Essential Eight: start with evidence, not assumptions.

“We have security software” is not the same as “we know our controls work.” Before buying another tool, build a clearer picture of your environment and the evidence behind your current security posture.

Start with the boundary

Our recommendation is to agree what you are assessing before you discuss a maturity score. Identify the relevant systems, users, administrators and service providers, and decide who owns the evidence.

Choose a target that fits your environment

ASD recommends selecting a suitable target maturity level, progressively implementing the model, and working towards the same maturity level across all eight mitigation strategies before moving higher. The Essential Eight does not address every cyber threat, so additional controls may be needed for your environment (ASD Essential Eight maturity model).

Ask for evidence, not reassurance

Use the assessment to understand how controls operate in practice. Useful questions for your team include:

• Can we demonstrate that patching requirements are being met across the agreed scope?
• Which users have privileged access, and how is that access controlled?
• Where is multifactor authentication enforced, and what exceptions exist?
• When did we last test restoring our critical information from backup?
• Who approves exceptions, and when are they reviewed?

Turn the gaps into decisions

We recommend a short, prioritised improvement plan with an owner, expected outcome and dependency for each action. Distinguish quick configuration fixes from changes that require investment, operational coordination or new ways of working.

Use the framework as a foundation

ASD describes the Essential Eight as a minimum set of preventative measures and notes that it will not mitigate all cyber threats. Treat it as part of a broader, risk-based security programme rather than a blanket assurance of safety (ASD guidance).