How do we find out our current Essential Eight maturity, and how urgent is this?

Start by getting a read on where you stand. InterIntra's free Essential Eight self-assessment tool gives you an indicative maturity level in a few minutes and flags which strategies to fix first. It is worth moving promptly: as the global cyber agencies recently warned, AI is shrinking the time between a vulnerability appearing and being exploited. Once you have that indicative picture, we can run a formal assessment and build a prioritised remediation roadmap.

ACSC Essential Eight · Maturity level assessment

Essential Eight compliance, done properly.

The Australian Cyber Security Centre's Essential Eight is the baseline cybersecurity framework for Australian organisations. We assess your current maturity, identify gaps, and build a remediation roadmap, whether you're targeting Maturity Level 1, 2 or 3.

Book a Discovery Call Free self-assessment tool → What's included

ISO 27001 certified ourselves DISP member Essential Eight Maturity Level 2, third-party audited

ACSC Essential 8 — The usual path

ML0 start

ML1 floor

ML2 target

Assess, remediate, maintain. Not just a report on a shelf.

We've seen too many Essential Eight assessments that produce a gap report and nothing else. Our engagements are built around closure: understanding where you are, remediating the gaps, and keeping you there through ongoing monitoring and evidence collection. We've run Essential Eight assessments for Australian businesses from Maturity Level 1 baselines through to Maturity Level 3 targets.

And we hold ourselves to it. InterIntra is aligned to ACSC Essential Eight Maturity Level 2, as required for our membership of the Defence Industry Security Program. We run the controls we assess you against.

Back to Cyber Security →

All eight strategies, assessed, prioritised, actioned.

The Essential Eight isn't one thing. It's eight distinct controls, each with three maturity levels. We assess all eight, show you where you stand, and build a remediation plan that sequences work logically and minimises disruption.

Prevent cyber attacks

Application control: preventing unapproved programs from running on your systems
Patch applications: keeping internet-facing software updated and vulnerabilities closed
Office macro settings: blocking malicious macros from executing
Application hardening: disabling features commonly exploited by attackers

Limit the extent of incidents

Admin privileges: limiting who can make system-level changes
Patch operating systems: keeping OS software current and fully supported
Multi-factor authentication: requiring more than a password to access systems

Recover data & system availability

Regular backups: tested, protected and stored to survive a ransomware attack

Maturity level evidence that holds up

Self-assessed maturity is easy to inflate. We produce evidence-based assessments, screenshots, configurations, logs, so your maturity rating reflects actual controls in place, not best intentions. That's what survives an audit or insurer review.

Essential Eight sits naturally inside a broader GRC programme. We manage the full compliance picture so you're not running separate workstreams for every framework.

Maturity levels

Three levels. One target. We help you pick the right one.

Each maturity level represents a meaningful step up in security posture. Most should be targeting Maturity Level 2: the sweet spot between achievable and genuinely effective.

ML 0 · Starting point

Maturity Level 0

Controls exist but don't yet consistently meet Maturity Level 1 requirements.

Where most businesses start
A completely normal starting point

ML 1 · Partly aligned

Maturity Level 1

Protection against opportunistic, volume-based attacks.

Good baseline for businesses starting from scratch
Not sufficient against targeted attacks or for regulated sectors
The floor, not the goal

ML 2 · Mostly aligned · Recommended

Maturity Level 2

Protection against moderately sophisticated adversaries.

Satisfies most client, insurer and government supply chain requirements
The right target for most South Australian businesses

ML 3 · Fully aligned

Maturity Level 3

Protection against sophisticated, targeted attacks.

Required for businesses handling sensitive government or defence data
Demands significant investment
If you need it, there's no substitute

“Essential Eight isn't a compliance exercise. It's the difference between surviving a cyber attack and being front-page news.”

InterIntra

Information Security Practice · Adelaide & Brisbane

All eight strategies, evidenced to a level you can name.

The Essential Eight is a maturity model, not a checklist. What matters is which level you can demonstrate, and to whom.

01
Scoped to a target levelLevel 1, 2 or 3, chosen against what your clients, insurer or contracts actually require, rather than aiming at everything at once.
02
Patching that is measuredOperating systems and applications patched to the cadence the level demands, with the evidence that it happened.
03
Application control and hardeningThe strategies most organisations skip because they are the hardest, done properly rather than marked as partial.
04
Evidence that holds upAssessment output written so an auditor, an insurer or a prime contractor can read it without a follow-up call.

From where you are now to a maturity level you can evidence.

The Essential Eight is assessed against evidence, not intent. Each phase produces something an assessor or an insurer can actually look at.

01 · Where you stand
Baseline assessment
Your current posture measured against all eight mitigation strategies, with the maturity level each one actually sits at today.
02 · Prioritised
Gap analysis
The distance between where you are and your target level, ordered by risk reduction rather than by ease.
03 · Costed
Remediation plan
What needs to change, in what order, and what it will take, so the programme can be budgeted rather than guessed at.
04 · Hands-on
Control deployment
Patching, application control, MFA, hardening and backups implemented and evidenced as we go.
05 · Kept current
Re-assessment
Maturity drifts as environments change. Periodic reassessment keeps the evidence current rather than a snapshot from last year.

Free tool

Start by getting a read on where you stand.

Our free Essential Eight self-assessment tool gives you an indicative maturity level in a few minutes and flags which strategies to fix first.

Try the self-assessment

From indicative to evidenced

An indicative maturity level
Which strategies to fix first
A formal assessment
A prioritised remediation roadmap

Questions

Got questions? We have answers.

Something else? Call 1300 080 000 and you'll get a straight answer.

Is the Essential Eight mandatory for our business?

For Australian Government entities and their suppliers, compliance with the Essential Eight is mandated. For private sector businesses, it's not legally required, but it's become the de facto baseline that clients, insurers and boards expect. Many enterprise procurement processes now include Essential Eight questions. Beyond compliance, the controls are genuinely effective at reducing the most common attack vectors, so the case for implementation stands even without a mandate.

Does InterIntra meet the Essential Eight itself?

Yes. InterIntra is aligned to ACSC Essential Eight Maturity Level 2, which we were required to meet for our membership of the Defence Industry Security Program (DISP). We are also independently certified to ISO/IEC 27001. The controls we recommend are the controls we operate under, and we can show you how we implemented them in our own environment.

What maturity level should we be targeting?

Maturity Level 2 is the right target for most businesses, it provides meaningful defence against targeted attacks, satisfies most client and insurer requirements, and is achievable without enterprise-scale resources. Maturity Level 3 is appropriate for organisations that hold sensitive government or defence data, or that face sophisticated threat actors. We assess your risk profile and recommend the right target before any remediation work begins.

How long does it take to reach a target maturity level?

Starting from a typical baseline, reaching Maturity Level 1 takes three to six months. ML2 typically takes six to twelve months, depending on your current controls and how quickly your team can implement changes. The timeline is driven by the complexity of your environment and the pace your business can absorb change, not by technical difficulty. We build a realistic roadmap in the gap assessment phase so you know what you're committing to.

How do we find out our current maturity, and how urgent is this?

Start by getting a read on where you stand. Our free Essential Eight self-assessment tool gives you an indicative maturity level in a few minutes and flags which strategies to fix first. It's worth moving promptly, too: as the global cyber agencies recently warned, AI is shrinking the time between a vulnerability appearing and being exploited, which we unpack in The Five Eyes just said AI has shrunk the cyber clock to months. Once you have that indicative picture, we can run a formal assessment and build a prioritised remediation roadmap.

Real businesses. Real maturity uplift.

Chris Henderson Electrical

Essential Eight ML2 · Secure Score uplift

A commercial electrical contractor lifted to ACSC Essential Eight Maturity Level 2, with enforced MFA, hardened and encrypted devices, application control and 24/7 managed monitoring.

Read the case study →

PRP Group

Financial services · ACSC Essential Eight aligned

An accounting and financial planning firm brought into line with the ACSC Essential Eight, with Microsoft 365, multi-factor authentication, backup and staff cyber-awareness training.

Read the case study →

Sports College SA

500 students · ACSC Essential Eight aligned

Essential Eight deployment across an independent secondary school: M365, MDM, content-filtered firewalls and AWS workloads all secured and aligned.

Read the case study →

The Barossa Council

Local government · Essential Eight aligned roadmap

A South Australian local council's 12-month modernisation program, audited and sequenced against the Essential Eight, using security capability the Council already licensed.

Read the case study →