Essential Eight uplift cost in Brisbane depends on three things: the maturity level you are aiming for, where you are starting from, and how much evidence you need to show for it. A business that is already well run and needs Maturity Level One will spend a fraction of what a business with old servers needs to reach Level Two. This guide explains what you are paying for and how to keep the cost under control. It does not quote figures, because any number given without seeing your environment would be a guess.
What an uplift involves
The Essential Eight is a set of eight mitigation strategies published by the Australian Signals Directorate. Each is scored from Maturity Level Zero to Level Three under the Essential Eight Maturity Model.
An uplift has three parts, and a quote should show each one:
- Assessment. Measuring where each control sits today.
- Remediation. The technical work to close the gaps.
- Evidence and upkeep. Documenting the result and keeping it true.
Proposals that only price the first part look cheap. The assessment is the smallest piece.
The target maturity level sets the scale
Your overall maturity is set by your weakest control, so reaching a level means lifting all eight to it.
- Level One suits most small and mid-sized businesses and addresses common, opportunistic attacks.
- Level Two is frequently expected of suppliers to government and larger enterprises. It tightens timeframes and adds logging and stronger authentication.
- Level Three is for organisations facing targeted, skilled attackers.
Each step up costs noticeably more than the one before, because the requirements move from switching on settings to changing how systems are built and monitored. Ask who is requiring the level, and get that requirement in writing before you commit to it.
What drives Essential Eight uplift cost in Brisbane
Your starting point
A recent Microsoft 365 environment with supported devices is far cheaper to uplift than a mix of old servers and unsupported software. Legacy applications that cannot be patched or cannot run without administrator rights are the most common cause of cost blowouts.
Size and spread
More users, devices, servers and sites means more to configure and more evidence to gather.
Application control
This is usually the hardest of the eight to implement well. It means only approved software can run, which requires knowing every application the business uses. Expect it to take the most effort.
Licensing
Some controls rely on features in higher licence tiers. A provider should tell you early whether your current licences are enough.
Internal capacity
Work your own IT people can do under guidance reduces the fee. Work the provider does alone costs more but finishes sooner.
Costs that are easy to miss
- Replacing hardware or software that cannot meet the patching requirement
- Staff time for testing, particularly when macros and application control change how people work
- Restore testing of backups, which takes planned downtime
- Ongoing monitoring so the maturity level stays true after the project ends
- Reassessment, usually yearly
The honest caveat: Level One is the right target for many businesses
There is a tendency to treat a higher level as better. For a 30 person professional services firm with no government contracts, chasing Level Two can mean spending heavily on controls that address threats the business is unlikely to face, while disrupting staff along the way.
A provider should be willing to tell you that Level One is enough when it is. Equally, a self-assessment cannot prove any level. Evidence has to be gathered from the systems themselves, and that work cannot be skipped to save money.
How to keep the cost down
- Do a gap assessment first and insist on findings ranked by risk and effort
- Fix the low cost controls early: multi-factor authentication, administrator rights, macro settings
- Retire legacy systems where you can, instead of building exceptions around them
- Combine the uplift with planned changes such as a device refresh or cloud migration
- Ask for the work to be staged so the spend is spread across quarters
Staging matters. A good plan sequences the controls so the highest risks close first and the budget is predictable.
What a quote should contain
Ask for the scope in writing: number of users, devices, servers and sites; the target level for each control; what remediation is included; what evidence you will receive; and what happens after the project. The guidance on assessing Essential Eight implementation from the Australian Signals Directorate describes what a proper assessment looks like, and it is worth reading before you compare proposals.
Our own Essential Eight assessment and uplift starts with a gap assessment by an engineer, and you keep the findings whether or not you proceed.
Uplift or certification?
If your goal is to show customers something they can verify, a certification scheme may suit you better than a maturity claim. SMB1001 is a tiered standard written for smaller organisations and is independently certified. Some businesses do both, and the work overlaps heavily.
Frequently asked questions
How much does an Essential Eight uplift cost?
The cost depends on your target maturity level, your current environment and your size, so it needs an assessment to price. Reaching Level One from a modern, well kept environment is a modest project, while Level Two from a legacy environment is a substantial one.
How long does an Essential Eight uplift take?
Most Level One uplifts take a few weeks to a few months. The assessment is quick, and the time goes into remediation, testing with staff and gathering evidence.
Is the Essential Eight mandatory?
It is mandatory for non-corporate Commonwealth entities and is not a legal requirement for most private businesses. In practice insurers, government customers and large enterprises often require it of their suppliers.
Can we do it ourselves?
Yes, a capable internal team can implement many controls. An independent assessment is still worthwhile, because a maturity level you scored yourself carries little weight with an insurer or customer.
Do we have to redo it every year?
You should reassess at least yearly. Systems and staff change, and maturity is only true for as long as the controls keep working.
What to do next
Find out who is asking for the Essential Eight and at what level, then get a gap assessment before you set a budget. To talk through your situation, book a consult with REDD in Milton, or read how our wider cyber security services fit around the eight controls.