Maturity assessment
Test how each strategy is implemented across the agreed systems and record the maturity level the evidence supports.
Essential Eight Cybersecurity Consulting
The Essential Eight (often written Essential 8) is a set of eight mitigation strategies published by the Australian Signals Directorate (ASD) to make systems harder to compromise. Umbrella Tech helps Australian organisations measure their maturity against ASD's Essential Eight Maturity Model, set a realistic target, implement the controls in Microsoft 365, Windows and network environments, and keep evidence that shows each strategy working.
The problem
The challenge we help you address
A customer questionnaire, insurer or government contract asks for your Essential Eight maturity, and nobody can answer with confidence. Settings vary between devices, exceptions are undocumented, and a policy may say a control exists when it only covers part of the fleet.
The outcome
What the engagement should deliver
An evidence-based maturity position for each strategy, an agreed target level, and a staged plan to reach it. Where we implement, you also receive validated configuration changes, recorded exceptions and a handover so your team can maintain the result.
How we can help
Target setting
Agree a target maturity level that suits your risk profile and the people asking for it.
Remediation
Plan and deliver the configuration, tooling and process changes needed to close the gaps.
Evidence and reporting
Keep the records that show coverage, exceptions and ongoing operation.
Self-check · about 3 minutes
Where does your Essential Eight sit today?
For each strategy, pick the statement closest to your environment. A common way to summarise maturity is the lowest of the eight, so the summary shows what holds you back from your target.
The eight mitigation strategies
Each strategy is assessed on its own, and together they form the baseline ASD recommends for Microsoft Windows-based networks:
- Patch applications
- Patch operating systems
- Multi-factor authentication
- Restrict administrative privileges
- Application control
- Restrict Microsoft Office macros
- User application hardening
- Regular backups
The Essential Eight Maturity Model
The Essential Eight Maturity Model defines Maturity Levels Zero to Three. Maturity Level One targets opportunistic attackers using widely available techniques; Levels Two and Three address adversaries who invest more time and capability. ASD recommends reaching the same level across all eight strategies before moving to a higher one, which is why Essential Eight compliance is usually planned as a staged programme rather than a single project. The model is a baseline: it sits alongside wider frameworks such as ISO/IEC 27001, shares many controls with SMB1001, and commonly informs DISP cyber security preparation.
Assessment and implementation options
Frequently asked questions
Can't see your question? Ask us directly →
What is the Essential 8?
It is ASD's prioritised set of eight mitigation strategies for protecting internet-connected IT networks, with Microsoft Windows-based environments as the primary focus. Each strategy is measured against the Essential Eight Maturity Model, from Maturity Level Zero to Three.
Who needs it?
Non-corporate Commonwealth entities have formal obligations, and many other organisations are asked about it by customers, insurers and government buyers. Any Australian organisation running Windows and Microsoft 365 can use it as a practical baseline.
What are the main requirements?
Each maturity level sets specific requirements for every strategy, such as how quickly patches are applied, which accounts need multi-factor authentication, and how backups are tested. Meeting a level means meeting all of its requirements across the systems in scope, with evidence.
How long does implementation take?
It depends on your starting maturity, the number of systems and applications, your target level and how much change users can absorb at once. We confirm scope and timing in discovery, after an assessment shows where you stand.
How does it relate to other frameworks?
The Essential Eight is a technical baseline, while ISO/IEC 27001 is a full management system. SMB1001 shares many of the same controls and DISP preparation commonly draws on the Essential Eight, so work done here usually supports those programs too.
Plan the next improvement
Tell us who is asking about your Essential Eight maturity, which systems are involved and what target you have in mind. We will help define a practical starting point.