Essential Eight assessment
Where the client stands on each of the eight strategies, measured against how their systems are configured.
We assess against the ASD Essential Eight Maturity Model at the level the client is aiming for, Maturity Level One, Two or Three, and set out what it will take to get there. You get the report under your brand, or with us as your named partner.
- Patch applications: Maturity Level Two
- Patch operating systems: Maturity Level Two
- Multi-factor authentication: Maturity Level One
- Restrict administrative privileges: Maturity Level Two
- Application control: Maturity Level Zero
- Restrict Microsoft Office macros: Maturity Level Two
- User application hardening: Maturity Level One
- Regular backups: Maturity Level Two
Each level is built for a different kind of attacker
Each maturity level is written to stand up to a more capable adversary than the last, and every level includes everything below it.
-
Maturity Level One
Opportunistic attackers using commodity tools and publicly known weaknesses, taking whatever access they can find.
-
Maturity Level Two
Attackers prepared to spend more time and effort on a target, working harder to steal credentials and get around weaker controls.
-
Maturity Level Three
Adaptive attackers who rely less on public tools, go looking for weaknesses in the client’s own setup, and work to keep their access once they have it.
Maturity Level Zero
The strategy doesn’t yet meet every requirement of Maturity Level One. It doesn’t mean nothing is in place: a strategy that is mostly done is still at zero.
Choosing the target is the first decision in an assessment. Sometimes it’s set for the client by a contract, a customer or an insurer. Often it isn’t, and the right level depends on what the client holds and who is likely to come after it.
ASD’s advice is to bring all eight strategies to the same level before aiming higher. That shapes the assessment too: a client chasing Maturity Level Two needs to know which strategies are holding them at One or Zero before anything else.
What we look for in each of the eight
The eight strategies fall into three jobs: stopping malicious code from arriving and running, limiting how far an intruder gets, and getting the business back. Each has its own weak spots, and they tend to be the same ones from client to client.
Stop malicious code arriving and running
Four strategies that decide whether a malicious document, script or download ever gets to execute.
-
Application control
Only approved programs, scripts and installers can run, including from user profiles and temporary folders, where most malicious files land.
Where it falls shortA policy left in audit mode, logging everything and blocking nothing.
-
Restrict Microsoft Office macros
Macros are off unless there’s a business need, macros from the internet are blocked, and users can’t change those settings.
Where it falls shortAn exclusion group created for one finance spreadsheet that has grown to half the company.
-
User application hardening
Web browsers are configured to refuse the content attackers rely on, such as web advertisements and Java from the internet, with Office and PDF software hardened as well at the higher levels, and users can’t undo any of it.
Where it falls shortHardening applied to the browser staff are told to use, and not to the other two installed beside it.
-
Patch applications
A vulnerability scanner finds what’s missing, and fixes reach internet-facing services and common applications within the model’s timeframes. Unsupported software is removed.
Where it falls shortWindows updates are automated, while the line-of-business application and the old PDF reader are not.
Limit how far an intruder gets
Three strategies that decide what a stolen password or a compromised laptop leads to.
-
Restrict administrative privileges
Who holds privileged access, whether they still need it, and whether those accounts are kept away from email and web browsing.
Where it falls shortEveryday accounts that are also Global Administrators, because it was easier at the time.
-
Patch operating systems
Patch status across workstations, servers and network devices, and nothing still running an operating system its vendor no longer supports.
Where it falls shortThe one server nobody wants to reboot.
-
Multi-factor authentication
Every way into the client’s online services, with particular attention to privileged and remote access. At the higher levels, MFA has to be phishing-resistant.
Where it falls shortConditional Access with exclusions nobody remembers adding, or older sign-in methods that skip MFA altogether.
Get the business back
One strategy for the day the others aren’t enough.
-
Regular backups
Important data, applications and settings are backed up, restores are tested, and ordinary accounts can’t delete or change the backups.
Where it falls shortBackups that have run every night for years and have never been restored.
What counts as evidence
ASD’s own guidance for Essential Eight assessments ranks evidence by how much it can be trusted. A document describing a control sits at the bottom. Seeing the control at work sits at the top.
We work from the systems in scope, such as Microsoft 365, Entra ID, Intune and the endpoints, with read-only administrative access. The findings come from the configuration as it stands, rather than from someone’s memory of what was set up.
Strongest evidence
-
The control, shown working
A blocked macro, a refused program, a sign-in that asked for MFA.
-
The configuration, seen in the system
The setting as the system holds it now, and what it applies to.
-
A copy of the configuration
A screenshot or exported report. Better, but it shows one moment on one system.
-
A policy or design document
Says what should happen. It shows intent, not whether it happens.
Weakest evidence
The calls that decide the result
Most of the model is precise. A handful of places need a judgement, and the reason for it goes in the report.
-
Having the licence doesn’t count
A tenant can be licensed for Intune and Microsoft Defender and still be at Maturity Level Zero for most strategies. We assess what is configured and enforced.
-
Documented exceptions are treated differently
The finance team’s macro workbook or the service account that can’t do MFA may be legitimate. An exception that is documented, approved and kept as narrow as possible is treated differently from one nobody knew existed.
-
Not everything is a Windows PC
The maturity model is written for internet-connected Windows networks. Macs, mobile devices and cloud services need a decision about how each strategy applies, and that decision belongs in the report where everyone can see it.
-
Nine requirements out of ten is the level below
A strategy reaches a level only when every requirement of that level is met. The report names the requirement that is missing, so a near miss reads as a near miss, and the fix is clear.
What the client ends up with
-
A maturity report covering all eight strategies
The current level of each strategy, the target, and the specific requirements standing between them.
-
A prioritised remediation roadmap
The gaps put in order, starting with the work that lifts the strategies holding the overall level down.
-
Answers for cyber-insurance questionnaires
The Essential Eight questions insurers ask, answered from the assessment rather than from memory.
-
A walkthrough of the findings
We take you through the results, with the client in the room if you choose.
When the client is ready to close the gaps, the roadmap is the starting point for an Essential Eight uplift.
| Strategy | Current | Target |
|---|---|---|
| Application control | ML0 | ML2 |
| Multi-factor authentication | ML1 | ML2 |
| User application hardening | ML1 | ML2 |
| Patch applications | ML2 | ML2 |
| Patch operating systems | ML2 | ML2 |
| Restrict administrative privileges | ML2 | ML2 |
| Restrict Microsoft Office macros | ML2 | ML2 |
| Regular backups | ML2 | ML2 |
- Move application control from audit to enforcement
- Remove MFA exclusions and block older sign-in methods
- Harden every installed browser, including the non-default ones
Know where the client stands before anyone quotes the fix
We deliver the assessment remotely as a white-label project, under your brand or as your named partner, and quote you a fixed price for the agreed scope. The client stays yours, along with the ongoing service.
Request a quote for this project