Professional services
A point in time Essential Eight assessment across all eight strategies, with a maturity level for each, the evidence behind it, an executive summary and a prioritised uplift roadmap.
Assess your Essential Eight maturity
ESSENTIAL EIGHTKnow your Essential Eight maturity is real, not just reported.
We assess all eight strategies against evidence, show you the controls behind every maturity level, and close the gaps with the engineers who run your environment.
- 01Patch applicationsML2
- 02Patch operating systemsML1
- 03Multi factor authenticationML2
- 04Restrict admin privilegesML1
- 05Regular backupsML2
Illustrative example · Evidence behind every level
- ISO/IEC 27001 certified
- SMB1001 Gold
- Nueva 24x7 SOC
- In house digital forensics and incident response
- CREST Registered Testers in our team
- ARN Innovation Awards: SMB Partner of the Year 2024 and 2025
The challenge
A maturity level is only as good as the evidence behind it.
Boards, insurers, customers and regulators increasingly ask for an Essential Eight maturity level. Many organisations can quote one. Fewer can show the evidence for it. Self assessments drift, controls that were configured once quietly fall out of policy, and a single exception can drop a strategy a full maturity level. The result is a number that reads well in a board pack and fails the first time someone checks it.
How Nueva helps
Evidence first, then the fix.
We assess against the ASD Essential Eight Maturity Model (November 2023 revision), testing how each control actually behaves rather than how it is described. You get a maturity level for each of the eight strategies, the evidence behind it, and a costed path to your target level. Because Nueva Technology manages environments like yours every day, the uplift plan is one your team can actually run, and we can run it with you.
Reported or evidenced
The number in the board pack, and the number that holds up.
Toggle between a self reported maturity level and what an evidence based assessment typically finds. Select a strategy to see what we test.
All eight at target, on paper
Bar height: maturity level 0 to 3
Patch applications · Reported ML2
What we test: Coverage, timeliness and the systems that get missed.
Patch operating systems · Reported ML2
What we test: Coverage, timeliness and the systems that get missed.
Multi factor authentication · Reported ML2
What we test: Where it applies, how strong it is, and whether it is phishing resistant where it needs to be.
Restrict admin privileges · Reported ML2
What we test: Who holds privileged access, how it is granted and how it is reviewed.
Application control · Reported ML2
What we test: What can run, where, and how exceptions are managed.
Restrict Office macros · Reported ML2
What we test: The settings attackers rely on users leaving open.
User application hardening · Reported ML2
What we test: The settings attackers rely on users leaving open.
Regular backups · Reported ML2
What we test: Whether backups are complete, protected and actually restorable.
Illustrative example. Your levels come from evidence collected in your environment.
What we do
What we assess
- Patch applications and patch operating systems. Coverage, timeliness and the systems that get missed.
- Multi factor authentication. Where it applies, how strong it is, and whether it is phishing resistant where it needs to be.
- Restrict administrative privileges. Who holds privileged access, how it is granted and how it is reviewed.
- Application control. What can run, where, and how exceptions are managed.
- Restrict Microsoft Office macros and user application hardening. The settings attackers rely on users leaving open.
- Regular backups. Whether backups are complete, protected and actually restorable.
Nueva CyberA defined assessment Your extended compliance team
A project or a partnership. Your call.
Managed service
Annual assessments that measure progress against the last one, continuous vulnerability and patch visibility between them, and uplift delivered by Nueva Technology, so maturity keeps rising instead of being checked once a year.
Talk about ongoing Essential EightHow it works
From first call to proof it holds.
STEP 01 OF 05
Outcomes
What changes for you.
- A maturity level you can defend to a board, insurer, auditor or customer
- Gaps ranked by risk and effort, not listed alphabetically
- Progress you can measure year on year
- Uplift delivered by people who run environments like yours
“Nueva has been a trusted YHA partner for many years. They listen, understand our business and the problem we're trying to solve before recommending a vendor-agnostic solution. From modernising CCTV across our network to strengthening our cyber maturity through Essential Eight and CyberCert Gold, Nueva has helped us build a stronger, more measurable cybersecurity and risk posture.”
Read the YHA story
One team across three practices
- Nueva CyberAssess maturity against evidence
- Nueva TechnologyDeliver the uplift across your fleet
- Nueva SecureBackups and building systems in the same plan
Customer outcome
YHA Australia
Safer stays, on site and online
Nueva helped YHA Australia modernise video security across its hostel network and build cyber maturity it can measure, year on year.
- Cyber
- Secure
SmithHancock
Meeting ASIC's cyber expectations
IT, cyber and office security run by one accountable partner, helping the practice meet ASIC's cyber security expectations.
- Cyber
- Technology
- Secure
FAQ
Questions buyers ask us.
Still deciding? Talk to a security specialistDo we need to be certified against the Essential Eight?
ASD does not certify Essential Eight implementations, and does not require independent assessment unless a directive, regulator or contract calls for one. Many organisations still choose an independent assessment because boards, insurers and customers give it more weight than a self assessment.
Which maturity level should we target?
It depends on your obligations and your risk. Commonwealth entities under the PSPF are required to reach Maturity Level Two. Critical infrastructure entities on the enhanced tier of the amended SOCI CIRMP Rules are expected to meet Maturity Level Two, and the baseline tier Maturity Level One. For everyone else, the right target comes from the threats you face and what you are trying to protect.
What is the difference between an Essential Eight assessment and a penetration test?
An Essential Eight assessment measures whether eight specific mitigation strategies are in place and working. A penetration test shows how an attacker could actually get in and what they could reach. They answer different questions, and many organisations run both.
Can you fix what you find?
Yes. Nueva Technology delivers the uplift, or supports your team while it does. We then reassess to confirm the maturity level has moved.
Nueva Cyber
Know where you stand on the Essential Eight.
Cyber incident happening now?+61 2 7252 5678
Call our incident team any time. If we can't answer straight away, leave a message and a responder will call you back as soon as possible.