Essential Eight Assessment & Compliance
If a tender, a cyber insurer, or a client contract has asked you to prove your Essential Eight maturity, or you just want a straight answer on where your business actually stands, this is that answer, not a sales pitch dressed up as one.
$5,500
Gap Assessment, strategy by strategy
$3,500
Uplift, closing the gaps that were found
8
strategies assessed, scored to your weakest link
ML2
ASD's recommended baseline for most organisations
What is the Essential Eight?
The Essential Eight is the Australian Signals Directorate's (ASD) baseline set of eight cyber security strategies, designed to make it significantly harder for an attacker to compromise a business, and to limit the damage if they do. It's maintained and published by the Australian Cyber Security Centre (ACSC), see the official Essential Eight Maturity Model on cyber.gov.au for the government's own detail.
Maturity is scored on a scale of Level 0 (not implemented) to Level 3 (fully integrated with automation and monitoring), assessed strategy by strategy, and your overall maturity is only as high as your weakest strategy, not an average. ASD recommends most organisations target Maturity Level 2: controls that are consistently applied and monitored, not just drafted and hoped-for.
This isn't a checkbox exercise. It's the difference between "we have a policy that says we do this" and being able to hand over real evidence that you do.
Where does your business actually stand?
Most businesses we talk to have some of the Essential Eight in place already, usually without realising it's part of a named framework. Before booking a formal assessment, it's worth a quick gut check:
Scoping matters when different parts of a business have different requirements. In our Essential Eight Level 2 consulting case study, device controls and restricted project access supported the relevant environment within an existing Microsoft tenant. The client successfully submitted the evidence to the Department of Defence.
- Are application updates and patches applied within two weeks of release across your whole environment, not just when someone remembers?
- Is multi-factor authentication (MFA) switched on for every user, everywhere, with no manual exceptions?
- Can you say with confidence exactly which applications are allowed to run on your business devices, or could a user install anything they want?
- If a laptop was lost or stolen tomorrow, could you prove its data was protected and its access revoked, with a record to show it?
- Are your backups tested regularly, not just scheduled and forgotten?
If you answered "not sure" to more than one of these, that's normal, it's exactly what the formal Gap Assessment below is for.
The offer
Gap Assessment
$5,500
A structured review of your current environment against every strategy in the Essential Eight framework, strategy by strategy, not a generic checklist tick-through. You get a clear maturity rating per strategy, an honest read on your overall (weakest-link) maturity level, and a prioritised list of exactly what's missing and why it matters.
Web-search pricing checks on comparable independent Essential Eight assessments in the Australian market put a standalone assessment starting around $8,000–$8,500. Novaguard's $5,500 sits well under that.
Uplift
$3,500
The project work that actually closes the gaps the assessment found, not a second report, the remediation itself. Once the Gap Assessment tells you exactly where you stand, the Uplift is scoped directly against that list: the specific controls, exceptions, and evidence needed to move each strategy to your target maturity level.
Assessment and Uplift are sold together as one project, most clients run them back to back rather than sitting on a gap-list indefinitely.
What we actually find, most of the time
Being specific about this is the point, not a liability. In the large majority of Gap Assessments we run, the biggest gap isn't backups, MFA, or patching, most businesses have made real progress on those already. The most common gap is application whitelisting and device compliance management.
That's not an accident, it's because application control is widely regarded as the single most effective control against ransomware and other malicious code, and that's exactly why it's also the most disruptive to run day to day. The Uplift is what turns that on properly: application control plus the device-control requirements needed to prove it's being maintained, with every exception logged and documented.
How this fits your ongoing plan
The Gap Assessment and Uplift aren't a one-off side purchase. There are two ways this fits, depending on where you're starting from:
- Keep your current IT provider. This runs as a standalone project, no switch required. You get the assessment, the remediation, and the evidence pack; your existing provider or internal IT team keeps running day-to-day support.
- Move to our Iron Dome plan. Full Essential Eight, including application control, is already part of Iron Dome's baseline, the Gap Assessment and Uplift are the onboarding project that gets a new Iron Dome client's environment there. Once it's in place, Essential Eight maturity is maintained going forward through your plan's annual compliance assessment.
Perimeter and Fortress don't have an Essential Eight path. If that's where you sit today and you'd rather stay on a Novaguard managed plan than run this as a standalone project, Iron Dome is the way there, Managed IT Services has the full tier breakdown.
Already an Essential Eight client? Time for your annual refresh
Essential Eight maturity isn't "set and forget", ASD's own guidance expects it to be maintained, and your annual compliance assessment is where that gets confirmed: every control, every logged exception, and every flagged risk reviewed against your current environment. If it's been close to a year since your last review, or your business, headcount, or device fleet has changed since then, get in touch to book your refresh rather than letting your evidence quietly go stale.
Compared to the other compliance frameworks
If you're weighing this against a public certification badge instead, see SMB1001 certification. If your business is bidding on Defence work, Essential Eight ML2 is a mandatory part of DISP accreditation too, so this assessment isn't wasted work either way.
Essential Eight FAQ
How much does an Essential Eight assessment cost?
Novaguard's Gap Assessment is $5,500; the Uplift that closes the gaps it finds is a further $3,500. Independent Essential Eight assessments elsewhere in the Australian market commonly start around $8,000–$8,500 for the assessment alone, scaling higher with complexity.
What maturity level should my business target?
ASD recommends most organisations aim for Maturity Level 2, consistently applied, monitored controls, not just documented policy. Some businesses with higher risk profiles target Level 3. Your Gap Assessment will recommend a realistic target based on your actual environment, not a one-size-fits-all answer.
Is the on-page self-assessment checklist enough on its own?
No, it's a genuine starting point, not a substitute for a formal assessment. A real Essential Eight assessment tests evidence against each of the eight strategies individually; the quick checklist above is designed to tell you whether it's worth booking one, not to replace it.