A client or a tender asked
"State your Essential Eight maturity level and attach evidence."
A questionnaire or contract clause names a level, the deadline is real, and nobody can point to evidence of where you are.
Essential Eight Level 1 in six months.
Priced upfront
A two-week Essential Eight maturity assessment scores all eight strategies and tells you which level you need. If it is Level 1, go ahead within 90 days and your assessment payment becomes month one of a six-month programme, at one fixed price. If it is Level 2, the report prices that before you commit.
For organisations of up to 100 seats. Ex GST.
What you get
- Maturity scorecard, all eight strategies, with evidence
- Target level recommendation, in writing
- Prioritised remediation roadmap
Rated 5.0 out of 5. 5.0 on Google · Australia-based staff · Sydney, since 2014
Why you are here
Someone has asked for your Essential Eight level, and there is no evidenced answer
It usually arrives one of three ways. Whichever one brought you here, the first step is the same.
The insurer asked
- MFA enforced on all remote access?
- Critical patches applied within 48 hours?
- Backups tested and offline?
The answers you have are best guesses, and the policy is written on them.
The board asked
"Are we covered?"
The honest answer is "we think so." Your IT team is stretched, the MSP says everything is fine, and nobody has checked.
All three need the same thing first: an evidenced score against the eight strategies.
How you buy this
One thing to buy today. The rest depends on what we find
You commit to a two-week assessment and nothing else. The programme only exists if the report says you need it.
Step 1 · You buy thisTwo weeks
Gap assessment
$3,950 once, ex GST
All eight strategies scored, Level 0 to 3, with evidence. You keep the scorecard, the target recommendation and a sequenced plan with owners and indicative tooling costs, whoever does the work.
"Where are we, and which level do we actually need?"
The report decides
Outcome A · Most organisationsFixed price, published
Report says Level 0. You need Level 1.
Then the programme, with your assessment counted as month one. $23,700 in total. See the programme →
Outcome BPriced in the report
Already partly there, or you need Level 2.
A shorter engagement, or a deeper one, estimated in the report before you commit to anything. Indicative term 6 to 9 months.
Not sure whether you need Level 1 or Level 2? How to tell which maturity level you need
Outcome C
Already at the level you need. The report says so, and you owe nothing further. The plan is still yours.
No programme is sold before the report is written. The scoping call decides whether the assessment itself is the right first step.
The deliverable
What the $3,950 buys
The assessment is written to be useful to whoever does the work, including someone who is not us.
Maturity scorecard. Every strategy scored Level 0 to 3, with the evidence behind each score.
Target recommendation. The level your obligations actually require, in writing.
Prioritised remediation roadmap. Effort, owner and order per strategy, with tooling gaps and their indicative costs named.
Yours to keep. Take it to your MSP, your incumbent, or a competitor of ours. It is written to survive that.
Section 3 · Remediation plan
M1M2M3M4M5M6
Owner, effort and order per item
Section 2 · Maturity scorecard
Level 0 to 3Application controlL0
Patch applicationsL1
Office macrosL0
App hardeningL0
Admin privilegesL1
Patch OSL0
MFAL1
BackupsL0
Below Level 1At Level 1
Evidence referenced per score
Essential Eight maturity assessment
Current level, target level and the
sequenced plan to close the distance.
Confidential · ASD Essential Eight
Essential Eight pricing
What Essential Eight compliance costs
This is the second purchase, and it only exists if the report calls for it. Compliance here means reaching and holding the level your report recommends: for most organisations, Level 0 to Level 1 over six months, then staying there.
Step 2 · Remediation
Level 0 to Level 1
$23,700 to Level 1
6 payments of $3,950, the first of which is your assessment. Up to 100 seats. Ex GST.
All eight strategies uplifted to Level 1 in the plan's priority order, using tooling from our partners
Cliffside leads the uplift alongside your IT team or MSP, with responsibilities agreed and documented before remediation begins
Monthly report per strategy: done, in progress, blocked and by whom
Final month: re-assessment against Level 1, gaps closed, evidence pack issued for clients, insurers and auditors
Cybereen licences included. The compliance platform runs in your own tenant for the term, inside the price.
After the uplift
Essential Eight Monitoring
$2,800 per month
Ongoing. Stay at level between audits. Ex GST.
Monthly re-score of all eight strategies
Configuration drift alerts
Patch and MFA compliance reporting
One-page executive report and quarterly review call
Evidence pack maintained, audit-ready
Cybereen licences included. Your tenant stays live for as long as monitoring runs, inside the monthly price.
Already at Level 1 or 2? That uplift is estimated in your assessment report before you commit, typically over 6 to 9 months.
What the price covers
This is the one place the page states what is in and out, so nothing turns up in month four.
The programme price is for the outcome. The monthly split is for your cash flow, and it does not change if you reach Level 1 early.
In the price
Our service, for up to 100 seats
Cybereen platform licences for the term
Re-assessment and the evidence pack
Named in the plan before you commit
Third-party product licences
Hardware
Anything above 100 seats, priced at the scoping call
Tooling in the plan
Level 1 is delivered with tooling from our partners, so you are not assembling eight point products to reach a baseline. The plan names what you need, what you already own and what each costs. Only Cybereen sits inside the price.
Start here
Book the scoping call
Go ahead within 90 days of your assessment and it is included in the six-month plan, not added on top.
Your name and work email is all we need. Thirty minutes with a senior consultant; if something smaller than this programme would do, we say so.
- 01We confirm a time within one business day
- 02Thirty minutes with a senior consultant, no slides
- 03A straight answer on whether the assessment is the right first step
"I feel like I've got a great cybersecurity team when I've got Cliffside. They leave no stone unturned."
Leah Christiansen · Security Manager, DeltaPAE · Read the case study →
Rated five out of five.
"…a report that was packed with actionable items and in priority order. This made it super clear to us what we needed to work on."
The programme
How the six months run
Gate · plan agreed first
Gate · plan agreed first
01 · Weeks 1 to 2
Assess
All eight strategies scored with evidence, not interviews alone. Target level recommended in writing.
02 · Week 3
Agree
Plan presented to leadership: sequence, effort, owners, exclusions and the monthly price. You decide with the full picture.
03 · To month 6
Remediate
Strategies hardened in priority order alongside your IT team or MSP. Monthly report: done, in progress, blocked and by whom.
04 · Month 6
Prove
Re-assessment against the target level, gaps closed, evidence pack issued.
Week 1Week 3Months 2 to 5Month 6
Six months assumes you go ahead straight after the readout. Using the full 90-day window moves the finish date by the same amount. Outcome B engagements typically run 6 to 9 months.
Timelines assume your IT team or MSP completes assigned actions within agreed windows. Where they do not, we tell you early and in writing.
Our commitment
What we will put in writing
If a strategy is not at level, the report says so. Anything beyond the agreed scope is quoted in writing before it starts.
Rated five out of five.
"Because of their support and honest advice, our security posture is much better than what it was six months back. Would absolutely recommend their services. Great value for money is an added bonus."
Rated five out of five.
"…excellent, professional and have been a pleasure to work with on our networking projects. Very forthcoming with information on what they're doing and how configuration has been implemented."
Who delivers
Ajay Ambadan
Senior Security ConsultantEssential Eight lead
- CISSP
- ISO/IEC 27001 Lead Auditor
- ISO/IEC 42001:2023 Lead Implementer
Ajay leads Cliffside's governance, risk and compliance work, Essential Eight included. He runs the assessment and stays on the engagement through to the re-assessment at the end of the programme.
Ajay works within Cliffside's security engineering and architecture team. Cliffside's own information security management system is certified to ISO/IEC 27001:2022 by BSI.
Questions buyers ask
What does an Essential Eight assessment cost, all in?
$23,700 to reach Level 1, paid as 6 monthly payments of $3,950 ex GST. The first payment is the assessment. Go ahead within 90 days of your assessment and it is included in the six-month plan, so five more payments complete the programme. If you stop after the assessment, you owe nothing further. Once you are at Level 1, Essential Eight Monitoring is $2,800 a month.
Can we skip the assessment and go straight to remediation?
No, and you should be suspicious of anyone who will. A fixed remediation price is only honest if it is based on evidence of where you are starting from. The assessment takes two weeks, and if you go ahead within 90 days it becomes month one of the programme rather than an extra cost.
What is in the price, and what is not?
Our service for organisations of up to 100 seats, and Cybereen platform licences for the term. Hardware, third-party product licences and anything else that is not our service are excluded. If reaching your target level needs tooling you do not own, the plan names it and its indicative cost before you commit, not in month four. Above 100 seats, we price the difference at the scoping call.
We already have an MSP. Whose work is this?
Cliffside leads remediation alongside your IT team or MSP. Any actions that must be completed by your team or provider are identified in the plan and tracked through delivery, and the monthly report names who is blocked on what. The assessment is independent: we are not scoring our own operations work.
What if we need Level 2, or are already partly at Level 1?
Then the distance is different, and the report prices it. Where you are already partly at Level 1 the engagement is shorter; where your obligations call for Level 2 it is deeper, typically 6 to 9 months. Either way the estimate is in the report before you commit to anything. You pay for the distance you actually have to travel. How the maturity levels differ →
Will this satisfy our insurer or client questionnaire?
Insurers and clients vary. Some ask for specific controls, such as MFA and patching cadence, rather than a maturity level; some name Level 1 or Level 2 in the policy or contract. The assessment reviews the wording and questionnaires you are being asked to complete, and the recommendation is written against them. The evidence pack at the end is built to be handed over.
Two weeks from now, you could know exactly where you stand
Thirty minutes, no slides. We ask about your environment, your obligations and who is asking for evidence, and tell you whether the assessment is the right first step or if something smaller would do.
Book my scoping call →$3,950 assessment ex GST, fixed
Still working out which level you need?
Our Essential Eight page covers the eight strategies, the four maturity levels and a self-assessment checklist you can run before you talk to anyone.