Essential Eight Compliance & Maturity Assessment

Nano Solutions assesses your Essential Eight maturity across all eight mitigation strategies, shows you exactly where you stand, builds a costed roadmap to your target level, and does the remediation — patching, application control, multi-factor authentication, hardening and backups. Established 2013, WA Government CUAICTS2021 panel supplier (Contractor #225). Assessment to compliant, with one team.

The ACSC Essential Eight is the baseline for Australian government and a fast-becoming standard for everyone who works with them. We don't just hand you a report — the same team that scores your maturity does the uplift work to close the gaps.

Who it's for

Essential Eight compliance matters most to:

• Government suppliers — organisations bidding for or holding WA and federal government contracts where an Essential Eight baseline is expected.
• WA mining & resources — operators and service providers protecting operational technology and corporate systems.
• Community-services organisations handling sensitive personal data.
• Any business that needs to prove its security baseline to win or keep contracts.

What the Essential Eight assesses

The Essential Eight is a set of eight baseline mitigation strategies defined by the Australian Signals Directorate. We assess your current maturity level (0–3) for each, against your target:

1. Application control — preventing unapproved executables, scripts and installers from running.
2. Patch applications — closing known vulnerabilities in internet-facing and productivity software promptly.
3. Configure Microsoft Office macro settings — blocking macros from the internet and untrusted sources.
4. User application hardening — disabling risky features in browsers, PDF readers and Office.
5. Restrict administrative privileges — least-privilege access and controlled, audited admin accounts.
6. Patch operating systems — keeping servers and workstations current and unsupported systems out of production.
7. Multi-factor authentication — MFA across remote access, privileged accounts and sensitive data systems.
8. Regular backups — tested, isolated backups that support recovery within business requirements.

Essential Eight maturity levels

The ACSC defines four maturity levels (Zero through Three), increasing with adversary sophistication. For most organisations the practical target is Maturity Level One or Two:

• Maturity Level One — mitigates opportunistic attackers using publicly available exploits and commodity tooling. Suitable for lower-criticality workloads.
• Maturity Level Two — mitigates attackers willing to invest more time and effort, including custom tooling and limited social engineering. The typical baseline for non-classified government workloads and most enterprise targets.
• Maturity Level Three — mitigates well-resourced, adaptive attackers with novel exploits and persistence. Required for sensitive government workloads and critical infrastructure.

You can target a different maturity level per strategy — we help you set the right target based on your risk and obligations, then build a remediation roadmap with effort and risk reduction quantified. For the authoritative detail, see the ACSC's Maturity Model and Essential Eight explained.

How we work

1. Assessment (1–2 weeks, fixed) — evidence review and interviews produce a maturity scorecard across all eight strategies, plus a target-level gap analysis.
2. Roadmap — a prioritised, costed uplift plan to your target maturity level, sequenced by risk reduction.
3. Uplift (we do it) — patching, MFA rollout, application control, server hardening and a tested backup regime. We use automation tools like Ansible to keep systems hardened and consistent.
4. Annual re-assessment retainer — maturity drifts as systems and people change; we keep you compliant and re-score on a cadence.

Where the Essential Eight is heading

ASD has opened a consultation on the evolution of the Essential Eight — a broader, ISM-based "Essentials" series ("Essentials for enterprise IT"), designed to be more flexible and threat-informed for cloud, SaaS and identity-driven environments. The consultation is open until 12 July 2026.

Nothing has changed yet, and the current Essential Eight and its Maturity Model still apply. The important point: the foundational controls — patching, MFA, admin restriction, application control and tested backups — carry forward regardless of what the framework is renamed. We track the consultation and align your roadmap as the new guidance is finalised.

Why Nano Solutions

We're a Fremantle-based custom software and cyber team — a WA Government CUAICTS2021 panel supplier (Contractor #225) — so we work with the exact organisations these obligations apply to, including government agencies. With 13 years running secure production systems for government and enterprise, Linux and server hardening is home turf. Critically, we advise, build, and run it: assessment, remediation and ongoing maintenance from one accountable team.