Essential Eight cost and timeline are driven by your target maturity level, how many legacy systems you run, how much of the work is already in place, and how strong your evidence is. ASD publishes no price list, and we will not invent one. Here is what to size before you ask anyone for a quote.
What are you actually buying?
Two separate efforts get lumped together. The first is implementation: changing settings, tools and habits so the eight strategies are in place. The second is assessment: someone checking that they are in place and effective. ASD's assessment process guide covers the second, and says an assessment looks at both implementation and effectiveness of the controls.
The eight strategies are patch applications, patch operating systems, multi-factor authentication, restrict administrative privileges, application control, restrict Microsoft Office macros, user application hardening and regular backups.
Which target level are you aiming for?
This is the biggest driver. ASD's FAQ says Maturity Level One may suit small to medium enterprises, Level Two large enterprises, and Level Three critical infrastructure providers and organisations in high threat environments. Each level mitigates a more capable adversary, so the requirements get stricter and the work grows.
Your level may also be set for you by a contract or policy. If so, the question is not what to aim for but how far you are from it today.
Why not jump straight to the top?
ASD says to implement and assess each level progressively until the target is reached. Its reasons include checking that new controls work, spotting unexpected side effects and giving employees time to adjust. A staged plan takes longer on a calendar but gives fewer surprises.
There is one shortcut ASD allows. If your target is above Level One, you may implement a higher level requirement early when that is cheaper in the long run. Its example: roll out passkeys or security keys at Level One instead of buying one-time password tokens you will replace later.
What makes the work bigger?
Legacy systems. ASD notes that implementing the Essential Eight on legacy systems is often difficult, and encourages upgrading them first. Until then you need compensating controls, which add their own work.
Fleet size and variety. Assessors test a representative sample of workstations, servers and network devices. A varied estate means more configurations to bring into line and more to sample.
Scope. The model was designed for internet-connected IT networks. ASD says it was not designed for enterprise mobility or operational technology, so a clear scope statement saves arguments later.
Online services. Cloud services count. A SaaS tool without multi-factor authentication is a finding, even if no server is involved.
What makes the assessment longer?
Evidence quality. The guide ranks evidence from excellent (testing the control with a simulated activity) down to poor (a policy or verbal statement). Weak evidence means follow-up requests and more testing by the assessor.
All or nothing per strategy. To claim a strategy, every control in it must be assessed as effective or as an alternate control. One ineffective control means you cannot claim that maturity level for the strategy.
Exceptions. A formal exception needs documented scope, compensating controls, an owner, and approval by an appropriate authority. ASD says exceptions should not be approved beyond one year. Risk acceptance on its own, or buying cyber insurance, does not count as a justification for skipping a whole strategy.
What can shorten it?
Collect evidence from the systems that enforce each control instead of screenshots. Use ASD's own tools: the FAQ lists the Essential Eight Maturity Verification Tool and the Application Control Verification Tool. The assessment guide also publishes test plans and a report template, which show what an assessor will ask.
For software you build, a current inventory of dependencies and a record of how fast vulnerable ones are fixed can feed the patching evidence. Safeguard's CLI generates SBOMs and scans many package managers, but no tool makes an organisation compliant, and Safeguard does not certify anyone.
What to do
- Confirm your target maturity level and who set it.
- Define scope in writing, including cloud services and anything out of scope.
- List legacy systems and decide whether to upgrade or compensate.
- Score each of the eight strategies as met, partly met or missing.
- Set a staged plan, and note any higher level requirement worth doing early.
- Start collecting dated evidence from the systems themselves.
- Ask assessors to quote against the plan, and ask what drives their own effort.
Quick check
How much does Essential Eight cost?
There is no standard price. It depends on target level, estate size, legacy systems and the evidence you already have. Get quotes against a written scope.
Can we skip a strategy if we accept the risk?
No. ASD says risk acceptance without compensating controls leaves that strategy not implemented, and the overall result drops to Maturity Level Zero.
Sources
Last reviewed: 18 October 2026.
