Essential Eight assessment for Sydney small businesses
Last reviewed 24 September 2026.
An Essential Eight assessment from Static Computers checks your business against each of the eight mitigation strategies in the Australian Signals Directorate's Essential Eight maturity model, shows which maturity level you've reached for each control, and gives you a prioritised plan to reach your target maturity level. The assessment report is written for owners, not auditors, and is quoted as a fixed fee after a short scoping call.
What is an Essential Eight assessment?
The Essential Eight is the Australian Cyber Security Centre's (ACSC) baseline set of mitigation strategies to mitigate cyber security incidents. The eight strategies target the common cyber threats that compromise systems: stolen passwords, unpatched software, malicious macro execution and ransomware. An Essential Eight assessment tests how well each control is actually implemented across your systems, and rates your cyber security maturity against the Essential Eight maturity model's four levels, from Maturity Level Zero to Maturity Level Three.
Static Computers follows ASD's Essential Eight assessment guidance and reports results using ASD's standardised assessment outcomes, such as effective, alternate control, not effective and not implemented, so your results mean the same thing to an insurer, client or auditor.
Assessment scope: the Essential Eight controls we check
| Essential Eight control | What we check |
|---|---|
| Patch applications | Update status of web browsers, Microsoft Office and office productivity suites, PDF readers and business apps; patching of online services; unsupported software |
| Patch operating systems | Update status of Windows, macOS, servers and network devices; unsupported operating systems |
| Multi-factor authentication | MFA enforcement for every user account, privileged accounts, remote access and online customer services that hold sensitive customer data; strength of methods against brute force attacks and phishing |
| Restrict administrative privileges | How privileged users and privileged accounts are approved, separated from unprivileged operating environments, and reviewed |
| Application control | Whether only approved programs, software libraries, scripts and control panel applets can run, and we check application control rulesets |
| Configure Microsoft Office macro settings | Microsoft Office macro settings and how they're enforced, to stop malicious macro execution |
| User application hardening | Web browser and Office security settings against common social engineering techniques |
| Regular backups | What's backed up, whether backups are protected from privileged users deleting them, and whether restores of critical data are tested |
| Cloud and identity (beyond the Essential Eight) | Microsoft 365 system configuration and conditional access, the areas ASD's new Essentials series is expected to expand |
How the Essential Eight assessment works
-
Scoping call
30 minutes
We agree the assessment scope, your size and systems, and your target maturity level, for example for an insurer or contract.
-
Evidence collection
We review system configuration and reports from Microsoft 365, devices and backup systems, using automated methods where possible so we obtain adequate visibility without interrupting staff. Where a control can't be verified, we test it directly.
-
Control effectiveness review
For each control's objective, we record the outcome. If you use an alternate control, we look at determining compensating control effectiveness: whether it genuinely achieves the same result.
-
Assessment report
Maturity ratings, gaps and a prioritised plan for control implementation.
-
Walk-through
45 minutes
We go through the findings and agree what to fix first, and document any risk acceptance for gaps you choose not to fix.
-
Optional remediation and re-assessment
Static Computers can implement the plan, then re-assess. Subsequent vulnerability scanning activities keep an eye on drift.
What you get in the assessment report
- A maturity level rating for each of the eight strategies.
- A plain-English explanation of each gap and why it matters to your security posture.
- A prioritised plan: the fixes that remove the most risk for the least effort first.
- Notes on compensating controls and any risk acceptance.
- A note on how your results map to ASD's upcoming Essentials series.
- Evidence you can give an insurer, client or tender panel.
Which maturity level do you need?
Maturity Level One protects against attackers who opportunistically seek common weaknesses and simply leverage commodity tradecraft. It's the right first target for most small businesses. Maturity Level Two suits businesses that hold sensitive customer data or supply government, and is what Australian government agencies (non-corporate Commonwealth entities) must meet. Maturity Level Three is for organisations facing skilled, targeted attackers. The assessment confirms the right maturity targets for you.
What an Essential Eight assessment costs
The assessment is quoted as a fixed fee after a short scoping call. Remediation is quoted separately once you know what needs doing.
Is an Essential Eight assessment still worth doing?
Yes. On 24 June 2026 ASD confirmed it will replace the Essential Eight with the Essentials series, with deprecation expected around mid-2027 and retirement around mid-2028. ASD has said existing work carries across, and insurers, clients and government buyers still measure against the current Essential Eight framework. The security controls it covers will still matter under the new framework. Read more about the transition.
Who it's for
- Businesses renewing cyber insurance and facing a detailed questionnaire.
- Suppliers asked for Essential Eight alignment by a government or enterprise client.
- Accounting, legal and medical practices that communicate sensitive customer data. See accounting firms.
- Owners who want an honest picture of their cyber security posture against evolving cyber threats.
If you need an assessment by an ASD-endorsed assessor for a formal compliance requirement, talk to us first and we will explain your options.
What clients say on Google
Read 10 of our 40+ reviewsThe best MSP I have used. These guys are quick, reliable and professional.
Great to deal with very helpful always answers a call , is very efficient at solving problems and making your data safe would highly recommend static computers and Steven
Steve turned around an issue we were having with our CRM configuration in a timely and professional manner. I would definitely engage Steve at Static Computers again in the future.
Questions we get asked
Not here? Call 1300 366 638 or ask on the review call.
What does an Essential Eight assessment involve?
Static Computers reviews your systems against each of the eight mitigation strategies in ASD's Essential Eight maturity model, rates your maturity level for each control using ASD's assessment outcomes, and gives you a plain-English assessment report and a prioritised plan to close the gaps.
How long does an Essential Eight assessment take?
It runs from a short scoping call to the written report, then a walk-through meeting. Larger or more complex environments take longer.
Which maturity level does my business need?
Most small businesses should aim for Maturity Level One across all eight controls first. Businesses holding sensitive customer data, supplying government or answering to an insurer may need Maturity Level Two. The assessment confirms the right target for you.
What is a compensating control?
A compensating control, or alternate control, is a different security measure that achieves the same objective as an Essential Eight control when the standard control can't be implemented. The assessment checks whether it's genuinely effective.
What does an Essential Eight assessment cost?
The assessment is quoted as a fixed fee after a short scoping call. Remediation is quoted separately once you know what needs doing.
Book your complimentary IT review
25 minutes, phone or Teams. You get a written report covering what you run, what is at risk and what we would fix first, with a proposed agreement within five business days. No obligation.
Rather talk now? Call 1300 366 638. Not ready yet? Get Steven’s book, 90 Days to a Secure Business.