Simulated attacks to find and fix vulnerabilities.
Essential 8 Compliance and Assessments
Know your maturity level. Close the gaps. Prove it with evidence.
Technetics Cyber Security helps Australian businesses assess their Essential 8 implementation, reach their target maturity level and keep it. We have completed hundreds of Essential 8 assessments for businesses across Australia from our South Melbourne office.
Recent result: a finance and wealth management client moved from Maturity Level 0 on seven of eight controls to Maturity Level 1 across all eight within three months.
What is the Essential 8?
Being asked if your business is “Essential 8 compliant” raises more questions than it answers. Which maturity level applies? What evidence counts? Does having MFA and backups mean you are covered? We answer those questions against your actual systems, not a generic checklist.
The Essential 8 (also written Essential Eight) is a set of eight cyber security mitigation strategies published by the Australian Signals Directorate (ASD) through the Australian Cyber Security Centre (ACSC). The strategies reduce exposure to the most common cyber attacks and improve recovery when an incident happens.
The eight strategies fall into three groups:
- Prevent attacks from running: application control, patch applications, configure Microsoft Office macro settings, user application hardening.
- Limit the damage of an attack: restrict administrative privileges, patch operating systems, multi-factor authentication.
- Recover data and systems: regular backups.
The Essential 8 is designed for Microsoft Windows-based, internet-connected IT networks. Other environments, such as operational technology, may need different controls. It is one part of a wider cyber security program that also covers people, suppliers and incident response.
Client result
Seven of eight controls at Maturity Level 0 to Maturity Level 1 across all eight, in three months.
A finance and wealth management client engaged Technetics in October 2025 to achieve Essential Eight Maturity Level 1. An initial assessment found seven of the eight controls at Maturity Level 0. Technetics documented the gaps in an assessment report and dashboard, supported by evidence artefacts, and developed a targeted remediation plan. Through consulting services and software licensing support, Technetics implemented the required improvements. Within three months, the client achieved Maturity Level 1 across all eight controls. A follow-up assessment provided an updated report, dashboard, and supporting evidence demonstrating the uplift.
The Essential 8 controls at a glance
This table summarises what each strategy does and what Maturity Level One typically requires. The full requirements are in the ASD Essential Eight maturity model.
| Strategy | What it does | Maturity Level One in brief |
|---|---|---|
| Application control | Stops unapproved programs and scripts from running | Only approved executables, scripts and installers run from user profile and temporary folders on workstations |
| Patch applications | Fixes known vulnerabilities in software | Internet-facing services patched within two weeks, or 48 hours if an exploit exists. Browsers, office suites, email clients and PDF software patched within two weeks. Unsupported applications removed |
| Configure Microsoft Office macro settings | Blocks malicious macros | Macros disabled for users without a business need. Macros in files from the internet blocked. Users cannot change macro settings |
| User application hardening | Removes risky features from everyday software | Browsers do not process Java or web ads from the internet. Internet Explorer 11 disabled or removed. Users cannot change browser security settings |
| Restrict administrative privileges | Limits who can make major system changes | Privileged access validated when requested. Privileged accounts cannot browse the web or use email. Admin work done in a separate environment |
| Patch operating systems | Fixes known vulnerabilities in Windows and server platforms | Internet-facing services patched within two weeks, or 48 hours if an exploit exists. Workstations and other servers patched within one month. Unsupported operating systems replaced |
| Multi-factor authentication | Stops stolen passwords from being enough to log in | MFA on online services that hold sensitive data, including third-party and customer-facing services |
| Regular backups | Makes recovery possible after an attack or failure | Backups of data, applications and settings kept to business continuity needs. Restores tested. Standard users cannot access, change or delete backups |
The eight Essential 8 strategies explained
Each strategy has detailed requirements that change by maturity level. An assessment checks your implementation against the requirements for your target level.
1. Application control
Application control restricts which software, scripts and installers can run. It stops unapproved programs from executing, including malicious files delivered by email or downloaded by a user.
Installing an application control product is only the start. You need a maintained list of approved applications, a process for approving new software, and testing so restrictions do not block essential work.
2. Patch applications
Application patching fixes known vulnerabilities in software such as web browsers, office suites, email clients, PDF readers and internet-facing services. It covers finding affected assets, identifying missing updates and confirming fixes were applied.
Timeframes tighten at higher maturity levels. A routine update schedule needs a fast track for urgent vulnerabilities, and every failed update needs an owner so vulnerable software is not left running unnoticed.
3. Configure Microsoft Office macro settings
Macros automate useful tasks, but malicious macros are a common way to run harmful code. This strategy limits macros to approved business needs and blocks macros in files from the internet.
Start by finding where the business genuinely relies on macros. Finance and operations teams that depend on spreadsheet automation will need testing and communication before restrictions roll out.
4. User application hardening
Application hardening switches off risky features in everyday software, such as web advertisements and Java in browsers. Higher maturity levels add restrictions on how Office, PDF software and PowerShell interact with the operating system.
A policy document does not prove hardening is in place. An assessment checks the settings actually applied to devices and users, and confirms users cannot change them.
5. Restrict administrative privileges
Administrative accounts can make major changes to systems. Restricting them limits the damage if an account or device is compromised.
The work covers who needs elevated access, separating admin work from everyday activity, and reviewing privileges when roles change. External IT providers with admin access need clear owners too. Removing local admin rights changes how staff install software, so plan support for the change.
6. Patch operating systems
Operating system patching fixes vulnerabilities in the platforms your workstations, servers and network devices run on. It needs full visibility of your assets and a way to verify updates installed.
Offline devices, failed installs and pending restarts leave gaps even when patching is automated. Unsupported operating systems must be replaced to meet any maturity level.
7. Multi-factor authentication
Multi-factor authentication (MFA) requires more than a password to log in. It stops stolen, guessed or reused passwords from being enough on their own.
Where MFA is enforced and how strong it is both matter. Higher maturity levels require phishing-resistant MFA. An assessment checks every account, application and access path, including exceptions and account recovery processes. Turning MFA on in one system does not mean every required user and service is protected.
8. Regular backups
Backups let you recover data, applications and settings after an attack or system failure. They must match your business continuity needs and be protected from unauthorised access, changes and deletion.
A successful backup job is not proof of recovery. Restores need to be tested, and backups need protecting from an attacker who has stolen admin credentials.
Essential 8 maturity levels explained
The Essential 8 maturity model has four levels, from Zero to Three. Each level defends against a more capable attacker.
| Maturity level | What it means | Typical fit |
|---|---|---|
| Zero | Weaknesses remain that leave the environment exposed to the threats Level One addresses | Starting point for most businesses before an assessment |
| One | Defends against opportunistic attackers using common, freely available tools | Baseline for most small and medium-sized businesses |
| Two | Defends against attackers willing to invest more time and use more advanced techniques | Required for non-corporate Commonwealth entities. Often requested in government and enterprise supply chains |
| Three | Defends against adaptive attackers who actively look for and exploit gaps | Organisations holding high-value data or facing targeted threats |
Your overall maturity is set by your weakest strategy. ASD recommends reaching the same maturity level across all eight strategies before moving up. Strong results in seven areas do not make up for a gap in the eighth.
For example, a business with strong patching and MFA that still lets unapproved software run on workstations sits at Maturity Level Zero for application control. That gap holds back its overall result until it is fixed.
A maturity result only applies to the environment that was assessed. Always share the scope alongside the result, whether it is used internally or with a customer.
Which maturity level should your business target?
Most small and medium-sized businesses should target Maturity Level One first. ASD suggests Level One may suit SMEs, but a customer contract, tender or threat profile can require Level Two or higher.
We confirm the reason for your target before planning any work. That stops you investing in controls that miss a required outcome, or claiming a level that does not meet a customer’s needs. A staged approach works well: reach Level One across all eight, then move to Level Two where it is required.
Is Essential 8 compliance mandatory in Australia?
Not for every business. Essential 8 compliance is mandatory for non-corporate Commonwealth entities, which must reach at least Maturity Level Two under the Protective Security Policy Framework.
Private businesses usually meet Essential 8 requirements through:
- Government contracts and tenders
- Customer procurement and supplier security reviews
- Cyber insurance questionnaires
- Industry or state government requirements
Reaching a maturity level does not guarantee insurance cover or satisfy every contract clause. Bring the actual tender, contract or questionnaire to your assessment so we can map exactly what is being asked for.
What an Essential 8 assessment involves
An Essential 8 assessment with Technetics follows four stages and typically takes 1 to 2 weeks for a single environment.
Agree the scope and target
We confirm why you need the assessment, the target maturity level and which systems are in scope. Useful inputs include an asset list, a list of cloud services and details of your current IT and security providers. If a customer requested the assessment, include their evidence requirements.
Review implementation and evidence
We test how each control actually works, using configuration reviews, technical testing, documentation and interviews with the people responsible. Where documented procedures differ from real settings, we find out why before drawing a conclusion.
Report gaps and their impact
You receive a report showing your maturity level for each of the eight strategies, your overall level, the evidence behind each finding and the scope assessed. Leadership gets a plain-language summary. Your technical team gets findings it can act on.
Plan remediation
We rank remediation by risk, dependencies and your target level. Some fixes are quick configuration changes. Others need new licensing, replacement systems or process changes. Implementation support and reassessment can then be scoped, so the evidence of improvement stays connected to the original findings.
From gaps to working controls
A remediation plan has to work in your environment. Blocking an application can break a business process. Removing local admin rights changes how staff install software. Replacing an unsupported platform can become a larger project.
We map those dependencies, agree who does what and sequence the work. Your internal team or IT provider can implement some changes, with our specialists handling the rest.
Where a legacy system cannot meet a requirement, we record the limitation and assess suitable alternatives. A compensating control must give equivalent protection and be assessed on that basis. Accepting a risk does not mean the requirement is met.
Once changes are made, we gather evidence and retest the affected controls, so you have a result you can stand behind.
Client Success Stories
Technetics have been our trusted IT partner for over 13 years, growing alongside our business and helping us work smarter every step of the way. Their proactive approach, technical expertise, and reliability have delivered real improvements to our efficiency and bottom line. They’re not just a provider — they’re an essential part of our success.
Andrew Dunne
Director, Advertising Associates
Since Technetics took over the management of our technology and cyber security, there hasn’t been a single incident! Having worked with other firms in the past, I can confidently say they are top tier when it comes to service and partnership.
Kim Dema
CFO, Harris Capital
After suffering a cyber attack that held our data ransom, we turned to Technetics for help. Their solution completely transformed our IT setup — from messy and unreliable to streamlined, secure, and efficient. We now operate without downtime, and with total peace of mind. Zoran and his team truly feel like partners in our business growth.
Adam Fletcher
CEO, CR Labs
Oliver Hume
3 years ago
Fantastic experience with the team at Technetics, they really took the effort to understand our requirements and provided quality solutions for our business. Highly recommended!
Ani D
3 years ago
This is great company to work with. Great communication, reliable, good response times and patient. The team are willing to learning the organisations needs and give the most current and fitting advice in all things I.T related. John, Ruby, Mario and Justin, I have really appreciated working with you and the rest of the Technetics staff since I started at the BUV.
Keep up the good work.
Michelle Keating
4 years ago
Secure site, and knowledgeable service.
Minh Si
4 years ago
Great service, have been dealing with Technetics for past year and will always go back
Keep your Essential 8 position current
New staff, new software and new cloud services all shift your security position. Without ongoing ownership, maturity slips within months of a project ending.
Assign an owner to every control and every exception
Review privileged access when roles change
Follow up every failed update
Maintain application control rules as software changes
Test backup restores on a set schedule
Keep records your team can find and understand
Our managed cyber security services can handle the ongoing monitoring and maintenance. For a broader view of risk, book a cyber security audit.
How much does an Essential 8 assessment cost?
Essential 8 assessments with Technetics are quoted for each environment. The price depends on scope, target maturity level, number of environments and how much evidence already exists. A business with one managed environment needs less work than one with several sites, legacy systems and multiple IT providers.
Remediation is priced separately. It can include configuration changes, licensing, implementation support or replacing unsupported technology.
We confirm scope and deliverables before quoting. Bring any deadlines and previous assessment results to the first conversation.
Prepare for your Essential 8 assessment
Gather these before your first meeting:
Current asset list (devices, servers, cloud services)
User and privileged account lists
Existing security policies
Backup and restore details
Previous security or audit reports
Any tender, contract or insurer requirements
Missing records? Tell us at the start and we will include evidence collection in the scope. Maturity is assessed against ASD’s Essential Eight assessment process guide.
Get a clear view of your Essential 8 gaps
Whether a customer wants evidence or you want a stronger security baseline, we will help you define the work. Talk to Technetics about an Essential 8 assessment for your business, anywhere in Australia.
Book an Essential 8 Assessment Call 1300 130 730
Essential 8 questions answered
What does Essential 8 compliant actually mean?
Essential 8 compliant means an assessed implementation has met a stated maturity level, against a specific version of the ASD maturity model, for a defined environment. A compliance claim without the maturity level, version and scope tells a customer very little. Always ask for all three, plus the supporting evidence.
Is there an official Essential 8 certification?
No. There is no government-issued Essential 8 certificate for private businesses. An assessment evaluates your implementation and reports findings for an agreed scope. If a tender asks for “certification”, confirm the exact scheme and evidence it accepts. It may mean an independent assessment report, or a separate scheme such as SMB1001 or ISO 27001.
Is the Essential 8 changing?
Yes, it is evolving. In 2026, ASD consulted on expanding the Essential Eight into a broader Essentials series: prioritised, threat-informed guidance grounded in the Information Security Manual. The current Essential Eight guidance will become the first chapter, Essentials for enterprise IT, with more chapters to follow. Consultation closed on 12 July 2026.
Until ASD publishes the new guidance, the current Essential Eight maturity model still applies. ASD expects strong alignment with existing controls and investments, so work done now carries forward. Ask us what the changes mean for your environment.
Does my small business need all eight strategies?
Yes, if you want a maturity result. Your overall level depends on all eight, and the strategies are designed to work together. Small businesses still face real risk through email, remote access and customer data. Start with Maturity Level One across all eight.
How long does it take to reach Essential 8 Maturity Level One?
It depends on your starting point. Businesses on modern, well-managed Microsoft 365 environments can often reach Level One in 1 to 2 months. Legacy systems, unsupported software or major access changes take longer. Your assessment sets a realistic timeline.
Can Microsoft 365 make us Essential 8 compliant?
Microsoft 365 and related Microsoft tools can support several Essential 8 controls, but buying licences does not make you compliant. Compliance depends on configuration, coverage, processes and evidence across the whole assessed environment, including systems outside Microsoft 365.
How often should we review our Essential 8 controls?
Reassess at least annually, and after any major change such as new systems, an acquisition, major access changes or a security incident. Patching and access management need continuous attention between formal assessments.
Will the Essential 8 stop every cyber attack?
No. The Essential 8 reduces exposure to the most common attack methods and supports recovery, but no framework stops every threat. Your wider cyber security program should also cover staff behaviour, supplier access and incident response.
Can we keep our existing IT provider?
Yes. An assessment gives your current provider a clear list of findings and priorities. We agree who implements each change and how results are checked, and provide specialist guidance alongside your existing team.
Do you provide Essential 8 assessments outside Melbourne?
Yes. We are based in South Melbourne and assess businesses across Australia. Much of the evidence review and testing can be done remotely, with on-site work where the scope needs it.
