Which Essential Eight maturity level do we need?

Maturity Level 2 is the most common target in contracts, insurer questionnaires and government supply chains. Level 3 is usually reserved for organisations handling sensitive data or facing capable, targeted adversaries.

Is an Essential Eight assessment the same as an IRAP assessment?

No. An Essential Eight assessment rates controls against the ASD Essential Eight Maturity Model. An IRAP assessment is a broader government assessment against the Information Security Manual by an IRAP-endorsed assessor, required for specific Commonwealth work.

Can Coder Trove deliver the uplift as well?

Yes. Coder Trove can deliver the uplift or hand the costed plan to the client's own team or MSP, and re-rates the controls once the work is done.

+61 2 7200 2554

Essential Eight · For Australian organisations

Independent Essential Eight assessment

Q: What does an Essential Eight assessment cost?

Cost depends on users and devices, environments and business units in scope, and how much evidence already exists. Most single-entity Australian organisations fall between A$12,000 and A$25,000; Coder Trove provides a fixed quote within one business day of a scoping call.

Q: Is the assessment independent of our IT provider?

Yes. Coder Trove does not run the client environment and works alongside the MSP or internal IT team for access and evidence. The report goes to the client.

Q: Can Coder Trove assess organisations on Google Workspace or non-Microsoft platforms?

Yes. The Essential Eight is platform-neutral. Coder Trove assesses and uplifts Microsoft 365, Google Workspace, hybrid and on-premises environments; the evidence collected differs by platform, the rating method does not.

Every control rated on evidence from your environment, with a costed plan to reach the level you have been asked for. Two to four weeks.

Book a 30-minute scoping call or take the free five-minute quick check

With Marcel Rizzolo, director. Typically A$12,000 to A$25,000 for a single-entity organisation; fixed quote in writing within one business day.

Every control rated on evidenceAgainst the current ASD Essential Eight Maturity Model
Costed, sequenced uplift planEffort and cost against each step, ready for the board
Independent of your MSPWe do not run your environment and the report goes to you
Uplift by our engineers or your teamFollowed by a re-rating of the controls that were changed

What you get

Two to four weeks, four documents, one plan

Scoping call

Thirty minutes with Marcel. You tell us who is asking and by when. We confirm scope and send a fixed quote the next business day.

Evidence

We collect exports and screenshots from your environment with read-only access. Your IT team or MSP spends a few hours, not a few days.

Rating

Each control is rated against the current ASD maturity model. Aligned, partially aligned or open gap, with the evidence behind each call.

Report and plan

An executive brief, the full report, the workbook and policy recommendations. The uplift plan is costed and sequenced, ready for the board.

Most of the fixes sit in tools you already pay for. For Microsoft 365 that is Intune, Defender and Entra. Google Workspace and mixed estates are assessed the same way. Our engineers can do the uplift, or your own team can work from the plan. Either way we re-rate the controls once the work is done.

Already assessed, or know where you stand? If you have a recent assessment or MSP report and need help lifting your tools and processes to the next maturity level, or getting ready for ISO 27001, our uplift team can take it from there.

See Essential Eight uplift

Next step

Book a free 30-minute consult

Marcel RizzoloDirector, Coder Trove

You will have a fixed quote in writing the next business day.

No sales pitch. If an assessment is not what you need, Marcel will tell you on the call.
Your details are used to set up the call and send the quote, nothing else.

Prefer email or phone? Send a note or call +61 2 7200 2554.

Who does the work

Assessed by people who have owned these controls

The practice

CISO-led

Our cyber security practice is led by our Chief Information Security Officer and run by Ben. The same team runs penetration testing, incident response and vCISO retainers.

The assessors

CISM and OSCP certified

Our assessors have led cyber consulting practices and held CISO and CTO roles in government and the private sector. The report is written by people who have run these controls.

The firm

Australian since 2010

Coder Trove has worked with mid-sized and enterprise organisations across Australia since 2010.

Our 2026 analysis of Australian breach costs sets out why insurers and regulators now ask to see the evidence.

Not ready to book?

See where you stand first

An indicative view of your position against each of the eight ASD strategies, and where you are most exposed. Two questions per strategy, about five minutes.

Before you start

Eight strategies, two questions each

Answer for your organisation as it is today, not as the policy says it should be. Each section opens with why the strategy matters and one practical note from our assessors. Allow about five minutes.

At the end you see an indicative position for each strategy and overall. ASD scores an organisation at its weakest strategy, so one gap sets the level.

This quick assessment is a guide based on your answers. It is not a formal assessment and cannot be used as evidence for a client, insurer or Defence.

Common questions

Essential Eight assessment questions, answered

What does an Essential Eight assessment cost?

Most single-entity Australian organisations fall between A$12,000 and A$25,000. Where you land depends on users and devices, how many environments are in scope, and how much evidence already exists. Larger or multi-entity groups sit above the range, and we say so on the call. The quote is fixed and does not move unless the scope does.

How long does it take?

Most assessments run two to four weeks from scoping call to report. The turnaround is written into the quote. Evidence collection is usually the longest part, so good records make it faster.

Which maturity level do we need?

Maturity Level 2 is the most common target in contracts, insurer questionnaires and government supply chains. Level 3 is usually for organisations handling sensitive data or facing capable, targeted adversaries. If you are not sure, Marcel will tell you on the call.

Is the assessment independent of our IT provider?

Yes. We do not run your environment. We work alongside your MSP or internal IT team for access and evidence, and the report goes to you. A maturity level reported by the provider who runs the environment is often discounted by insurers and auditors.

We run Google Workspace, not Microsoft 365. Can you still assess us?

Yes. The Essential Eight is platform-neutral. We assess and uplift Microsoft 365, Google Workspace, hybrid and on-premises environments. The evidence differs by platform; the rating method does not.

Is this the same as an IRAP assessment?

No. An Essential Eight assessment rates your controls against the ASD maturity model. IRAP is a broader government assessment against the Information Security Manual by an IRAP-endorsed assessor, required for specific Commonwealth work. If you need IRAP, Marcel will tell you.

Should we do the Essential Eight or ISO 27001 first?

If an Australian insurer, customer or government buyer is asking, the Essential Eight first. It is faster and it is what they named. International customers and enterprise procurement usually ask for ISO 27001, and Essential Eight work counts toward its technical controls.

ASD is replacing the Essential Eight. Should we still get assessed?

Yes. ASD opened consultation in June 2026 on an Essentials series that will succeed the Essential Eight over roughly two years. Until then the Essential Eight is what insurers, auditors and contracts ask for. The controls carry across, and we keep the evidence in a form that can be re-cut against the new guidance.

Can you deliver the uplift as well?

Yes. The people who found the gaps already know the environment, which makes the uplift faster. You can also hand the costed plan to your own team or MSP. Either way we re-rate the controls once the work is done. Our Essential Eight uplift page explains how that runs.

Start here

Tell us who is asking, and by when

Thirty minutes with Marcel, then a fixed quote and a dated turnaround in writing the next business day.

Book a 30-minute scoping call