Cyber Security · Essential Eight

Essential Eight assessment in Adelaide

The Essential Eight is the Australian Cyber Security Centre's baseline for protecting businesses against the most common cyber threats. Whether you need it for compliance, insurance or just to know where you stand, we'll assess your systems honestly and give you a practical plan to close the gaps — no scare tactics, no overselling.

What is the Essential Eight?

The Essential Eight is a set of eight strategies developed by the Australian Cyber Security Centre (ACSC) to help organisations protect themselves against the majority of cyber attacks. It covers things like patching, multi-factor authentication, backups and restricting admin access. Each strategy is measured across three maturity levels — Level One through Three — so you can see where you're strong and where you're exposed.

What we assess

Application control

We check whether your systems restrict which programs can run, preventing malware and unapproved software from executing.

Patching applications

We review how quickly your business apps get security patches and whether anything critical is falling behind.

Microsoft Office macros

We assess your macro settings to make sure they're not leaving the door open for common malware delivery methods.

User application hardening

We check that web browsers and common apps are configured to block risky content like Flash, ads and Java.

Admin privilege management

We review who has admin access, whether it's justified and how well those accounts are protected.

Multi-factor authentication & backups

We verify MFA is in place for remote access and critical systems, and that your backups meet ACSC recovery expectations.

Who it's for

Businesses required to demonstrate Essential Eight compliance for government contracts or tenders.
Organisations renewing cyber insurance — many insurers now ask for proof of maturity alignment.
Adelaide businesses that want to understand their actual security posture in plain terms.
IT managers who need an independent assessment to support a business case for security investment.

How it works

Scoping. We work out which systems and users are in scope and agree on the target maturity level.
Technical assessment. We test your environment against all eight strategies using a mix of automated tools and manual checks.
Gap report. You get a clear, prioritised report showing where you meet the maturity level and where you fall short.
Remediation plan. We lay out what needs to change, in what order, with realistic timeframes and costs — no surprises.
Implementation support. We can do the remediation work ourselves or support your team through it, then re-assess to confirm you've reached the target.

Why WaTo for Essential Eight

We do the assessment and the remediation — one team, no handoff to a different provider.
Reports written in plain English so your board or management can actually understand them.
Adelaide-based since 2001 — we understand the local business landscape and regulatory environment.
We tell you what you actually need to fix, not what would be nice to sell you.
Ongoing support to maintain your maturity level as the ACSC updates the framework.

Essential Eight questions

Is Essential Eight mandatory for my business?

It's mandatory for Australian government agencies. For private businesses it's strongly recommended by the ACSC, increasingly required by cyber insurers and often expected in government supply chains. Even if it's not compulsory for you, it's the most practical framework to measure your security against.

What maturity level should we aim for?

Most small and medium businesses should aim for Maturity Level One as a starting point. Level Two suits organisations with higher risk or compliance requirements. We'll help you pick a realistic target based on your size, industry and budget.

How long does an assessment take?

For a typical small business, one to two weeks from scoping to report. Larger or more complex environments may take longer. We'll give you a timeline before we start.

Will the assessment disrupt our work?

No. Most of the assessment happens in the background. We may need brief access to devices or accounts, but we schedule that around your business hours.