Home » Essential Eight Maturity

TRUSTED Pathway

Get to ACSC Essential Eight ML2 — with audit-ready evidence.

A Microsoft-aligned, evidence-led path to ML2 — built for State & Local Government, defence supply chain and SOCI mid-market.

Book Essential Eight ML2 Assessment →

Talk to a specialist

Regulatory Trigger — Increased cyber insurance, customer due‑diligence, and board assurance requirements are pushing organisations to demonstrate Essential Eight ML2 with verifiable, auditable controls—not policy intent.

Essential Eight Uplift Assessment

ENVISION

$0 customer cost when bundled with a Modern SecOps engagement.

Control-by-control ML1 → ML2 gap analysis.

Microsoft tooling map (Defender, Intune, Entra, Sentinel).

Evidence and reporting model aligned to ASD audit format.

Costed 90-day uplift plan with Microsoft funding levers.

Uplift to ML2 in 180 Days

ACCELERATE

Hardened controls, deployed evidence, no audit surprises.

Application control, patching, macros, hardening — operationalised.

MFA, restrict admin, OS patching — enforced via Intune + Entra.

Daily backups validated; restore tested and documented.

Evidence pack generated and version-controlled.

Essential Eight Continuous Compliance

ALWAYS-ON

Posture stays at ML2 — quarterly audit-ready, year after year.

Monthly E8 posture report; control drift alerts.

Patch + macro + admin telemetry into Sentinel.

Annual ML3 readiness review.

Audit-pack export on demand for ASD / IRAP / regulators.

FAQ

Do we need an external assessor to confirm ML2?

PSPF entities and most regulated buyers expect an independent assessment. We produce ASD-format evidence packs and work with assessors of your choice; we do not self-attest.

How long to uplift to ML2 in practice?

A 180-day uplift is realistic for most AU mid-market estates already on Microsoft 365 E5. Timelines extend if application control or backup validation lag — both flagged early in the assessment.

How do you keep posture at ML2 once we get there?How do you keep posture at ML2 once we get there?

Always-On streams patch, macro and admin telemetry into Sentinel, alerts on drift, and produces a quarterly ML2 attestation with annual ML3 readiness review.