A customer asking for a maturity level is a different brief from a business wanting better security habits. Bring the exact question so the work can address it.
An informal checklist should not be presented as an independent assessment, and a Microsoft 365 setting should not be treated as evidence for every system in the business.
Confirm the requirement and the target
We establish who needs the result, which environment it covers and the assessment method expected. Existing customer instructions and contract requirements should be available during scoping.
A target needs a reason and evidence requirements. The business can then decide whether it needs implementation help, assessment preparation or a specialist assessor for an independent conclusion.
Review controls across the agreed environment
The Essential Eight covers eight mitigation strategies, including patching, authentication, restricted administration and backups. Their requirements work together within the maturity model.
We can help organise the current evidence and identify gaps. Improving one control does not demonstrate an overall maturity level, and an unchecked system should not disappear from the scope because it is inconvenient.
Account for cloud and unusual systems
The Essentials cloud chapter addresses shared responsibility for SaaS and PaaS services. Your business may still be responsible for access, configuration, connected applications and data handling. The services you operate and control determine which chapters are relevant.
We distinguish practical improvement work from a formal assessment. Physical control systems and specialised equipment need an appropriate scope and approved changes, with the person responsible for safe operation involved.
Plan implementation around business operations
Updates and access changes can affect software people need to work. We scope the dependencies, change approvals and relevant tests before implementation.
An unsupported application may need vendor involvement or a replacement plan. A temporary exception needs an explanation, a responsible person and a review point so it remains visible after the initial project.
Prepare evidence that an assessor can follow
Configuration records and completed checks should identify the system, date and scope. A policy describing intended practice is different from evidence that a control operates.
If independent assessment is required, its provider should confirm the expected method and evidence. Preparation work supports that process without deciding or promising its outcome.
Maintain the controls after the project
Patching, staff departures and restore checks create ongoing work. The handover records who owns those tasks and what happens when a control fails or the environment changes.
We are Perth based and can support suitable work remotely across Australia. Physical inspection or site changes are separate requirements that need to be established before the scope is agreed.
Keep the existing requirement clear during transition
ASD released Essentials on 15 October 2026 and is maintaining Essential Eight during the transition. Existing regulatory and contractual requirements still need to be met. We start with the requirement that applies to your business and review how the current controls and evidence carry into the new guidance.
Essentials uses principles, actions and domains, with effectiveness assessed in context. Its implementation phases are not maturity levels, and an existing Essential Eight result does not automatically become an Essentials rating. Our release article and practical guide explain the distinction.
