ACSC Essential Eight
Essential Eight assessment
and uplift for WA businesses.
Insurers, tenders and boards ask the same question: how do you measure up against the Essential Eight? We assess where you sit, agree the target level, close the gaps and give you the evidence.
What’s in a Lucente Essential Eight engagement
-
Maturity assessment - a structured review of each of the eight controls against your target level, Maturity Level 1 for most small businesses
-
Gap analysis - what’s in place, what’s partial and what’s missing
-
Prioritised uplift roadmap - ordered by risk reduced per hour of effort
-
Uplift project delivery - we implement the controls we recommended
-
Evidence pack - documentation for insurance renewals, customer due diligence and tender prequalification
-
Ongoing alignment - once uplifted, the controls are maintained under Protect+ and reported in the health check report at each business review
What the engagement delivers, and how long it takes
Protect+ keeps your controls aligned to the Essential Eight as part of day-to-day management. This engagement adds a formal assessment against a target maturity level, a written gap analysis and roadmap, the uplift work, and an evidence pack you can hand to an insurer or a tender panel.
The assessment takes one to two weeks. The uplift depends on where you start and how many devices and accounts are in scope, and we set the timeline in the scope.
Scoped and quoted. The assessment is available to any business. Uplift work is delivered for Lucente managed customers unless we scope it otherwise; if you’re not one yet, get in touch and we’ll scope the uplift and Protect+ together.
Maturity levels
Maturity Level 1 is the right target for most small businesses
ML1 is aimed at opportunistic attacks that use widely available tools. ML2 and ML3 suit higher-risk data, regulated industries, or supply chains that demand them.
Common questions
What does the Essential Eight cover?
Eight controls in three groups. Prevent: application control (only approved software runs), patching applications, configuring Microsoft Office macros (blocked unless there is a business reason), and user application hardening (browsers and Office locked down). Limit: restricting admin privileges, patching operating systems, and multi-factor authentication. Recover: regular backups that are retained, protected from tampering and tested.
Do we need to reach ML3 to be secure?
No. ML1 is the right target for most small businesses. It is aimed at opportunistic attacks that use widely available tools. ML2 and ML3 are appropriate where you have higher-risk data, regulatory requirements, or you’re in a supply chain that demands it.
How long does a typical uplift take?
The assessment takes one to two weeks. Uplift length depends on your starting maturity and the number of devices and accounts in scope. We set the timeline in the scope, and the roadmap is ordered so the highest-risk gaps close first.
Is the Essential Eight the same as ISO 27001 or NIST?
No. The Essential Eight is narrower and more tactical: eight specific controls. ISO 27001 and NIST CSF are broader management frameworks. The Essential Eight is the right starting point for a small business; the broader frameworks make sense once you have an in-house security function or a regulatory mandate.
Do we need to be a managed customer?
The assessment is available to any business. Uplift work is delivered for Lucente managed customers unless we scope it otherwise, because the controls only hold their value if someone maintains them. If you’re not a customer yet, get in touch and we’ll scope the uplift and Protect+ together.
Will this help with cyber insurance renewals?
Yes. Insurers ask for evidence of MFA, endpoint protection, patching, backups and admin controls. The evidence pack from a Lucente Essential Eight engagement is structured to answer those questions directly.
Tell us who is asking for evidence
Tell us who is asking and by when, whether that’s an insurer, a tender or a customer, and we’ll scope the assessment. We reply within one business day.
Talk to us