7 Questions to Ask Before Hiring an Essential Eight Provider

A provider tells you they will get your business to Maturity Level Two. It sounds precise, and it is the kind of sentence that ends a sales meeting. It also leaves most of the useful questions unasked. Maturity Level Two is not a product or a certificate. It is a set of requirements across eight security controls, and every one of them has to be met in your environment, with your software and your staff.

The ground is also shifting. ASD has launched ASD Essentials, which moves away from the single maturity score and towards evidence that controls are working. The Essential Eight stays published during the transition, and ASD has not announced a date by which organisations must move. We covered that in our post on whether the Essential Eight is being replaced. The practical effect for you is that the best Essential Eight provider is the one who talks about evidence, not just a number.

 

The quick answer

A good Essential Eight provider can tell you what is in scope, show evidence for each control, say who verifies the work, warn you in advance about what will disrupt your staff, and stay involved after the project finishes. The seven questions below test each of those.

 

Essential Eight compliance: who actually has to do it?

Only non-corporate Commonwealth entities are required to. The Protective Security Policy Framework (PSPF) requires them to implement the Essential Eight to Maturity Level Two. For everyone else, it is voluntary, and ASD recommends it as a baseline.

That does not make it optional in practice. In our experience, security questionnaires from clients, tender documents and cyber insurers increasingly reference the Essential Eight, so a private business may well be asked to show where it stands. Knowing who is asking, and what they will accept, shapes every answer below.

 

1. Which maturity level are you aiming for, and how will you handle the move to ASD Essentials?

A good provider explains why a target level suits your business, rather than simply naming one. ASD says the Essential Eight should be implemented using a risk-based approach, and that all eight strategies should be met at one level before moving to the next. A provider who says “Level Two” before learning anything about your business is selling a default.

Then ask about ASD Essentials. A strong answer is calm and plain: the work you do now carries forward, they are tracking ASD’s guidance, and they can explain what is likely to change in how you demonstrate results. A weak answer is a blank look.

 

2. What exactly is in scope, and what is left out?

Ask for the scope in writing, including the exclusions. The Essential Eight was designed to protect internet-connected IT networks, so the edges matter: laptops, servers, Microsoft 365, other cloud services, personal devices, remote sites, and any operational technology such as factory equipment. ASD Essentials treats operational technology and cloud as their own chapters, which tells you these are not minor details.

“Everything” is not a scope. A written list of what is covered, what is not, and why, is the first sign the provider has done this before.

 

3. What evidence will I receive, and in what form?

You should receive dated, repeatable evidence for each control, not a score or a traffic-light dashboard. For patching, that means patch status reports. For backups, it means proof that a restore was actually tested. For application control, it means the configuration itself.

A green tick is an opinion. A configuration report is evidence. This matters more now that ASD is shifting attention from a rating to proof that controls work, and it matters immediately if a client, auditor or insurer ever asks you to back up a claim.

 

4. Who checks the work?

Ask whether the provider that implements the controls also assesses them, and whether an independent party can verify the result. ASD does not require independent certification of an Essential Eight implementation, and it says assessments should follow its Essential Eight assessment process guide. So a provider marking its own homework is not against the rules.

It is, however, a conflict of interest worth naming. The fix is transparency. A good provider will say how the assessment follows ASD’s guide, show the working, and be comfortable with someone else looking at it. Many businesses only need internal assurance. If a tender or client wants independent verification, you will want to know that early.

 

5. What will break, and how will you manage it?

An honest provider can name the parts that will annoy your staff before they happen. Application control, which allows only approved software to run, tends to surface the old line-of-business program nobody remembered. Restricting administrative privileges means some people lose the local admin rights they have had for years. Office macro settings and application hardening can interrupt a spreadsheet someone built in 2014 that quietly runs half of finance.

A strong answer includes a pilot group, a rollout in stages, and a clear process for exceptions, with each exception documented along with the risk. ASD’s own FAQ allows compensating controls in some cases, so a good provider can explain when an alternative is reasonable and when it is a shortcut. “There will be no impact” is the warning sign.

 

6. How do you cover Microsoft 365, cloud services and staff use of AI?

Most Australian businesses now run on Microsoft 365, so the answer should go beyond laptops and servers. Ask how they protect cloud sign-ins and administrator accounts, and whether they use Conditional Access, which lets a business decide when and how someone may sign in, such as requiring extra verification from an unfamiliar device or location.

Then ask about AI. Staff are already pasting company information into AI tools, and businesses are starting to give AI agents their own permissions. ASD has published guidance on AI alongside the Essentials, and a provider should have a considered view on how it fits with the controls, not a slogan.

 

7. What happens after the project ends?

The Essential Eight is not a one-off project, and a provider should say who watches it afterwards. New laptops arrive, new software is installed, exceptions pile up, and patches keep landing. An environment that passed in March can quietly drift by September.

Ask how often evidence is refreshed, who is alerted when something slips, and who owns the documentation. Also ask what happens if you ever leave: your documentation and administrator access should come back to you without a fight.

 

Where Essential Eight projects tend to go wrong

A few patterns come up often enough to be worth knowing.

The first is the gap between “implemented” and “provable”. Controls are often switched on, but nobody captured evidence at the time, so months later the business cannot show a client or insurer what it did.

The second is that application control and administrator restrictions stall more projects than any technical limitation, because they change how people work. That makes them a communication problem before they are a technology problem.

The third is the finish line. Projects tend to end with a report and a handshake, and the monitoring that keeps the controls in place is treated as a separate purchase, or forgotten.

 

The seven questions at a glance

 

Essential Eight Implementation Help for Australian Businesses

We treat the Essential Eight as ongoing IT management rather than a one-off project. Implementation is the first stage, and the harder part is keeping the controls in place as your environment changes. That is why we have a cybersecurity-focused team, so the people planning your controls work on security day to day rather than treating it as an add-on to general IT support. The work sits within our managed IT services, where ConnectSecure vulnerability management gives us continuing visibility of patch and vulnerability status, and SentinelOne EDR with a 24/7 SOC watches endpoints around the clock. Our Essential 8 framework page sets out the service.

If you want a starting point before talking to anyone, AffinityScan is our free, domain-based cybersecurity assessment. If you would rather put these seven questions to us directly, get in touch. We would rather you ask them of every provider you speak to.

 

Essential Eight provider FAQs

What does an Essential Eight provider do?
An Essential Eight provider assesses your current position against the eight strategies, implements the missing controls, gathers evidence that they are working, and ideally keeps them in place over time. Scope and evidence differ widely between providers, which is why the questions above matter.

Is the Essential Eight mandatory for private businesses?
No. It is mandatory only for non-corporate Commonwealth entities under the PSPF. For private businesses, ASD recommends it as a baseline, and clients, tenders and insurers may ask about it.

Does the Essential Eight need independent certification?
ASD does not require independent certification. It does say assessments should follow its Essential Eight assessment process guide. Some clients or tenders may still ask for independent verification.

Which Essential Eight maturity level should my business aim for?
ASD recommends a risk-based approach and meeting all eight strategies at one level before moving up. The right target depends on your threat environment and who is asking you to demonstrate it.

What is the difference between the Essential Eight and ASD Essentials?
ASD Essentials is new guidance that grows out of the Essential Eight, starting with chapters for enterprise IT, operational technology and cloud. The Essential Eight remains published during the transition, and ASD has not announced a date by which organisations must move.

How does Affinity MSP help with Essential Eight?
We implement the controls, then keep them in place through managed IT, using ConnectSecure for vulnerability management and SentinelOne EDR with a 24/7 SOC. We also help you gather evidence you can show to clients, insurers and auditors.