A one-off, fixed-fee analysis of your environment today, or one you've inherited. You get your current position against the Essential Eight, evidenced control by control, plus a prioritised and costed roadmap to close the gaps. No managed plan required.
From $3,500AUD, fixed fee + GST
Gap analysis at a glance
For businesses on another provider, or running IT in-house, who need to know where they actually stand.
Assessed using ASD's published Essential Eight Assessment Process Guide.
Configurations are inspected. We don't ask you to tick boxes about your own systems.
Reported using ASD's standardised outcomes, the same terms an independent assessor would use.
Prioritised, costed remediation steps you can act on with anyone, including your current provider.
Written for owners and boards, alongside the technical detail.
No managed plan required, before or after.
We agree what is in the environment and confirm the fixed fee in writing.
We inspect configurations against each of the eight strategies, following ASD's assessment process guide.
You get a control-by-control position using ASD's standardised outcomes.
A prioritised, costed plan to close the gaps, with a plain-English summary for owners and boards.
ASD's baseline for protecting internet-connected IT networks. The Essential Eight is published by the Australian Signals Directorate. The plain-English descriptions are ours.
Each level is set by the skill of the attacker it is meant to stop. The quoted words are ASD's.
ASD's advice is to “achieve the same maturity level across all eight mitigation strategies” before moving up. A level only counts when all eight strategies meet it, which is why a gap analysis reports each one separately.
Signifies “weaknesses in an organisation's overall cybersecurity posture.”
Aimed at “malicious actors who are content to simply leverage commodity tradecraft”: widely available tools, used against anyone who happens to be vulnerable.
Aimed at “malicious actors operating with a modest step-up in capability”: willing to spend more time on a chosen target.
Aimed at “malicious actors who are more adaptive and much less reliant on public tools and techniques.”
From $3,500 AUD, fixed fee + GST
For businesses on another provider, or running IT in-house, who need to know where they actually stand.
Quoted on scope
The analysis, then the work. We close the gaps we found and hand back a documented environment.
ASD says “there is no requirement for organisations to have their Essential Eight implementation certified by an independent party.” An independent assessment may still be required by a government directive, a regulator or a contract.
We run Gap Analysis on environments we didn't implement, because a provider grading its own work isn't an analysis. For our own managed clients, Essential Eight alignment is ongoing work under the Fortified plan with monthly control reporting, rather than a self-assessment.
If an insurer, auditor or tender panel needs it, tell us and we'll point you to an independent assessor.
In June 2026 ASD opened consultation on evolving the Essential Eight into a broader “Essentials” series, with “Essentials for enterprise IT” as its first chapter. Consultation closed on 12 July 2026.
At the time of writing, in October 2026, ASD had not published the final guidance, and the Essential Eight Maturity Model last updated in November 2023 remained the current version. ASD has indicated that organisations already using the Essential Eight should find their existing controls carry across.
Check cyber.gov.au for the latest. We assess against the current published model.
No, and we're careful about the difference. Under Fortified we build and maintain your environment toward Essential Eight alignment and report monthly on which controls are in place and which are outstanding. That's implementation work, not a rating of it. A formal position against the maturity model is our separate Gap Analysis, which we run on environments we didn't build. And if you need independent assurance for an insurer, auditor or tender, that calls for an independent assessor. We're your implementer, and we'll refer you rather than grade our own work.
We build and measure client environments against the ACSC Essential Eight, and we can evidence our own controls. We don't claim certification badges we don't hold, and we'd suggest asking any provider who does to show you the certificate.
What to ask about scope, response times, access, data and exit terms, and what a good answer sounds like.
Read the guideThe eight strategies, the four maturity levels, who it applies to, and what ASD is changing.
Read the guideHow long deleted email and files really stay recoverable, and where a separate backup takes over.
Read the guideA short call to scope the environment and confirm the fixed fee. No managed plan required, and no obligation to go further.