Essential Eight Assessments
Independent, senior-led Essential Eight assessments aligned with the ASD maturity model, with prioritised guidance to close the gaps.
operating since 2017.
The Essential Eight is the Australian Cyber Security Centre's (ACSC) baseline set of mitigation strategies for cyber threats, and many organisations are now expected to demonstrate maturity against it — by government customers, regulators, insurers, or their own boards.
Your assessment is independent of any MSP, evidence-based against the ASD's published maturity model and evidence-quality framework, and structured to give you a clear, defensible view of where your maturity actually sits.
The report supports decisions and remediation, with the quality of evidence underpinning each rating made explicit. You finish with a maturity rating you can defend, and a prioritised path to improving it.
Best for
Organisations that need a credible, defensible view of their Essential Eight maturity to satisfy government customers, regulators, insurers, boards, or DISP requirements, and who want the assessment performed independently of any MSP that manages the controls being assessed.
Why choose us for your Essential Eight assessment
Independent of your MSP
Acumenis doesn't implement, manage, or sell the controls being assessed, so the assessment isn't grading our own homework. Independence is clear, satisfying boards, customers, insurers, and regulators increasingly expecting independent assessments.
Evidence-based, not screenshot-based
Maturity ratings are determined from outcome-based evidence (logs, block events, test restores, enforced policies) and the quality of that evidence is made explicit in your report against the ASD's four-level framework (Excellent, Good, Fair, Poor). You get a rating you can stand behind.
Applied as the ASD intended
The maturity model is applied as published, with formal use of compensating controls where they're warranted, rather than loose interpretation that flatters the rating.
Tool-agnostic and platform-agnostic
Your assessment covers the actual environment, whether that's Windows, macOS, server or SaaS, rather than only what a particular toolset has visibility into. Recommendations are determined by your context, not by vendor alignment.
Reports built to drive action
Findings come with prioritised, practical guidance: quick wins, dependencies, and the conditions required to reach each maturity level. The assessment provides you with a roadmap rather than just a score.
Senior consultants, based in Australia
Scoped and delivered by experienced assessors based in Brisbane and surrounds, working with clients across Australia. Assessors have completed the ASD's Essential Eight Assessor course and bring hands-on experience across Windows, macOS, server, and cloud environments.
How your Essential Eight assessment runs
Aligned with ASD guidance, every assessment follows four stages.
Stage 1 - Planning and preparation
You and your lead assessor identify resource and access requirements, engage key stakeholders (including external service providers where they manage in-scope environments), confirm the approach to reporting, and agree appropriate use and retention of the report.
Stage 2 - Scope and approach determination
Your assessor defines the boundaries of the assessment against your target maturity level, including in-scope systems, applications, environments, and processes. Assessment methodology and tooling approach are confirmed before evidence collection begins.
Stage 3 - Control assessment
Your assessor evaluates each control associated with the eight mitigation strategies, collecting evidence across logs, configurations, policy documents, and other artefacts. Interviews with relevant personnel and observation of processes are used to understand how controls are implemented in practice, not just on paper.
Stage 4 - Report development
Findings are documented against the ASD maturity model and evidence-quality framework, with prioritised recommendations to close identified gaps. The report is reviewed by a separate senior consultant before delivery, then walked through with you in a follow-up meeting so the team has the chance to ask questions and discuss next steps.
Challenges you'll avoid
MSP-conducted assessments that don't survive scrutiny
An MSP-conducted assessment doesn't hold up when a customer, insurer, or regulator looks closely. Independence is the answer the ASD's own guidance point to, and Acumenis is structured to provide it.
High ratings supported by weak evidence
Maturity ratings without supporting evidence quality look comfortable but don't survive scrutiny. Your assessment names the evidence quality behind every rating per the ASD's four-level framework, so the rating you receive is a rating you can defend.
Loose interpretation of the maturity model
The Essential Eight Maturity Model is specific about what each level requires. Partial implementations, missing controls, and assumed compensating controls don't count toward a rating. Your assessment applies the model as published, producing ratings that hold up to challenge.
Assessments limited by tool visibility
A toolset can only assess what it can see. Where MSPs assess maturity using their own tools, gaps in tool coverage can become gaps in the assessment. Your assessment covers the actual environment, including Windows, macOS, server, SaaS, and admin paths, rather than only what a particular toolset surfaces.
Reports that produce a score but no roadmap
A maturity rating without a path to improvement isn't useful to anyone who has to fund or act on it. Your report includes prioritised guidance on improvements needed to reach each maturity level, with quick wins, dependencies, and realistic sequencing.
Outcomes
After your Essential Eight assessment, you'll have:
- A current, evidence-based maturity rating against the ASD Essential Eight Maturity Model
- Evidence-quality notation for each rating, per the ASD's four-level framework
- A clear scope statement covering what the rating includes and what it doesn't
- Prioritised guidance on improvements needed to reach each maturity level
- A report suitable for board, customer, regulator, or insurer review
- A follow-up walkthrough with the team to discuss findings and next steps
Proof in practice.
A snapshot of how we've helped Australian organisations strengthen security, meet stakeholder expectations, and move forward with confidence.
Frequently asked questions.
Straight answers to the questions we hear most. Can't find yours? We're happy to help.
Most assessments run between one and two weeks of calendar time, depending on the size of your environment, the diversity of platforms in scope, your target maturity level, and how centralised your evidence is. You'll get a recommendation during scoping rather than a fixed package.
They can, and many do. The question is whether you want the people who implement and manage the controls to also rate the maturity of those controls. ASD guidance points to independence as a foundation of credible assessment, and customers, insurers, and regulators increasingly expect independent results.
The ASD Essential Eight Maturity Model defines three levels, with each level appropriate for a different threat profile. Most organisations targeting Essential Eight maturity work towards Maturity Level 1 or 2; Maturity Level 3 is typically required only in specific regulated contexts. The right target for your organisation is part of the scoping conversation.
The standard report is suitable for internal consumption. Where the report is required for third-party assurance, including DISP submissions and assessments shared with prime contractors, regulators, or insurers, an Extended Evidence Collection and Validation option is available to support the deeper evidence requirements.
Remediation sits outside the assessment itself, to preserve independence at the next assessment cycle. The report includes prioritised guidance on what to address and how, which your internal team or MSP can act on. Where you'd like help with broader security uplift, we can scope a separate engagement.
All Acumenis consultants are based in Australia, with team members in Brisbane and Toowoomba. We support clients nationally and internationally, meeting in person across South East Queensland and travelling as engagements require. Engagements are handled by the same consultant from start to finish, giving you clear accountability and on-shore data handling throughout.
Let's talk about where you are and where you need to be.
Whether you're preparing for certification, validating your controls, or building security foundations for growth, we'll help you get there with clarity and confidence.
