Essential Eight Assessment & Maturity Uplift

Update (July 2026): ASD has confirmed it will retire the Essential Eight within two years, replacing it with a broader, outcomes-based “Essentials” series. Consultation on the first chapter closed on 12 July 2026. The Essential Eight remains the active, supported framework today and your investment carries over. Read our full explainer on what’s changing and when.

Practical Essential Eight assessment and maturity uplift for Australian organisations, especially those bidding for government and enterprise work. Streamline assesses where you stand, rates your maturity honestly, and gives you a clear, prioritised roadmap to the level your tender actually asks for. Most assessments take one to two weeks and are run remotely.

Essential Eight cyber security maturity assessment — Each of the eight strategies is scored separately from Level 0 to Level 3, against evidence rather than a questionnaire. Most assessments take one to two weeks, and the variable is how quickly you can produce that evidence.

What is the Essential Eight?

The Essential Eight is a set of eight baseline mitigation strategies from the Australian Cyber Security Centre (ACSC) that protect against common cyber threats. Maturity is measured on a scale from Level 0 to Level 3, and many Australian government and enterprise tenders now specify a target maturity level.

Application control
Patch applications
Configure Microsoft Office macro settings
User application hardening
Restrict administrative privileges
Patch operating systems
Multi-factor authentication
Regular backups

How Streamline helps

We assess your current Essential Eight maturity against each of the eight strategies, identify the gaps, and give you a prioritised roadmap to your required level. Where you also hold or are pursuing ISO 27001, we align the two so your security investment does double duty. You work directly with an experienced information security auditor.

What an Essential Eight assessment involves

An assessment is a structured review of your environment against each of the eight strategies, scored against the ACSC maturity scale. In practice it runs like this:

Scoping. We agree the systems in scope and the target maturity level you actually need, which is the biggest cost lever in the whole exercise.
Evidence gathering. We review configurations, patching, backups, MFA coverage and administrative access against each strategy. Not a questionnaire: evidence.
Maturity rating. Each of the eight strategies is scored honestly from Level 0 to Level 3. You will get the real number, not a flattering one.
Gap analysis. Exactly where you fall short of the target, and why it matters.
Prioritised roadmap. A sequenced, costed plan to close the gaps, ordered by impact and by what is cheap to fix first.

What you get

A clear assessment report: your current maturity level for each of the eight strategies, the gaps to your target, and a prioritised action plan you can hand straight to your IT team or managed service provider and have them act on it. Where you also hold or are pursuing ISO 27001, we align the findings so the same work counts toward both rather than being done twice.

How long it takes

For most small and mid-sized organisations, one to two weeks, depending on the size of your environment and how readily the evidence can be produced. That second factor is usually the one that drags. We work remotely with clients across Australia, so on-site visits are rarely needed.

The Essential Eight maturity levels

The ACSC defines four maturity levels for each strategy, and your target depends on the threats you need to defend against:

Maturity Level 0: significant weaknesses in your overall security posture.
Maturity Level 1: protection against common, opportunistic attacks using widely available tools.
Maturity Level 2: protection against more capable adversaries who invest time and effort.
Maturity Level 3: protection against sophisticated, targeted and adaptive attackers.

Most businesses are asked for Level 1 or 2 in tender prequalification; organisations handling sensitive government data may need Level 3. If you are not sure what to aim for, we help you set a target that is defensible without over-investing. Chasing Level 3 when your customer asked for Level 1 is an expensive way to win nothing extra. For the detail on each level, see the Essential Eight explained.

Why the Essential Eight matters for winning work

The Essential Eight is mandatory for many Australian government entities, and increasingly flows down to their suppliers through tenders and contracts, even where it is not legally mandated for your organisation directly. Being able to demonstrate a defined maturity level is becoming a precondition for bidding on government and enterprise work, and the controls genuinely reduce your risk of a costly cyber incident. Streamline helps you reach your target efficiently and keep it current, and where it makes sense we extend the work into full ISO 27001 certification.

Essential Eight guides

The assessment isn’t the expensive part. The incident is.

The OAIC recorded 1,205 notifiable data breaches in 2025, the highest since the scheme began. Only 716 were malicious or criminal. The other 489 were not attacks at all. The Essential Eight hardens your technical controls; it does not fix an access review nobody runs. Both halves matter, and both are cheaper than the breach.

What poor quality and incidents really cost →

Frequently asked questions

What Essential Eight maturity level do I need?

It depends on your risk profile and what your customers or tenders require, commonly Maturity Level 1 or 2 for general business, with higher levels for handling sensitive government data. We help you confirm the target and the most cost-effective path to reach it.

Is the Essential Eight mandatory?

It is mandatory for many Australian government entities, and it increasingly reaches private businesses through tenders and contracts even where it is not legally mandated for them directly. In practice, most organisations come to us because a customer asked for a maturity level, not because a law did.

How long does an Essential Eight assessment take?

One to two weeks for most small and mid-sized organisations, run remotely. The variable is not our speed. It is how quickly you can produce evidence for the controls you believe you have.

How does the Essential Eight relate to ISO 27001?

The Essential Eight is a focused set of technical controls; ISO 27001 is a complete information security management system. They complement each other. The Essential Eight strengthens key technical controls within a broader ISO 27001 framework. See Essential Eight vs ISO 27001 if you are deciding between them.

Is it worth starting the Essential Eight if ASD is retiring it?

Yes. It is the live framework today, it is what tenders still reference, and ASD has confirmed your investment carries over to the incoming Essentials series. Here is what is changing and when.

Speak with an experienced ISO auditor

Need to meet an Essential Eight maturity target for a tender? Email hello@streamline.business or call us. You will deal directly with an experienced information security auditor, not a salesperson.