Essential Eight gap assessment on verified evidence

Consultant-grade depth

24 catalogued controls across 8 areas, assessed deterministically against your uploaded and connector-collected evidence — honest coverage against the full catalogue, consultant-grade reporting from one run.

Book a demo on ASD Essential Eight → Open the sample-evidence demo

Applies to: Banks & APRA-regulated · Insurers & APRA-regulated · Superannuation & RSE licensees · Small & medium business · Government & Defence · GRC consultants & practices · Healthcare · Critical infrastructure — SOCI · Schools & education · Early childhood education & care

Coverage areas

Application controlConfigure Microsoft Office macro settingsMulti-factor authenticationPatch applicationsPatch operating systemsRegular backupsRestrict administrative privilegesUser application hardening

Generated from the live catalogue at build time — control identifiers and CyberSentien's own labels; no standard text is reproduced.

Honest coverage

Verdicts against the FULL catalogue — controls without evidence read “manual assessment required”, never a fabricated pass.

Evidence lineage

Every report carries a run id and SHA-256 integrity anchor; sections trace to the controls and evidence they rest on.

One assessment, every report

The same run renders the ASD Essential Eight report, executive brief and board pack — no drift between audiences.

See ASD Essential Eight on the real engine

Run it against synthetic sample documents now, or bring your own evidence in a gated demo week.

Request the demo →

Frequently asked

What is an Essential Eight gap assessment?

It measures your controls against the ASD Essential Eight maturity model (ML1-ML3) to show where you meet each level and where gaps remain, with evidence for each mitigation strategy.

Is a self-attested Essential Eight score enough?

Often not. Insurers, boards and procurement increasingly want verified evidence. CyberSentien assesses real artefacts and produces a defensible, tamper-evident report rather than an assertion.

What maturity level do I need?

It depends on your risk and obligations — many government suppliers now target ML2. CyberSentien shows exactly which level your evidence supports today.

Is the Essential Eight being retired?

Not today. An ASD official has said publicly that ASD intends to move to a broader 'Essentials' series, but no deprecation schedule has been published. The Essential Eight and its maturity model remain the current baseline; CyberSentien tracks the transition.

Related

Essential Eight ML2 evidence · ISM at IRAP depth · For GRC consultants