Someone is asking for your Essential Eight level. We'll get you there, prove it and keep you there.

Any size, any industry

We work with organisations from ten staff to several thousand. A small business on Microsoft 365 Business Premium and a 1,500-seat hybrid estate need the same eight controls, delivered differently.

• Up to about 50 staff: a standard, ready-made Essential Eight setup, applied to your Microsoft 365 in days, then evidenced. You need a few hours in total.
• 50 to 200 staff: the same baseline, with application control and administrator separation fitted to the applications you run.
• 200 to 2,000 staff: an evidence-based assessment with sampling, then a phased uplift through your change process, alongside your IT team.
• Larger organisations: individual strategies or evidence work delivered inside your existing security plan.

We do, you do

• We do: assess every strategy, design the controls, set them up, pilot them, roll them out, build the application control rules, handle exceptions, produce the evidence pack, reassess and brief your leadership.
• You do: grant access, approve changes through your change process, nominate a pilot group and give us application owners for testing. For most organisations that is two to four hours a week from one person.

Levels we deliver

Maturity Level One is the usual first target, and the level the SOCI rules and several state policies refer to.

Maturity Level Two is what most contracts and many insurers ask for. It is the level we are asked for most.

Maturity Level Three suits organisations facing targeted, well-resourced adversaries. We scope it after an assessment, because it depends heavily on your estate and licensing.

ASD advises reaching the same level across all eight strategies before going higher, and we plan the uplift that way.

What you end up with

• A maturity level for each strategy, with the evidence behind it
• Every setting recorded and handed to you, so it can be checked, put back if someone changes it, and shown to an auditor
• An evidence pack you can give to a contract manager, insurer, auditor or regulator
• A one-page summary for your leadership and board
• Runbooks your team can use, or a monthly service from us

Will application control break our applications?

It will if it is switched on in one go. We build the rules from what your people run, leave the policy in audit mode until the logs are clean, then enforce in rings, starting with IT. Exceptions go through a fast approval route so nobody is stuck waiting.

Is the Essential Eight being replaced?

Yes, over time. In June 2026 ASD opened consultation on a broader Essentials series that will replace the Essential Eight, covering enterprise IT, cloud and operational technology. The ACSC has said the Essential Eight will be retired in about two years.

Contracts, the SOCI rules and insurers still ask for Essential Eight levels today, and ASD has said the work you do under the Essential Eight stays relevant under the Essentials. When the new guidance is final, clients on our Maintained service get their position mapped across.

Proof

We closed audit findings and Essential Eight gaps across around 14,000 users and devices: multi-factor authentication for every user, legacy authentication blocked, compliant devices required, standing admin rights replaced with just-in-time access, and Defender for Endpoint and Sentinel deployed, all through change control. The audit passed.

How it is priced

Every package is a fixed fee, agreed in writing after scoping. The uplift is paid by milestone, and each milestone is paid once its evidence is accepted. The assessment fee is credited against the uplift if you go ahead within 60 days.