Misconfigurations, incomplete patching and inconsistent control coverage are common causes of compromise. The ACSC Essential Eight is a prioritised set of mitigation strategies, with a maturity model that gives you a measurable, defensible way to describe and improve your security posture.
years testing for government and enterprise
CREST-accredited through CREST ANZ
We perform independent Essential Eight maturity assessments across all four maturity levels, then verify controls and plan your uplift.
dotSec is ISO 27001 certified and runs its own managed SIEM and MDR services, so our advice reflects how controls behave in production.
The Essential Eight groups eight mitigation strategies by what they do. An assessment measures each strategy against the maturity model, from Maturity Level Zero to Three; uplift takes you from where you are to your target level.
We perform independent Essential Eight maturity assessments across all four maturity levels. They show how well you meet ASD’s maturity requirements, which risks remain, and which improvements will deliver the most meaningful uplift.
A proper Essential Eight maturity assessment needs document analysis, interviews, observation, sampling and validation of control operation. That is the standard we apply.
policy coverage
configuration consistency
privileged access design
operating procedures
Nor can they see the difference between how a control is meant to work and how it works in your environment. Some assessments rely on scanning alone, and an environment that passes a scan can still fall short when evidence, procedures and configurations are reviewed formally.
Each step builds on the last, from an independent baseline to verified controls and a roadmap to your target maturity.
A structured, independent assessment of your alignment with the maturity model: evidence reviews, interviews, configuration sampling and technical analysis across selected systems, cloud services and user devices. It sets your maturity level for each of the eight strategies and shows where control design differs from actual operation. The report is a factual, defensible view you can share with IT, leadership and external stakeholders.
We verify how the in-scope controls operate day to day: configuration consistency, operational processes, evidence of repeatability, and whether controls meet the intent of ASD’s requirements. This separates controls that exist on paper from controls that work, and finds systemic issues such as configuration drift and reliance on manual workarounds.
A prioritised roadmap from your current to your target maturity, shaped by your operational constraints and risk profile: patching cycles, configuration hardening, privileged access, application control, backup integrity and procedures. Quick wins come first where they have the greatest effect, and we can validate progress as you go.
Our Essential Eight assessment and uplift services are practical, evidence-driven and grounded in operational experience.
We assess controls at every maturity level, from a Level Zero baseline to guiding organisations toward Level Three, across government, private sector, regulated environments and hybrid architectures.
We run our own ISO 27001 certified ISMS, maintain PCI DSS compliance, and provide managed SIEM and MDR services, so we know how controls behave in production, not just in audits.
Our recommendations account for technical realities, business priorities and resource constraints. The goal is uplift that is sustainable and measurable.
Start by evaluating your environment against the Essential Eight Maturity Model. That baseline shows how closely your controls match the expected outcomes at each maturity level, from Zero to Three, and puts you in a position to prioritise your uplift.
Both, working together. The Essential Eight is the eight highest-priority strategies from ASD’s Strategies to Mitigate Cyber Security Incidents. The maturity model gives a structured way to implement them and measure how well they operate, across four levels from Zero to Three.
Three outcomes: prioritised improvements where controls fall short of their intended maturity, with recommendations that make operational sense; faster risk reduction against the common threats the Essential Eight targets; and an evidence-based baseline that supports planning, budgeting and decisions at every level.
The Essential Eight is a prescriptive technical baseline: which eight mitigations to implement, and to what level. ISO 27001 is a management-system standard: how to run security, not which controls to use. Many clients need both, and we can run them as one engagement because the Annex A controls and the Essential Eight overlap heavily.
If you need an independent Essential Eight maturity assessment, a gap analysis against your target maturity level, or practical help implementing controls, dotSec can help.
We tailor each engagement to your environment, risk profile and operational constraints, and focus effort where it delivers the most meaningful uplift.
