Scope and target
Agree the systems, user groups and target maturity level, from Maturity Level One upwards.
Essential Eight Assessment
An Essential 8 assessment measures how well your organisation implements the Australian Signals Directorate (ASD) Essential Eight, strategy by strategy, against the Essential Eight Maturity Model. Umbrella Tech confirms the systems in scope and your target maturity, tests how each control actually operates, and gives you the maturity level the evidence supports, the gaps that hold you back and a prioritised plan to reach your target.
When this assessment is useful
Use it when a customer, insurer, contract or board asks for your maturity level, before setting a remediation budget, or when a previous self-assessment relied on policies rather than tested configuration.
Assessment scope
Control testing
Check patching, multi-factor authentication, administrative privileges, application control, Office macros, application hardening and backups against the level's requirements.
Coverage
Confirm that controls apply across the whole fleet, not only a sample or a pilot group.
Exceptions
Record where a requirement is not met, why, and whether a documented exception exists.
Evidence and access
Depending on scope, evidence may include device management and policy exports, patch and vulnerability reports, multi-factor authentication and Conditional Access settings, privileged account lists, backup and restore test records, and interviews with the people who run them. We agree read-only access and evidence handling first. This kind of Essential Eight audit relies on what systems show, not only on what documents say.
Device management and policy exports
Patch and vulnerability reports
Multi-factor authentication and Conditional Access settings
Privileged account lists
Backup and restore test records
Interviews with the people who run them
Findings that lead to action
You receive a maturity rating for each of the eight strategies, the evidence behind it, and a prioritised remediation roadmap towards your target level. Findings separate controls that are missing, partly deployed, or deployed but unevidenced, so effort goes where it changes the rating.
Illustrative findingsExamples only
- ExampleMulti-factor authentication enforced for staff but not for an administrative or service account
- ExampleOffice macros blocked by policy on most devices but not on an older group
- ExampleBackups running without any recorded restore test
These are examples of what an assessment can uncover, not findings about your organisation.
How it runs
Assessment method
01
Confirm scope and target
Agree the systems, user groups and target maturity level.
02
Test the controls
Review configuration and reports for each strategy and check a sample of devices and accounts.
03
Rate and prioritise
Assign the maturity level the evidence supports for each strategy and rank the gaps by risk and effort.
04
Walk through the results
Present the findings to your team, agree the remediation sequence and confirm what needs more investigation.
From assessment to remediation
You can take the roadmap to your internal team or existing provider, or ask us to deliver it through Essential Eight Remediation. Many fixes sit in Microsoft 365 and endpoint management, so the work often connects with our Cybersecurity services.
Assessment outputFindings and remediation roadmap
Umbrella TechWe deliver the improvements
DesignImplementValidate
Your organisationYour internal team
Your partnerYour existing technology provider
Essential Eight
The Essential Eight is a set of eight mitigation strategies published by ASD, measured using ASD's Essential Eight Maturity Model from Maturity Level Zero to Three.
About Essential Eight services →Self-check · about 3 minutes
Where does your Essential Eight sit today?
For each strategy, pick the statement closest to your environment. A common way to summarise maturity is the lowest of the eight, so the summary shows what holds you back from your target.
Frequently asked questions
Can't see your question? Ask us directly →
What does an Essential 8 assessment include?
Agreeing scope and target level, testing each strategy against that level's requirements, a maturity rating per strategy and a prioritised remediation roadmap, plus the evidence collected.
How long does the assessment take?
It depends on the number of systems and sites, how many strategies and which target level are in scope, and how quickly evidence and access can be provided. We confirm scope and timing in discovery before work starts.
What evidence or access is required?
Usually read-only access to device management, Microsoft 365 and identity settings, plus reports for patching and backups and time with the people who manage them. We agree the exact list with you before the assessment begins.
What happens after the assessment?
You decide how to act on the roadmap. We can deliver the remediation, support your team, or reassess later to confirm progress.
How much does it cost?
Cost depends on the size of the environment, the target maturity level and how much evidence already exists. We confirm scope and cost in discovery before any work starts. The assessment supports preparation; it does not grant certification or accreditation.
Establish your current position
Tell us about your environment, who is asking about your maturity and the level you are aiming for. We will scope an assessment that answers the question.