Essential Eight assessment in Adelaide
The Essential Eight is the Australian Cyber Security Centre's baseline for protecting businesses against the most common cyber threats. Whether you need it for compliance, insurance or just to know where you stand, we'll assess your systems honestly and give you a practical plan to close the gaps, without scare tactics or overselling.
Last updated
The short answer
An Essential Eight assessment measures your business against the ACSC's eight strategies, such as patching, multi-factor authentication, backups and admin access, across three maturity levels. WaTo Consulting assesses Adelaide businesses, writes a prioritised gap report and remediation plan, and can do the fixes and re-assess to confirm you have reached the target level.
What is the Essential Eight?
The Essential Eight is a set of eight strategies developed by the Australian Cyber Security Centre (ACSC) to help organisations protect themselves against the majority of cyber attacks. It covers things like patching, multi-factor authentication, backups and restricting admin access. Each strategy is measured across three maturity levels (Level One through Three) so you can see where you're strong and where you're exposed.
What we assess
Application control
We check whether your systems restrict which programs can run, preventing malware and unapproved software from executing.
Patching applications
We review how quickly your business apps get security patches and whether anything critical is falling behind.
Microsoft Office macros
We assess your macro settings to make sure they're not leaving the door open for common malware delivery methods.
User application hardening
We check that web browsers and common apps are configured to block risky content like Flash, ads and Java.
Admin privilege management
We review who has admin access, whether it's justified and how well those accounts are protected.
Multi-factor authentication & backups
We verify MFA is in place for remote access and critical systems, and that your backups meet ACSC recovery expectations.
Who it's for
- Businesses required to demonstrate Essential Eight compliance for government contracts or tenders.
- Organisations renewing cyber insurance, since many insurers now ask for proof of maturity alignment.
- Adelaide businesses that want to understand their actual security posture in plain terms.
- IT managers who need an independent assessment to support a business case for security investment.
How it works
- Scoping. We work out which systems and users are in scope and agree on the target maturity level.
- Technical assessment. We test your environment against all eight strategies using a mix of automated tools and manual checks.
- Gap report. You get a clear, prioritised report showing where you meet the maturity level and where you fall short.
- Remediation plan. We lay out what needs to change, in what order, with realistic timeframes and costs, so there are no surprises.
- Implementation support. We can do the remediation work ourselves or support your team through it, then re-assess to confirm you've reached the target.
Why WaTo for Essential Eight
- We do the assessment and the remediation, so it's one team with no handoff to a different provider.
- Reports written in plain English so your board or management can actually understand them.
- Adelaide-based since 2001. We understand local businesses and the regulatory environment they work in.
- We tell you what you actually need to fix, not what would be nice to sell you.
- Ongoing support to maintain your maturity level as the ACSC updates the framework.
Essential Eight questions
Is Essential Eight mandatory for my business?
It's mandatory for Australian government agencies. For private businesses it's strongly recommended by the ACSC, increasingly required by cyber insurers and often expected in government supply chains. Even if it's not compulsory for you, it's the most practical framework to measure your security against.
What maturity level should we aim for?
Most small and medium businesses should aim for Maturity Level One as a starting point. Level Two suits organisations with higher risk or compliance requirements. We'll help you pick a realistic target based on your size, industry and budget.
How long does an assessment take?
For a typical small business, one to two weeks from scoping to report. Larger or more complex environments may take longer. We'll give you a timeline before we start.
Will the assessment disrupt our work?
No. Most of the assessment happens in the background. We may need brief access to devices or accounts, but we schedule that around your business hours.
What about ASD Essentials, the Essential Eight's replacement?
The Australian Signals Directorate published ASD Essentials on 15 October 2026 as the successor to the Essential Eight. It's aimed mainly at government, critical infrastructure and large organisations, there's no transition deadline yet, and ASD says to keep current uplift programs going. Old Essential Eight ratings don't carry across automatically, so we assess against the Essential Eight and note where the new guidance changes things for you.
Related services
Guides on this topic
- What is the Essential Eight?
- Cyber insurance IT readiness: what to have in order first
- IT health check, IT audit or penetration test: which do you need?
Sources & references
Ready to find out where you stand?
Book a call and we'll walk you through what an Essential Eight assessment involves. No commitment, just a clear picture.
Mon to Fri, 8:30am to 5pm
