Essential Eight Assessment and Uplift for South East Queensland Businesses
Loginet Technologies helps South East Queensland small and medium businesses assess and lift their maturity against the ASD Essential Eight. We measure each of the eight mitigation strategies against the official maturity model, give you a plain-English gap report and prioritised roadmap, then implement and maintain the controls, from MFA and patching to tested backups.
or call (07) 4599 7909
What the Essential Eight is (in one minute)
The Essential Eight is a set of eight mitigation strategies that the Australian Signals Directorate (ASD) recommends as a cyber security baseline for Australian organisations. ASD developed them from its broader Strategies to Mitigate Cyber Security Incidents and describes them as “the most effective of these mitigation strategies” (Essential Eight maturity model).
| Objective | Mitigation strategies |
|---|---|
| Prevent attacks | Patch applications; Patch operating systems; Application control; Restrict Microsoft Office macros; User application hardening |
| Limit the impact of an attack | Multi-factor authentication; Restrict administrative privileges |
| Recover data and systems | Regular backups |
Want the full background first? Read our guide to what the Essential Eight is, in plain English.
Which maturity level does your business need?
ASD’s maturity model has four levels:
- Maturity Level Zero: weaknesses exist that Level One is designed to close.
- Maturity Level One: defends against opportunistic attackers using widely available tools, such as unpatched online services or stolen and guessed passwords.
- Maturity Level Two: defends against attackers who invest more time and effort, including targeted phishing and attempts to get around weak MFA.
- Maturity Level Three: defends against more adaptive attackers who move quickly on new exploits and work to evade your specific controls.
ASD’s own guidance is that “Generally, Maturity Level One may be suitable for small to medium enterprises, Maturity Level Two may be suitable for large enterprises, and Maturity Level Three may be suitable for critical infrastructure providers and other organisations that operate in high threat environments” (Essential Eight maturity model FAQ).
Our practical view: most SMBs should reach Level One across all eight strategies first, then move to Level Two where an insurer, a customer contract, a tender or the sensitivity of your data justifies it. ASD recommends planning to reach the same maturity level across all eight strategies before moving to a higher level, because the strategies are designed to work together.
The November 2023 update to the maturity model made centralised collection and analysis of event logs a requirement at Level Two (maturity model changes). That is why Level Two usually needs proper log collection and monitoring, such as our SIEM and threat monitoring service.
or call (07) 4599 7909
Who asks for the Essential Eight (and why it matters to SE QLD SMBs)
The Essential Eight is not a legal requirement for most private businesses, but more and more people are asking about it:
- Cyber insurers ask about MFA, backups, patching and admin rights at renewal.
- Larger customers send supply-chain security questionnaires before they sign or renew.
- Government and council tenders ask about it. Non-corporate Commonwealth entities subject to the Protective Security Policy Framework treat Maturity Level Two as a mandatory baseline (ASD maturity model FAQ), and those expectations flow down to their suppliers.
- Privacy obligations. Businesses covered by the Privacy Act 1988 must take reasonable steps to protect the personal information they hold (OAIC guidance). The Essential Eight is a sensible, well-documented way to show what you have done.
ASD also notes there is no requirement to have an Essential Eight implementation certified by an independent party, unless a government directive, regulator or contract requires an independent assessment.
Our Essential Eight service, step by step
1. Scoping call
We agree your target maturity level and what is in scope: your Microsoft 365 tenant, Windows endpoints, servers and cloud services.
2. Maturity assessment
We assess each of the eight strategies against the ASD maturity model, following the approach in ASD’s Essential Eight Assessment Process Guide.
3. Gap report and roadmap
You get a plain-English report with a maturity rating for each strategy and a prioritised plan. Quick wins come first: MFA, admin rights, backups and patching.
4. Uplift and implementation
We implement the controls: Intune and Defender policies, application control, macro settings, browser hardening, privileged access, backup design and restore tests. See our endpoint protection, email security, Microsoft 365 security and backup and recovery services.
5. Ongoing monitoring and evidence
Controls drift as staff, devices and software change. As part of our managed IT services, we keep the controls working, with 24/7 monitoring, and keep the evidence your insurer or customers ask for.
The eight strategies, and what we put in place
The summaries below reflect the Maturity Level One requirements in the November 2023 maturity model. Always check the current maturity model for the full wording.
Patch applications
Level One expects regular vulnerability scanning and patches for internet-facing services within 48 hours when a vulnerability is critical or exploited, and within two weeks for browsers, Office, email clients, PDF software and security products. We automate application patching and report on what is missing.
Patch operating systems
Level One expects operating system patches within one month for workstations and internal servers, faster for internet-facing systems, and unsupported operating systems replaced. We manage Windows updates through Intune and plan replacements for out-of-support systems.
Multi-factor authentication
Level One expects MFA for staff on online services that hold sensitive data, including third-party services. We enforce MFA through Microsoft Entra ID and conditional access, and help you switch it on for your other cloud apps.
Restrict administrative privileges
Level One expects privileged users to have separate admin accounts that are not used for email and web browsing, and privileged access to be validated when first requested. We remove everyday admin rights and set up dedicated admin accounts.
Application control
Level One expects workstations to run only approved programs, scripts and installers, including in user profiles and temporary folders. We design and roll out application control policies in stages, so they block the bad without stopping your team working.
Restrict Microsoft Office macros
Level One expects macros to be disabled for users without a business need, macros from the internet blocked, macro antivirus scanning on, and settings locked so users cannot change them. We set these through Microsoft 365 and Intune policy.
User application hardening
Level One expects Internet Explorer 11 disabled or removed, browsers blocking web ads and Java from the internet, and browser security settings locked. We apply hardened browser baselines across your fleet.
Regular backups
Level One expects backups of data, applications and settings that are kept securely, restorable to a common point in time, tested, and protected from being deleted or changed by ordinary user accounts. We design the backup, protect it and run restore tests. See backup and recovery.
Essential Eight with Microsoft 365 Business Premium
Many Level One controls can be delivered with the tools in Microsoft 365 Business Premium: Intune for device policy and patching, Defender for Business for endpoint protection, and Entra ID for MFA and conditional access. It does not cover everything. Backups need a separate solution, and application control and some hardening need careful configuration, especially at higher maturity levels. We map what you already pay for against each strategy before recommending anything new.
How much does an Essential Eight assessment cost?
The price of an assessment depends on how many users, devices and sites you have, whether you are cloud-only or also run on-premises servers, and the maturity level you are targeting. We give you a fixed quote after a scoping call, so the price is agreed before any work starts. Our published starting prices for a Maturity Level One assessment are below.
| Business size | Assessment (Maturity Level One) | Report turnaround |
|---|---|---|
| Up to 20 users, single site | From $2,590 ex GST | 5 business days |
| 21–50 users | From $3,450 ex GST | 7 business days |
| 51–100 users | From $4,350 ex GST | 10 business days |
| Over 100 users, multiple sites or Maturity Level Two | Fixed quote after a scoping call | Agreed at scoping |
Each assessment covers all eight strategies, with a maturity rating for each, a plain-English gap report and a prioritised roadmap. The turnaround is counted from when we have the access we need. Uplift work is quoted separately after the assessment, once we know the gaps.
or call (07) 4599 7909
The Essential Eight is evolving: what that means for you
In June 2026, ASD announced that the Essential Eight will evolve into a broader Essentials series. The first chapter, Essentials for enterprise IT, builds on the current Essential Eight, and further chapters for operational technology and cloud will follow (ASD announcement). ASD has said both frameworks will run side by side during a transition period, and that it expects to start deprecating the Essential Eight in about 12 months and retire it in about 24 months (iTnews).
For now, the Essential Eight is still the framework insurers, customers and tenders name. The controls underneath it, such as MFA, patching, admin rights, application control and backups, are the foundation the new series builds on. Work you do now carries forward, and we will map your results to the Essentials series once ASD publishes the final guidance.
Why SE QLD businesses use Loginet for the Essential Eight
- One provider for the controls and the day-to-day IT. Managed IT, Microsoft 365, backup, networking and phones sit with the same team that implements your Essential Eight controls, so nothing is lost between providers.
- Local offices. Our head office is at 12/217 Margaret St, Toowoomba, and our Gold Coast office is at Suite F10B, 47 Ashmore Rd, Bundall, with support staff across Australia.
- A certified team. Our engineers hold AWS and CEH (Certified Ethical Hacker) certifications, and we have 4+ years of experience delivering IT and cybersecurity services.
- 24/7 monitoring keeps an eye on your systems outside business hours.
- Straight answers. We cite ASD’s own guidance, explain what each control means for your team, and do not promise “certification” for a framework that has none.
Explore our wider cybersecurity services.
Frequently Asked Questions
What is the Essential Eight?
The Essential Eight is eight mitigation strategies that ASD recommends Australian organisations implement as a cyber security baseline: patch applications, patch operating systems, multi-factor authentication, restrict administrative privileges, application control, restrict Microsoft Office macros, user application hardening and regular backups.
Is the Essential Eight mandatory for my business?
Not for most private businesses. It is mandatory for many Australian Government entities, and it is increasingly asked for by cyber insurers, larger customers and tenders.
What maturity level should a small business aim for?
ASD says Maturity Level One may be suitable for small to medium enterprises. We usually start there and move to Level Two where your risk, customers or insurer require it.
How much does an Essential Eight assessment cost?
Our Maturity Level One assessments start from $2,590 ex GST for up to 20 users, $3,450 for 21–50 users and $4,350 for 51–100 users. We confirm a fixed quote after a scoping call. Larger environments and Maturity Level Two are quoted at scoping.
How long does an assessment take?
We deliver the report within 5 business days for up to 20 users, 7 business days for 21–50 users and 10 business days for 51–100 users, counted from when we have the access we need.
Is the Essential Eight being replaced?
ASD announced in June 2026 that it will evolve into a broader Essentials series. Both will run side by side during the transition, and ASD expects to retire the Essential Eight in about two years. The core controls carry forward.
Can you implement the controls, not just assess them?
Yes. We implement and maintain the controls as part of our managed IT and cybersecurity services.
Does Microsoft 365 Business Premium cover the Essential Eight?
It covers a lot of Level One through Intune, Defender for Business and Entra ID MFA and conditional access, but not everything. Backups and some hardening need extra tools or configuration.
Is the Essential Eight a certification?
No. It is a maturity model. You are assessed against it, not certified, and ASD does not require independent certification unless a directive, regulator or contract asks for it.
Will you give us something to show our insurer or customer?
Yes. Our gap report gives a maturity rating for each of the eight strategies, which you can use to answer insurer and customer questions.
Not sure where you sit?
Book an Essential Eight review and get a clear picture of your maturity level and next steps.
or call (07) 4599 7909
