Four situations that lead to this assessment
"A bank's supplier questionnaire asked for our Essential Eight maturity level across all eight strategies. We left it blank."
Leaving it blank is not an answer. Your competitors didn't leave it blank.
"A government tender listed Essential Eight ML1 as a baseline requirement for suppliers. We want to bid."
You can't bid without an answer. And you can't answer without knowing your current state.
"Our insurer asked for evidence of Essential Eight maturity as a condition of coverage renewal. The policy is due in six weeks."
Six weeks is enough time if you start now. It won't be if you wait.
"A major client sent a letter: all suppliers must demonstrate Essential Eight ML1 within 90 days."
The supply chain requirement has arrived. This is how you respond to it.
Your MSP keeps your systems running. But Essential Eight maturity assessment isn't what MSPs are paid to do — and their estimate of your maturity is not what a client or insurer will accept. This is an independent scorecard based on evidence review.
The scope
All eight strategies at Maturity Level 1
Each strategy is assessed against the ASD's published ML1 criteria. You get a clear rating per strategy — not an averaged score that hides where the real gaps are.
Application Control
Only approved applications execute on workstations and servers
Patch Applications
Internet-facing services and high-risk applications patched within timeframes
Configure Office Macro Settings
Microsoft Office macros disabled or restricted to approved, signed macros
User Application Hardening
Web browser, PDF reader, and Flash/Java configured to reduce attack surface
Restrict Administrative Privileges
Admin accounts are privileged, separate, and used only for admin tasks
Patch Operating Systems
Operating systems patched within ASD-specified timeframes
Multi-Factor Authentication
MFA applied to remote access, cloud services, and privileged accounts
Regular Backups
Backups performed and tested. Critical data recoverable within defined timeframes.
What you receive
A scorecard you can actually hand to the client who asked
Essential Eight Scorecard
A maturity rating for each of the eight strategies: below ML1 / ML1 partial / ML1 achieved. Rated against the ASD's published criteria — not an internal estimate.
Evidence review summary
What was reviewed for each strategy and what was absent or inadequate. You see the basis of every rating — so you understand what you need to improve, not just what score you got.
Priority action list
The highest-impact controls to address first, with a rationale for the sequencing. So you close the right gaps in the right order — especially if you're working to a client or insurer deadline.
One-page summary
A plain-language summary of your scorecard, designed to be presented to the client, procurement panel, or insurer who made the original request.
45-minute debrief call
Walk through the scorecard in detail. Understand what each gap means and what the implementation path looks like — so you can give whoever asked a real timeline.
How it works
Evidence-based review — no system access required
Book and pay — no call required
Use the pricing configurator below to get your fixed price and book directly.
30-minute kickoff call
We confirm scope and walk through what evidence is needed for each strategy — so the questionnaire doesn't land as a surprise. If your MSP manages the technical controls, they will need to be involved in evidence gathering.
Structured evidence submission
Within 24 hours of kickoff, we send a questionnaire — one section per strategy — specifying exactly what evidence is needed. Policy document, configuration screenshot, process description, or vendor statement. You submit at your own pace.
Scorecard and debrief delivered
CyberCraft reviews your evidence against ASD ML1 criteria and delivers the full scorecard within seven to ten business days of evidence received. Debrief call included.
Get your price
Fixed fee, tiered by organisation size and environment
Essential Eight Scorecard — Pricing Configurator
Three questions. Fixed price and delivery estimate displayed immediately.
Where to next