Understand where you stand against ASD's Essential Eight. Get a clear roadmap to ML2 compliance with actionable priorities.
E8 ML2 Assessment
ML2 Status
6/8 AT ML2
Assessment Cost
From $15k
Scales with environment complexity
You know Essential Eight matters but don't know your current maturity level or where the critical gaps are.
DISP or contract requirements are approaching and you need to demonstrate ML2 compliance.
Your IT provider says you're covered, but you're not confident their operational reporting maps to E8 controls.
You don't know what compliance will actually cost or where to focus limited resources.
Assessment against all 8 mitigation strategies using ACSC verification methodology.
Current maturity level documented for each control using ACSC assessment tools.
Sequenced actions with effort estimates so you know exactly what to do and when.
Clear budget guidance for closing gaps, so you can plan your investment.
Board-ready report translating technical findings into business-relevant language.
Detailed record of your existing control environment as the baseline for uplift.
You're preparing for DISP and need to demonstrate Essential Eight ML2 compliance as part of your cyber security requirements.
You've been assessed before but need to validate ongoing compliance and close remaining gaps before your next review.
You need to evidence E8 compliance quickly for an upcoming contract, tender, or audit deadline.
Half-day on-site scoping session. Walk away with a clear picture of your current posture and direct advice on whether a full assessment is the right next step.
Full Essential Eight ML2 gap assessment with compliance roadmap and executive summary.
Assessment plus implementation — closing gaps, building documentation, and preparing your organisation for compliance milestones.
Pricing note: Assessment pricing scales with environment complexity. Small environments (under 50 users, M365-centric) start from $15,000. Larger or hybrid environments are scoped individually. All pricing is indicative and depends on environment size and complexity.
Pick a time that works for you — we'll confirm scope and send a pre-read before the call.
Federal department
Led the department's Essential Eight maturity review using ACSC verification methodology, then ran continuous-assurance activities through annual PSPF reporting and ASD cyber survey submissions — keeping E8 posture live between formal reviews.
Federal agency
Evaluated a multi-year Essential Eight uplift program, stress-tested its sustainability, and delivered a transition-to-business-as-usual plan with defined ownership, cadence, and evidence requirements — so compliance held after the consultants left the building.
Federal agency
Scoped, assessed, and reported on three high-priority SRAs in a single calendar year — an enterprise integration platform, a supplier-security uplift, and a public-facing online services portal with paired penetration testing — all delivered inside the agency's assessment window.
Typically 2–4 weeks depending on environment size. Small environments can be assessed in under 2 weeks. The timeline depends on how quickly your team can provide access to key systems, documentation, and key stakeholders for workshops.
Access to your environment documentation, IT architecture diagrams, and key stakeholders for workshops. We'll provide a detailed preparation checklist during scoping so you know exactly what you need to have ready.
Yes — our Uplift tier covers assessment plus implementation. We can assess first and then scope uplift separately, or combine both from the start. We'll discuss the best approach for your situation during scoping.
MSP reporting is operationally focused — uptime, tickets, patching status. Our assessment maps controls specifically to ASD's Essential Eight maturity model with evidence-based verification against each mitigation strategy. It's a formal, compliance-grade assessment rather than operational reporting.
Absolutely. Essential Eight ML2 is a core DISP cyber security requirement. The assessment report directly supports your DISP application and CSQ completion. Many of our clients use the E8 assessment as a stepping stone to full DISP readiness.
For a small, M365-centric environment we typically go from scoping to a full ML2 assessment report in 4-6 weeks. Uplift timelines depend on the size of the gap but most defence suppliers reach ML2 within 3-6 months of starting.
Assessment starts from $15,000 and scales with environment complexity. Uplift starts from $40,000. We scope and price every engagement individually after a free health check so you know the range before committing.
Your MSP manages infrastructure; we assess it against ASD's Essential Eight and the specific expectations of defence reviewers. Unlike Big 4, every consultant on the engagement is AGSVA-cleared and comes from a government delivery background — we're not building the team as we go.