do the uplift work?

Yes, as two separately scoped engagements. The assessment produces the maturity position and the plan; the Harden practice delivers the Microsoft 365 configuration work where you want it. The scope records who did which part. If you later need an independent view of the uplifted environment, a different Aegentra consultant or a separate provider can re-assess it, and we say so in the proposal rather than leaving it to be discovered.

How does an Essential Eight assessment differ from a penetration test?

A maturity assessment checks whether the eight mitigation strategies are implemented to the requirements of a maturity level, using configuration, records and interviews. A penetration test attempts to exploit weaknesses in a defined scope. One shows the state of the controls; the other shows what an attacker could do despite them. Many organisations need both, and we keep them as separate services with separate reports.

Will the assessment satisfy our SOCI Act risk management program?

It can be the evidence behind the cyber and information security hazard section of your CIRMP where you have adopted the Essential Eight Maturity Model as your framework, because the Rules name that model and the maturity level required. The CIRMP itself covers more than cyber: personnel, supply chain, and physical security and natural hazards, plus the annual report. See our SOCI Act compliance service for the program as a whole.

What evidence do we need to provide?

Read access to the systems in scope, or exports from them, together with the records that show the strategies operate: patch and update reports, application control policies and logs, administrative account lists and reviews, multi-factor authentication configuration, backup schedules and restoration tests, and the people who own each area for short interviews. We agree secure handling of that evidence at scoping and do not ask for passwords or tokens through email.

How long does an assessment take and what does it cost?

Both depend on the number of systems and users in scope, how many platforms are involved and how quickly evidence can be provided. We scope the work first and quote a fixed fee for the agreed scope rather than publishing a price that would be wrong for most environments. Uplift delivery and re-assessment are quoted separately so you can see what each part costs.

Scope and boundaries

There is no Essential Eight certificate, and we do not issue one.

ASD publishes the maturity model and certifies nobody; neither does Aegentra. What you can show a customer, an insurer or a regulator is an evidenced maturity position at a point in time, measured across the environment the report names. Every engagement is scoped and quoted as a fixed fee after a scoping call, and the report states what was examined and what was not.

Find out where each strategy actually stands.

A practitioner reviews the environment, the target level and the evidence you can provide, then sends a written scope and a fixed fee for the assessment. Uplift and re-assessment are quoted separately so each part of the cost is visible.

Where the service fits

Related Aegentra services

• Microsoft 365 security assessment (Harden)
• Microsoft 365 hardening checklist mapped to the Essential Eight
• ISO 27001 consulting and implementation
• SOCI Act compliance: critical infrastructure risk management program
• ISM readiness for government suppliers

Training, implementation, internal audit and independent certification have separate scopes and fees.

Where the environment is Microsoft 365, the uplift work is delivered through the Microsoft 365 security assessment and hardening services, starting from the settings in the Microsoft 365 hardening checklist. Responsible entities under the SOCI Act can read how the Essential Eight Maturity Model sits inside the critical infrastructure risk management program, and government suppliers how it feeds ISM readiness.

Where we work

Teams in Melbourne and Sydney. Delivered across all Australian states and territories, remotely or onsite by arrangement. New Zealand and Asia Pacific by arrangement.