An Essential Eight maturity assessment in Australia starts from $8,500 as a fixed fee, and a combined assessment plus uplift program — the assessment, a prioritised and costed roadmap, and implementation oversight to your target maturity level — starts from $18,000. Those are our published fees at CISO Advisory Australia, in Australian dollars and exclusive of GST, confirmed in writing after a short scoping call.
The Essential Eight is the Australian Cyber Security Centre’s baseline set of mitigation strategies, and it has quietly become the default yardstick for government suppliers, councils, tender panels and cyber insurers. This guide explains what a proper assessment costs, what drives the number, and why the cheapest option is usually the most expensive one over a two-year horizon.
What a proper assessment involves
An Essential Eight assessment rates your true maturity — Maturity Level 1 to 3 — against ACSC guidance across all eight mitigation strategies: application control, patching applications, configuring Microsoft Office macro settings, user application hardening, restricting administrative privileges, patching operating systems, multi-factor authentication and regular backups. The word that matters is evidence-based. A defensible assessment separates what is claimed from what can be demonstrated: it inspects configurations, samples systems and tests controls rather than accepting a questionnaire answer. The output is a maturity rating you can put in front of an auditor, a regulator or a tender panel, plus a gap analysis of exactly where and why you fall short. Our Essential Eight assessment and uplift service page covers the full method.
What drives the cost
- Size and spread of the environment. Endpoint fleet size, number of servers, sites and cloud tenancies determine how much there is to evidence.
- Target maturity level. Assessing against ML2 or ML3 requires deeper technical verification than an ML1 baseline — see our guides to Maturity Level One and the levels above it.
- Quality of existing records. Organisations with current asset registers and documented controls are faster to assess than those where discovery is part of the job.
- Assessment vs assessment plus uplift. A rating tells you where you are; the uplift program is the engineered path to where you need to be, sequenced by risk reduction and costed so it can be budgeted.
Published pricing (2026)
| Engagement | From (AUD ex GST) | What you get |
|---|---|---|
| Essential Eight assessment | $8,500 | Evidence-based maturity rating (ML1–ML3) across all eight strategies, plus a gap analysis defensible to an auditor or tender panel. |
| Assessment + uplift program | $18,000 | The assessment plus a prioritised, costed uplift roadmap and implementation oversight to your target level, with re-assessment after remediation. |
Both are fixed fees against a written scope — no hourly billing. Full details on the pricing page.
Why the cheap desktop review costs more
A questionnaire-based “assessment” that takes a claimed control at face value produces a rating you cannot defend. The gap surfaces at the worst possible moment — in a tender response, an audit, an insurance claim or an incident post-mortem — and the work has to be done again properly, this time under pressure. Paying once for an evidence-based rating is cheaper than paying twice, and considerably cheaper than losing the tender. The most common failure patterns are covered in our guide to common Essential Eight mistakes.
Who actually needs one
- Councils and local government, where citizen data, ageing systems and state-level audit attention meet — see our government and council practice.
- Suppliers to federal and state government, for whom Essential Eight maturity is increasingly a contractual condition rather than a nice-to-have.
- Organisations facing tender panels or insurers that ask for a current, independent maturity rating.
- Boards that want one number — a defensible statement of how exposed the organisation actually is, and what closing the gap costs.
Because CISO Advisory Australia sells no security products, an uplift roadmap from us is sequenced by your risk, not by anyone’s sales targets. For a fixed, written fee for your environment, book a scoping call.
Frequently asked questions
How much does an Essential Eight assessment cost?
An evidence-based Essential Eight maturity assessment from CISO Advisory Australia starts from $8,500 AUD ex GST as a fixed fee. A combined assessment plus uplift program — including a prioritised, costed roadmap and implementation oversight to your target maturity level — starts from $18,000. The exact fee is confirmed in writing after a short scoping call.
What is the difference between an assessment and an uplift program?
The assessment rates your current maturity (ML1–ML3) against ACSC guidance and identifies the gaps. The uplift program is the engineered path to your target level: a prioritised, costed roadmap sequenced by risk reduction, implementation oversight, and re-assessment after remediation so the improved rating is defensible.
Which Essential Eight maturity level should we target?
It depends on your threat profile and obligations. Maturity Level Two is the common benchmark for most organisations handling sensitive data or supplying government, while entities facing more capable adversaries or contractual requirements may need Maturity Level Three. A scoping conversation settles it quickly.
Is the Essential Eight mandatory?
For non-corporate Commonwealth entities it is mandated under the Protective Security Policy Framework. For everyone else it is formally voluntary but increasingly enforced in practice — through government supply contracts, tender requirements, cyber insurance underwriting and board expectations.
Why not just self-assess with a questionnaire?
Because a rating based on claimed rather than evidenced controls cannot be defended in front of an auditor, tender panel or insurer — and the gap tends to surface at the worst possible moment. An evidence-based assessment inspects configurations and tests controls, producing a rating you can stand behind.
Need this handled for your organisation?
Confidential and no obligation. We respond the same business day — on-site same day / next business day, or remote, Australia-wide. Prefer to talk now? Call us 24/7 on 07 2112 8502.