There is no single "Essential Eight tool". The market splits into five categories: security stacks that implement the mitigations, consultancies that assess them at a point in time, global trust-automation platforms built around SOC 2, free self-assessment against ASD's own guidance, and evidence-led continuous assessment. Most organisations end up needing two of these.
By Aneis Samaan, founder of CyberSentien · Last updated July 2026
The Essential Eight is ASD's baseline set of eight mitigation strategies: application control, patch applications, configure Microsoft Office macro settings, user application hardening, restrict administrative privileges, patch operating systems, multi-factor authentication, and regular backups. The Essential Eight Maturity Model defines four maturity levels, ML0 to ML3, and maturity is assessed per mitigation strategy: you can legitimately be ML2 for multi-factor authentication and ML0 for application control at the same time.
Two consequences follow. First, ASD's assessment process guide treats the Essential Eight as a package: in practice your overall maturity level reads as the lowest you achieve across the eight. Second, and this is the point most tool marketing skips: a tool that implements controls is not evidence that you have assessed your maturity. Deploying MFA is implementation. Demonstrating, with dated artefacts against the maturity model's per-level requirements, that your MFA implementation meets ML2 across your fleet is assessment. They are different jobs, usually done by different products. The expensive mistake is confusing the first category below with the other four, so this page compares all five by what each one can honestly claim to do.
Microsoft 365 E5, Intune, Defender, Entra Conditional Access and attack-surface-reduction rules cover a large share of the eight strategies in a Microsoft-centric fleet, and Microsoft publishes ANZ guidance mapping the Essential Eight to those capabilities. Equivalent stacks exist in other ecosystems. If your gap is that the mitigations are not actually in place, this category is where your money should go first — no assessment tool fixes an unpatched fleet.
What this category does not give you is an assessment. Your tenant holds configuration state and telemetry, which is raw material for evidence, but nobody has assembled it, dated it, and preserved it against the maturity model's per-strategy, per-level requirements. "We have E5, therefore we are ML2" is the single most common false claim we see in Essential Eight conversations, and it does not survive contact with ASD's assessment guidance.
Australian security consultancies will run an Essential Eight maturity assessment against ASD's published process and hand you a signed report: per-strategy maturity, gaps, and recommendations. The genuine value here is independence and judgement — a competent assessor evaluates compensating controls and challenges optimistic self-ratings, which no software fully replaces.
The structural limit is time. Fleets drift, patch windows slip, and a point-in-time snapshot decays from the day it is issued, while re-engaging the consultancy costs the same again. Point-in-time assessment pairs well with a continuous evidence layer underneath it; it substitutes poorly for one.
A disclosure before this section: we build CyberSentien, so read this page as a vendor's comparison — we have kept every claim about other tools to their own public positioning. Vanta publicly markets an Essential Eight product and announced Australian data-centre hosting alongside Essential Eight and CPS 234 support in late 2024. Drata has publicly announced Essential Eight support, mapped into its common control framework. Secureframe lists the Essential Eight among its supported frameworks. All three are built primarily around SOC 2 and the trust-report market, which is exactly their strength: if your anchor requirement is SOC 2 for US customers and the Essential Eight is a secondary line in an Australian tender, one integrated platform is a defensible choice. Pricing across this category is quote-based. Closer to home, Australian-founded 6clicks positions itself as a broader GRC platform with Essential Eight assessment content and a government offering it states has been IRAP-assessed.
The questions to put to any platform in this category: does it assess each mitigation strategy against ASD's per-maturity-level requirements, or against the vendor's own generalised control set? And what does it show when evidence for a control is missing — an honest gap, or a default pass?
ASD publishes everything you need to self-assess at no cost: the Essential Eight overview, the full maturity model, and an assessment process guide with concrete test approaches per control. A disciplined team with a spreadsheet can produce a genuinely useful self-assessment, and for a small organisation starting at ML0 this is the right first move. We say that as a vendor selling the alternative.
The costs are staff time and decay. A spreadsheet has no evidence chain — a cell that says "compliant" carries no artefact, no timestamp and no lineage, so it proves nothing outside the room and is stale a week later. Treat it as a starting map, not an assurance product.
CyberSentien is an Australian sovereign-hosted GRC assurance platform that assesses Essential Eight, ISM/IRAP, APRA CPS 230/234, ISO 27001/42001 and SOC 2, and never marks a control compliant without timestamped, SHA-256-lineaged evidence. The design rule is: never a false green. A control with no evidence renders "manual assessment required" — the engine refuses to fabricate a pass — and reports are tamper-evident, so a claim made in March is still checkable in November. Essential Eight maturity is assessed per strategy across ML1 to ML3, the way ASD's model defines it — our guide to the evidence ML2 actually requires walks that through strategy by strategy — and because SOC 2 lives on the same evidence spine, teams weighing a "SOC 2 tool versus Essential Eight tool" decision do not have to pick: the same artefact serves both.
What we are not: we do not implement the mitigations (that is category 1's job), we are not an audit firm, and we do not replace an independent assessor's signature where a buyer demands one. We are the readiness and assurance layer you control between those things — hosted on Australian-sovereign infrastructure by design (see sovereignty and platform). Pricing is on the pricing page, and the gated demo shows the real engine on a synthetic sample library, watermarked, with no data retained.
| Native security stack (M365 E5, Intune) | Consultant assessment | Global trust-automation platform | Spreadsheet vs ASD guidance | Evidence-led continuous assessment (CyberSentien) | |
|---|---|---|---|---|---|
| Implements the eight mitigations? | Yes — that is its job | No — recommends | No — monitors and collects | No | No — assesses what your stack implements |
| Assesses maturity per strategy (ML0–ML3)? | No — telemetry, not assessment | Yes, at a point in time | Varies — often via the vendor's own control set; ask | Yes, if you are honest with yourself | Yes — continuously, against ASD's model |
| Evidence model | Config state exists but is not assembled as evidence | Sampled during the engagement, then ages | Integration-collected, mapped to common controls | None — assertions in cells | Timestamped, SHA-256-lineaged artefact per control; no evidence = "manual assessment required" |
| Cadence | Continuous operation, no assessment cadence | Point-in-time, typically re-run yearly | Continuous monitoring | As often as someone updates it | Continuous |
| SOC 2 alongside Essential Eight? | Not an assurance tool | Separate engagement, separate firm | Yes — SOC 2 is the centre of gravity | No | Yes — same evidence spine serves both |
| Cost model | Licensing you may already own | Per-engagement quotes | Quote-based subscription | Free, apart from staff time | See pricing |
| Best for | Getting the mitigations actually in place | An independent, signed point-in-time report | SOC 2-anchored companies tracking Essential Eight in the same place | Small teams taking a first honest look | Organisations that must show current, evidence-backed maturity per strategy — without a false green |
On 15 June 2026, ASD opened consultation on evolving the Essential Eight into a broader "Essentials" series, with the consultation running to 12 July 2026 and a staged transition signalled over roughly the next two years. The Essential Eight remains the framework tenders and assessors measure against today, but the buying lesson is immediate: prefer tools that treat frameworks as data with per-control evidence that can be re-mapped when guidance changes, over tools with a checklist hardcoded to 2023's model. Our engine ingests every quarterly ISM release, including June 2026, because Australian frameworks do not sit still.
It depends on which job you are buying for. If the mitigations are not implemented yet, your security stack (for example Microsoft 365 with Intune) is the priority, not compliance software. If you need to prove maturity, you need an assessment layer: a consultant for a point-in-time signed report, or an evidence-led platform like CyberSentien for continuous, per-strategy assessment. Most organisations need one tool from each side.
It can implement a large share of the eight mitigation strategies, and Microsoft publishes guidance mapping its features to them. But implementation is not assessment: Essential Eight maturity is assessed per mitigation strategy across ML0 to ML3 under ASD's maturity model, against dated evidence. Owning E5 tells you nothing about which maturity level you would actually assess at.
All three publicly list Essential Eight support, and each is built primarily around SOC 2 and continuous control monitoring. The question to ask any of them is how deeply the per-strategy, per-maturity-level requirements of ASD's model are assessed versus mapped to the vendor's own generalised control set, and what the platform shows when evidence for a control is missing. Pricing across the category is quote-based.
Yes. ASD publishes the maturity model and an assessment process guide with per-control test approaches on cyber.gov.au, and a disciplined team can self-assess with a spreadsheet. The limits are that a spreadsheet carries no evidence chain and decays immediately, so it works as a starting map rather than something you can hand a tender panel or auditor.
ASD opened consultation in June 2026 on evolving the Essential Eight into a broader Essentials series, with a staged transition signalled over roughly two years. Today the Essential Eight remains current and is what many Australian tenders, insurers and assessors reference, so the practical advice is to keep assessing against it while preferring tooling that can re-map evidence when the guidance changes.
Every capability referenced on this page is live on the CyberSentien engine — see it on the always-live gated demo. Nothing on this page is legal advice.