Cyber insurers, auditors and enterprise customers now use the Essential Eight to assess Australian private sector organisations, and they check whether each control is operating. A policy document saying a control exists no longer satisfies them.
The Essential Eight was written by the Australian Signals Directorate as guidance for government entities. It became the yardstick for the private sector because everyone who assesses organisations needed a common standard, and this one was already in use.
That changes who you are answering to. It is a cyber insurer pricing your premium, an enterprise customer's security questionnaire deciding whether you make the panel, and an auditor who knows which questions expose a control that exists only on paper.
The Essential Eight covers eight mitigation strategies: application control, patching applications, configuring Microsoft Office macro settings, user application hardening, restricting administrative privileges, patching operating systems, multi-factor authentication, and regular backups. Each is assessed at maturity levels one to three, and the levels are defined by how well the control resists increasingly capable attackers. Whether a policy exists does not set the level.
So level one MFA means more than "we have MFA somewhere". The maturity model asks where it applies, what it protects, and what happens on the paths around it. Our explainer on the Essential Eight maturity model covers the levels in detail.
We run these assessments across regulated and commercial organisations, and the same gaps appear reliably enough to list plainly.
Patching performance falls well short of the window the policy states, and the assessor finds the gap before the IT team does. Administrative privileges have accumulated for years, so a quarter of the service desk can quietly do things only two people should. MFA protects the main remote access route while an older, forgotten one stays exposed. Backups exist but have never been restored end to end, so nobody knows whether they work.
None of this is unusual, and none of it is shameful. It is the normal state of controls that were implemented once and never re-verified. What has changed is that insurers and auditors now verify. Our Essential Eight checklist sets out the evidence to hold for each control.
The assessments worth paying for score what exists and give no credit for documentation alone. If application control is enforced on servers but advisory on endpoints, that is the score. If the backup restore has never been rehearsed, backups get no credit for existing. Clients occasionally find this confronting for a week, and then find the uplift plan is short, concrete and defensible, because it is built on the real position.
The uplift itself is rarely exotic. Most organisations reach the maturity level their risk profile requires through configuration, privilege clean-up and process discipline, without buying new products. The exceptions cluster around application control, which usually needs tooling and always needs patience. Our Essential Eight uplift service works through these in order.
If you have not been asked for your Essential Eight maturity level yet, expect it at contract renewal from your insurer, in a tender from a prospective customer, or after an incident from everyone at once. Arriving with a current assessment and a dated uplift plan changes that conversation, and getting there is a few weeks of work.
Requirements vary by insurer and policy. Many now ask about Essential Eight controls at renewal and expect evidence that the controls operate.
It depends on your risk profile and contracts. Level one is the usual floor for commercial organisations, and level two is increasingly expected where you hold sensitive data at scale or sell into government supply chains.
Getting a current assessment and a dated uplift plan in place is typically a few weeks of work. Closing the gaps it finds takes longer, depending on what they are.
Usually not. Most uplift is configuration, privilege clean-up and process discipline. Application control is the common exception, because it usually needs tooling.
Our Essential Eight assessment and uplift work are standing services in our cyber security practice, scored on the controls running in your environment.
Ben Jones leads the cyber security practice at Coder Trove.