How much does an Essential Eight assessment and uplift cost in Australia? (2026)

Should you still pay for Essential Eight work in late 2026?

Pay for Essential Eight assessment or uplift if a regulator, contract or customer still requires it; otherwise plan new work against ASD Essentials, which ASD published on 15 October 2026 to replace it. The framework ASD first published in 2017 is being evolved into a new series with chapters for enterprise IT, cloud and operational technology.

ASD’s transition guidance makes four points that matter for budgets:

1. Existing investment carries forward. Every Essential Eight strategy maps to at least one principle in ASD Essentials for enterprise IT, and existing controls will often satisfy or contribute to its actions.
2. Maturity levels don’t convert. Previous maturity ratings do not automatically translate into the new effectiveness ratings, which are not assessed, not effective, partially effective and fully effective. Existing evidence is the starting point for a gap analysis.
3. Don’t start work only to hit a superseded target. ASD says not to initiate work solely to achieve a superseded Essential Eight target unless a regulator or other obligation still requires it, or it still addresses material cyber security risk.
4. Obligations still stand. Organisations should keep meeting any regulatory, contractual or other obligations that require Essential Eight implementation or reporting.

ASD’s FAQ says it will advise on transition timeframes in due course. Commentary from Compliance Council and Epic IT, based on ASD’s June 2026 statements, put deprecation at roughly 12 months and retirement at roughly 24 months from that announcement; treat those as approximate until ASD confirms them.

Who still needs Essential Eight, and at what level?

Commonwealth entities under the PSPF need Maturity Level Two today, and many suppliers inherit a level through contracts. PSPF Release 2026’s list of requirements says each of the eight strategies (patch applications, patch operating systems, multi factor authentication, restrict administrative privileges, application control, restrict Microsoft Office macros, user application hardening and regular backups) is implemented to Maturity Level Two under ASD’s maturity model.

Private businesses typically need a level because a government customer, an enterprise customer’s security schedule or an industry program names one. Epic IT reports that full Maturity Level Two is now required for members of the Defence Industry Security Program. Read the clause: it tells you the level, the scope and whether self assessment is acceptable, which changes the cost more than anything else.

What does an assessment involve?

ASD’s assessment process guide splits an assessment into four stages: planning and preparation, scoping, assessing the controls, and writing the security assessment report. It also says a system owner who hasn’t demonstrated Maturity Level One shouldn’t begin an assessment against Level Two.

The guide stresses evidence quality. Assessors are expected to test that controls work, not just read policies: for example, checking that the vulnerability database used for a scan was updated close to the scan, ideally within 24 hours. Testing takes longer than interviews, and assessments built on testing cost more and are worth more.

What do assessment and uplift cost?

The published Australian figures we could find are for SMBs; larger organisations are worked estimates from an assumed day rate. We assume $1,100 to $1,500 a day ex GST. Re:Sourced puts senior cyber contractors in Sydney at $950 to $1,200 a day in 2026, and an agency day carries management and quality review on top.

Work	Organisation size	Figure (AUD, ex GST)	Basis
Assessment and implementation to Maturity Level One	Typical SMB	$10,000 to $25,000, over 3 to 6 months	Epic IT, published
Moving from Level One to Level Two	20 to 50 people	$15,000 to $40,000, over 6 to 12 months	Epic IT, published
Gap assessment only	20 to 100 seats	$4,400 to $18,000 (4 to 12 days)	Worked estimate
Gap assessment only	100 to 500 seats	$11,000 to $37,500 (10 to 25 days)	Worked estimate
Uplift to Level Two including application control	200 to 500 seats	$66,000 to $210,000+ (60 to 140 days)	Worked estimate

Licences are extra in every row. A cloud first Microsoft 365 business with managed devices typically starts nearer the low end; on premises servers, unmanaged laptops and old line of business software push costs up. These are market figures and estimates, not AWLabs prices.

Uplift costs strategy by strategy

Some strategies are mostly configuration of tools you already own; application control and patching custom software are where engineering time goes.

Strategy	Where the cost usually sits
Patch applications	Scanning tools, a patch process, and engineering time for software you build or host
Patch operating systems	Device management, server patch windows, replacing unsupported systems
Multi factor authentication	Identity platform configuration; development work for customer facing apps
Restrict administrative privileges	Separate admin accounts, access reviews, process change
Application control	Policy design, testing exceptions, ongoing maintenance as software changes
Restrict Microsoft Office macros	Configuration and handling the few teams that need macros
User application hardening	Browser and Office configuration
Regular backups	Backup tooling, restore testing, protecting backups from deletion

Where custom and line of business software fits

Your own applications are in scope, and fixing them is software work, not IT configuration. The maturity model’s Level One requirements include:

• Customer MFA. Multi factor authentication is used to authenticate customers to online customer services that process, store or communicate sensitive customer data. A portal you built counts.
• Patching online services. A vulnerability scanner is used at least daily on online services, and patches are applied within 48 hours of release when vulnerabilities are critical or working exploits exist, and within two weeks otherwise. That needs a dependency update pipeline you can run on short notice.
• Application control on workstations. Execution is restricted to an approved set, which affects developer tools and internal apps that need allowlisting.

At Level Two, applications beyond the common office, browser, email, PDF and security products must be scanned at least fortnightly and patched within one month. Old line of business systems that can’t be patched are often the most expensive item in an uplift. ASD’s transition guidance lists phishing resistant MFA, patching internet facing services, privileged access, application control and centralised logging among controls likely to carry into the early ASD Essentials priority phases, so this work isn’t wasted. Our guide to Essential Eight for software development covers the build side, and SSO with Entra ID covers MFA in business apps.

Licensing that helps

Check what your current Microsoft 365 plan already includes before buying separate tools. At the time of writing, Microsoft lists Microsoft 365 Business Premium at AU$32.90 per user a month on an annual subscription, or AU$39.48 a month on a monthly one, ex GST. For 60 users on the annual price that is $23,688 a year. Many businesses already pay part of that through a lower plan, so the real cost is the difference.

Three year cost: a 60 person business with a contract that names Level Two

In this worked example, keeping controls working costs more than reaching them. The assumptions are stated; replace them with your own.

Cost line	Assumption	Three year total (AUD, ex GST)
Reach Level One	Epic IT’s published SMB range	$10,000 to $25,000
Level One to Level Two	Epic IT’s range for 20 to 50 people, used for a slightly larger firm	$15,000 to $40,000
Licences	Microsoft 365 Business Premium, 60 users, annual price	$71,064
Running the controls and keeping evidence	2 days a month for 30 months at Re:Sourced’s $950 to $1,200 cyber rate	$57,000 to $72,000
Reassessment in years 2 and 3	Gap assessment of 6 to 10 days each year at $1,100 to $1,500	$13,200 to $30,000
Total		about $166,000 to $238,000

The licence line is the full plan price; if you already pay for a lower plan, subtract that. If nothing requires Level Two, ASD’s advice is to map this work to ASD Essentials first, which may change the order and the scope.

How AWLabs approaches Essential Eight and ASD Essentials work

We do gap assessments against ASD’s published guidance and the uplift work that follows, with particular depth in the software side: customer MFA, dependency patching pipelines, SSO, logging and application hardening. Where a contract asks for Essential Eight, we work to it; where nothing requires it, we map the work to ASD Essentials so it carries forward. AWLabs holds no Essential Eight certification and is not CREST accredited. Where a contract requires an independent assessor or an accredited penetration test, we help scope it and work with them. Senior engineers lead every build.

The first step is a Development Consult, a 15 minute call. A paid Discovery Audit scopes the gaps and obligations, then you get a fixed price Schedule of Work with three options: The Minimum, The Recommended and The Complete. Our cybersecurity service and trust page explain how we work, and our penetration testing cost guide covers independent testing.