Prices, cost drivers and 2026 rules
Essential Eight uplift cost: assessing maturity and budgeting the move to Maturity Level Two
What the ASD Essential Eight strategies and maturity levels are, how assessments and uplift projects are priced, an illustrative 40-person budget and the upkeep costs.
An Essential Eight uplift is usually bought in two parts: a maturity assessment (often fixed price) that tells you where you are against each of the eight mitigation strategies, and an uplift project (fixed price or time and materials) that implements the controls needed to reach a target maturity level. The biggest cost items tend to be application control and restricting administrative privileges, because they change how people work. In the illustrative example below, taking a 40-person business from mostly Maturity Level One to Maturity Level Two costs about $53,000 ex GST in year one, plus around $12,000 a year to keep it there. The upkeep is the part most budgets forget.
This guide sits under the pricing overview. A vCISO often plans the uplift, and managed endpoint services maintain much of it. Figures are illustrative, ex GST.
The eight strategies and maturity levels in brief
The Essential Eight is published by the Australian Signals Directorate's Australian Cyber Security Centre (ACSC) at cyber.gov.au. It groups eight mitigation strategies:
| Strategy | What it aims to stop |
|---|---|
| Patch applications | Exploitation of known flaws in browsers, Office, PDF readers and other apps |
| Patch operating systems | Exploitation of known flaws in Windows, macOS, Linux and server OSs |
| Multi-factor authentication | Use of stolen passwords |
| Restrict administrative privileges | Attackers using admin accounts to spread and disable defences |
| Application control | Running unapproved programs, including most malware |
| Restrict Microsoft Office macros | Malicious macros in documents |
| User application hardening | Abuse of browser and application features |
| Regular backups | Permanent loss of data after ransomware or error |
The maturity model describes levels from Maturity Level Zero to Maturity Level Three. Each level is aimed at a more capable adversary and adds stricter requirements, for example faster patching of exploited vulnerabilities or MFA for more types of access. ASD recommends implementing all eight strategies to the same target level before moving to a higher one, and choosing the target based on the threats you face. ASD updates the maturity model from time to time; the last update to the Essential Eight Maturity Model was published in November 2023. In October 2026 ASD launched ASD Essentials, a broader series whose first chapter, Essentials for enterprise IT, evolves the Essential Eight (other chapters cover operational technology and cloud). According to reports of the launch, both frameworks remain available on cyber.gov.au during a transition period, and existing contract or regulatory requirements that name the Essential Eight continue until the party that set them changes them. Check cyber.gov.au before you scope work, agree in writing which framework and version the provider will assess against, and ask how it will handle the transition.
The Essential Eight is not a law for private businesses. It becomes a requirement when a customer, government contract, industry body or insurer asks for it. Many small businesses use it as a practical priority list.
How assessments are priced
| Assessment approach | What you get | Illustrative cost |
|---|---|---|
| Self-assessment using ASD guidance | Your own view of maturity; low cost, variable accuracy | Internal time |
| Light-touch provider review | Interviews, configuration screenshots, a maturity table | $5,000–$10,000 |
| Evidence-based assessment | Technical testing of each control on a sample of systems, with evidence | $10,000–$20,000 |
An evidence-based assessment is more expensive but harder to dispute when a customer or insurer asks for proof. Ask whether the assessor will test controls (for example, try to run an unapproved program) or rely on documentation.
Illustrative uplift budget: 40 people, target Maturity Level Two
Starting point: MFA on email only, patches applied monthly, several staff with local admin rights, no application control, macros allowed, backups to a connected drive.
| Workstream | Effort | Illustrative cost |
|---|---|---|
| Evidence-based assessment | Fixed price | $8,000 |
| Application control design, testing and rollout | 12 days × $1,500 | $18,000 |
| Restrict administrative privileges (remove local admin, create separate admin accounts) | 5 days × $1,500 | $7,500 |
| MFA for all remote access and privileged accounts | 4 days × $1,500 | $6,000 |
| Office macro restrictions and user application hardening | 4 days × $1,500 | $6,000 |
| Patching automation and reporting for apps and OS | 3 days × $1,500 | $4,500 |
| Backup redesign with an isolated or immutable copy and a restore test | Set-up | $3,000 |
| Year-one total | $53,000 | |
| Ongoing upkeep (patch reporting, application control changes, admin reviews, backup testing) | $1,000 a month | $12,000 a year |
Per person, year one is $53,000 ÷ 40 = $1,325, and upkeep is $300 a year. Licences for application control, backup or endpoint tools may be extra if your current plans do not include them.
Why uplift projects overrun
- Application control surprises. Every business has unknown software in use. Budget a discovery phase and a pilot group.
- Admin rights pushback. Removing local admin creates support tickets. Plan for a short spike in help desk demand.
- Legacy systems. An old line-of-business application may not support modern controls. Decide whether to isolate it, replace it or accept the risk in writing.
- No owner for upkeep. Maturity decays when nobody checks patch reports or reviews admin accounts. Put upkeep in the managed service contract with reporting.
Making the business case
Show the owner or board three numbers: the year-one cost, the yearly upkeep, and what the uplift protects. You cannot reliably predict the cost of an incident, so avoid invented loss figures. Instead, list the concrete consequences you are reducing: days of downtime, recovery costs, notification work if the Privacy Act applies, insurer requirements and customer contracts that require a stated maturity.
Frequently asked questions
Do I need Maturity Level Three?
Most small businesses do not. ASD describes higher levels as aimed at more capable adversaries. Choose a target based on your threats and obligations, and implement all eight strategies at that level first.
Can a managed service provider "certify" my Essential Eight level?
There is no general ASD certification for private businesses. A provider can assess and report your maturity. Ask what evidence supports the report and which version of the maturity model was used.
Does Microsoft 365 already give me the Essential Eight?
Some plans include tools that help with several strategies, but configuration, coverage and evidence are what determine maturity. Owning a licence is not the same as reaching a level.
How long does an uplift take?
For a business of 30–80 people, a few months is common, mainly because of application control testing and change management. Ask for a phased plan.
Sources
- ASD's Australian Cyber Security Centre — Essential Eight overview, maturity model and assessment process guidance
- business.gov.au — cyber security checklist and support for small business
- Office of the Australian Information Commissioner — securing personal information under APP 11
