The Australian Cyber Security Centre's Essential Eight is the baseline cybersecurity framework for Australian organisations. We assess your current maturity, identify gaps, and build a remediation roadmap, whether you're targeting Maturity Level 1, 2 or 3.
We've seen too many Essential Eight assessments that produce a gap report and nothing else. Our engagements are built around closure: understanding where you are, remediating the gaps, and keeping you there through ongoing monitoring and evidence collection. We've run Essential Eight assessments for Australian businesses from Maturity Level 1 baselines through to Maturity Level 3 targets.
And we hold ourselves to it. InterIntra is aligned to ACSC Essential Eight Maturity Level 2, as required for our membership of the Defence Industry Security Program. We run the controls we assess you against.
The Essential Eight isn't one thing. It's eight distinct controls, each with three maturity levels. We assess all eight, show you where you stand, and build a remediation plan that sequences work logically and minimises disruption.
Self-assessed maturity is easy to inflate. We produce evidence-based assessments, screenshots, configurations, logs, so your maturity rating reflects actual controls in place, not best intentions. That's what survives an audit or insurer review.
Essential Eight sits naturally inside a broader GRC programme. We manage the full compliance picture so you're not running separate workstreams for every framework.
Each maturity level represents a meaningful step up in security posture. Most businesses start from Maturity Level 0, where controls exist but don't yet consistently meet Maturity Level 1 requirements, and that's a completely normal starting point. Most should be targeting Maturity Level 2: the sweet spot between achievable and genuinely effective.
Protection against opportunistic, volume-based attacks. Good baseline for businesses starting from scratch, but not sufficient against targeted attacks or for regulated sectors. The floor, not the goal.
Protection against moderately sophisticated adversaries. Satisfies most client, insurer and government supply chain requirements. The right target for most South Australian businesses.
Protection against sophisticated, targeted attacks. Required for businesses handling sensitive government or defence data. Demands significant investment, but if you need it, there's no substitute.
“Essential Eight isn't a compliance exercise. It's the difference between surviving a cyber attack and being front-page news.”
For Australian Government entities and their suppliers, compliance with the Essential Eight is mandated. For private sector businesses, it's not legally required, but it's become the de facto baseline that clients, insurers and boards expect. Many enterprise procurement processes now include Essential Eight questions. Beyond compliance, the controls are genuinely effective at reducing the most common attack vectors, so the case for implementation stands even without a mandate.
Yes. InterIntra is aligned to ACSC Essential Eight Maturity Level 2, which we were required to meet for our membership of the Defence Industry Security Program (DISP). We are also independently certified to ISO/IEC 27001. The controls we recommend are the controls we operate under, and we can show you how we implemented them in our own environment.
Maturity Level 2 is the right target for most businesses, it provides meaningful defence against targeted attacks, satisfies most client and insurer requirements, and is achievable without enterprise-scale resources. Maturity Level 3 is appropriate for organisations that hold sensitive government or defence data, or that face sophisticated threat actors. We assess your risk profile and recommend the right target before any remediation work begins.
Starting from a typical baseline, reaching Maturity Level 1 takes three to six months. ML2 typically takes six to twelve months, depending on your current controls and how quickly your team can implement changes. The timeline is driven by the complexity of your environment and the pace your business can absorb change, not by technical difficulty. We build a realistic roadmap in the gap assessment phase so you know what you're committing to.
Start by getting a read on where you stand. Our free Essential Eight self-assessment tool gives you an indicative maturity level in a few minutes and flags which strategies to fix first. It's worth moving promptly, too: as the global cyber agencies recently warned, AI is shrinking the time between a vulnerability appearing and being exploited, which we unpack in The Five Eyes just said AI has shrunk the cyber clock to months. Once you have that indicative picture, we can run a formal assessment and build a prioritised remediation roadmap.
A commercial electrical contractor lifted to ACSC Essential Eight Maturity Level 2, with enforced MFA, hardened and encrypted devices, application control and 24/7 managed monitoring.
Read the case study
An accounting and financial planning firm brought into line with the ACSC Essential Eight, with Microsoft 365, multi-factor authentication, backup and staff cyber-awareness training.
Read the case study
Essential Eight deployment across an independent secondary school: M365, MDM, content-filtered firewalls and AWS workloads all secured and aligned.
Read the case study
A South Australian local council's 12-month modernisation program, audited and sequenced against the Essential Eight, using security capability the Council already licensed.
Read the case studySMB1001 gives Australian small businesses a practical, tiered path to improving their security posture, without the complexity of the Essential Eight.
Read the article →Financial firms face mounting pressure to tighten cyber security. What ASIC's rules mean for AFS licensees.
Read the article →30 minutes, free, no commitment. We'll give you an honest initial read on your likely maturity level and what reaching your target would involve.
