Government and enterprise contracts increasingly ask for the Essential Eight. Here's how to meet it without a six-month project.
The Essential Eight is the Australian Signals Directorate's baseline for mitigating cyber intrusions, eight strategies, four maturity levels. ClearEdge gets you to the level your contract actually requires, not a theoretical Level 3 you don't need yet.
The Essential Eight, in plain English.
The Essential Eight is a set of eight baseline mitigation strategies published by the Australian Signals Directorate (ASD) to make it harder for an attacker to get into a system, and harder for them to do damage once they're in. Each strategy is scored on a maturity model from Level 0 (not implemented) to Level 3 (fully implemented and tuned to resist a sophisticated attacker).
- Application control
- Patch applications
- Configure Microsoft Office macro settings
- User application hardening
- Restrict administrative privileges
- Patch operating systems
- Multi-factor authentication
- Regular backups
This isn't theoretical.
A logistics supplier in Auckland bidding into an Australian-linked government contract, a firm renewing its cyber insurance, a Pacific government tender that lists a maturity level as a pre-qualifier. All three are being measured against the same baseline now.
-
Cyber insurance conditions
Insurers increasingly ask which Essential Eight maturity level you operate at before they'll price a policy, not just whether you have antivirus installed.
-
Client and supply-chain pressure
If you supply into an Australian government agency, a bank, or an enterprise with an Australian parent, the Essential Eight is often the reference point they measure you against, even when you're not the one being formally audited.
-
Government and enterprise tenders
Increasingly listed as a pre-qualifier or scored criterion in Pacific government procurement, especially where funding or oversight sits with an Australian-linked body.
-
NZ Privacy Act 2020
A breach involving personal information brings mandatory notification obligations. A documented maturity level is evidence you took reasonable steps before anything went wrong.
Find the level your contract asks for.
| Level | What it signals |
|---|---|
| Level 0 | Weaknesses in your overall posture. Mitigations against common intrusion techniques are not yet implemented. |
| Level 1 | Partly aligned. Mitigates opportunistic attackers using commodity tools and techniques. |
| Level 2 | Aligned. Mitigates attackers prepared to invest more time and use more capable tradecraft. |
| Level 3 | Aligned. Mitigates adaptive attackers who are less reliant on publicly available tools and techniques. |
Four steps, no six-month surprise.
- 1. Free external scan — the same domain and email-security check as our Make Email Safe scan, giving you a first read on where the gaps likely are.
- 2. Fixed-fee gap assessment — benchmarked against the maturity level your contract, insurer or tender actually asks for, not an automatic Level 3 you don't need yet.
- 3. Remediation — ClearEdge closes the gaps identified in your roadmap, strategy by strategy.
- 4. Documented position — the Essential Eight has no universal third-party certificate. We give you a documented maturity-level position, evidenced against the ASD model, that you can hand to an insurer, a client or a tender panel.
Client asking if you're "certified", not just aligned?
The Essential Eight is the baseline enterprise and government procurement recognises. If your client is asking specifically whether you're certified rather than what maturity level you're at, SMB1001 is often the more practical answer, and the two frameworks map onto each other.
See how SMB1001 certification worksEssential Eight questions we hear most.
The questions South Pacific organisations ask most often before they engage on the Essential Eight.
Is the Essential Eight mandatory in New Zealand?
No. The Essential Eight is an Australian Signals Directorate framework, and it's only a legal mandate for Australian non-corporate Commonwealth government entities, which must reach Maturity Level Two. It shows up anyway, as a condition in cyber-insurance policies, as a line in RFPs from Australian-linked government and enterprise buyers, and as the reference point auditors and insurers reach for when they ask what you're actually doing about cybersecurity. New Zealand's own government baseline is the NZISM, not the Essential Eight, but the controls map closely onto each other.
Isn't the Essential Eight being replaced?
Eventually, yes. In mid-2026 the ASD confirmed it will phase the Essential Eight into a new domain-based "Essentials" series over roughly a two-year transition, running both in parallel first. It remains the current, in-force baseline that tenders and insurers ask for today, and the underlying controls, multi-factor authentication, patching, backups, restricted admin access, carry straight across to whatever replaces it. Doing the work now isn't wasted, it's the same work either way.
How much does an Essential Eight assessment cost?
It depends on your environment and the maturity level you're targeting. The honest answer is a free, no-obligation quote once we've seen your environment and understood what your contract, insurer or tender actually requires.
Do we need to hit Level 3 across all eight strategies?
Not necessarily. The maturity level you need depends on what your contract, insurer or tender actually asks for. Chasing Level 3 everywhere when Level 1 is what's required is the six-month project you didn't need.
Does ClearEdge issue an Essential Eight certificate?
There's no universal third-party certificate for the Essential Eight the way there is for SMB1001. It's a self-assessed maturity model. ClearEdge assesses your current maturity level, closes the gaps, and gives you a documented position you can hand to an insurer, a client or a tender panel.
How is the Essential Eight different from SMB1001?
The Essential Eight is the ASD's baseline, widely recognised by enterprise and government buyers. SMB1001 is a certification built specifically for small businesses, with an actual certificate issued by an authorised body. If a client is asking for "the Essential Eight", they usually mean the maturity model. If they're asking whether you're certified, SMB1001 is more likely what closes that conversation.
Ready to find your maturity level?
Start with a free domain security check, or book a free, no-obligation scoping conversation for a fixed-fee gap assessment.