Control-level evidence
Review each mitigation strategy against the environment in scope, including the technical controls and supporting policy.
Advise / Essential 8 Audits
Know exactly where you stand against the Essential Eight.
A structured maturity assessment against the Australian Cyber Security Centre's Essential Eight, with a prioritised plan to close the gaps.
The challenge
Evidence first. Security decisions with substance.
An Essential Eight assessment needs to distinguish between a control being described, configured and supported by evidence. The findings should explain the maturity position and the practical work required to address gaps.
Most organisations know they should be assessed against the Essential Eight.
Few have a current, evidence-based view of where they actually sit or a realistic plan to move up a maturity level.
A one-off assessment goes stale as the environment and threats change.
When this service makes sense.
Your maturity position is out of date or unverified.
Audit, insurance or customer review requires evidence.
Leadership needs a prioritised remediation position.
From need to outcome
A clear line through the work.
Understand the starting point. Do the work that matters. Give your team something practical to carry forward.
Understand
Technical controls
Policy evidence
Assessment scope
Do the work
01Review eight strategies
02Assess against ACSC guidance
03Prioritise remediation
Carry it forward
Evidence-based maturity findings and a remediation roadmap
01application control
02patching of applications
03Microsoft Office macro settings
04user application hardening
05restricting administrative privileges
06patching of operating systems
07multi-factor authentication
08regular backups
Scope of work
The detail behind the delivery.
A clear, evidence-based view of your security maturity against the ACSC Essential Eight. The scope reflects your priorities, the operating environment and what needs to be achieved.
A defensible position
Document the basis for the maturity assessment. Make gaps and evidence limitations visible rather than implying assurance without support.
Actionable remediation
Translate findings into priorities and board-ready reporting so leadership understands where effort is needed.
What we cover
Essential 8 Audits- Application control
- Patching of applications
- Microsoft Office macro settings
- User application hardening
- Restricting administrative privileges
- Patching of operating systems
- Multi-factor authentication
- Regular backups
- Evidence-based scoring against ACSC guidance
- Board and executive reporting
Our approach
Structured work.
Purpose at every stage.
The method follows the work, not a generic playbook. Each stage connects to the decisions, capability or delivery your organisation needs.
Our approach / stage 1
Scope the environment and workshop with stakeholders
Agree the systems, stakeholders and evidence included in the assessment.
Your operating environment
Different pressures.
The same need for clarity.
Governance, obligations and delivery constraints differ. The engagement is shaped around the organisation you run, not an assumed environment.
Public sector
Agencies under audit or compliance pressure.
Commercial organisations
Organisations preparing for audit, insurance review or a client security assessment.
Intended outcomes
What this work is designed to change.
A defensible maturity position.
A realistic path to the next level.
Reporting a board can act on.
Specialist expertise. Practical application.
A security position supported by evidence, not assumptions.
Start with the right conversation
Define the need.
Shape the engagement.
We begin with what needs to change and the decisions or work your team needs to support. These are useful starting points for a conversation about essential 8 audits.
Systems and environments to include
Control documentation and supporting evidence
Technical stakeholders and existing assessment findings
The scope, people involved and expected outputs are agreed around your organisation’s needs.
Book a conversationQuestions
What you need to know.
How often should we reassess?
At least annually, and after major infrastructure or threat changes.
Does it cover cloud as well as on-premises?
Yes, assessed against your actual environment.
What do you need from our team?
Access to stakeholders and evidence. We agree the scope and effort up front.
Connected expertise
Where the work goes next.
Let's move the work forward
Make the next decision with confidence.
Tell us what needs to change, what is at stake and where you need support. We will discuss the advice, delivery or specialist capability the work calls for.