An Essential Eight assessor in Brisbane can mean anything from a consultant with a questionnaire to an engineer who tests every control on your systems. The two produce reports that look alike and are worth very different amounts to an insurer or a customer. This guide explains how to tell them apart and what to ask before you engage anyone for an assessment or uplift.
Why the choice of assessor matters
The Essential Eight is published by the Australian Signals Directorate, and your maturity level is only as credible as the evidence behind it. If a customer, insurer or tender panel asks you to prove a level, a report based on interviews will not hold up.
A weak assessment also costs you twice. You pay for it, then pay again when a proper one finds the gaps the first one missed.
What a proper assessment looks like
The Australian Signals Directorate publishes an Essential Eight assessment process guide that sets out how controls should be tested. In plain terms, a sound assessment has these features.
- It tests, and does not only ask. The assessor checks configurations, runs tools and reviews logs. Interviews support the testing but do not replace it.
- It covers all eight controls at the level you are targeting, across a sensible sample of workstations and servers.
- It rates each control as effective, partly effective or not effective, with the reason.
- It records the evidence so someone else could check the finding.
- It gives you a plan ranked by risk and effort, not only a score.
Ask to see a sample report with client details removed. You will know within a page whether it is evidence or opinion.
Choosing an Essential Eight assessor in Brisbane: five checks
1. Who does the work
Ask for the name and background of the person who will assess your environment. You want an engineer who has implemented these controls, because someone who has only audited them tends to miss why a control fails in practice.
2. Their own security standing
An assessor gets deep access to your systems. Independent certification of their own operations, such as ISO/IEC 27001, tells you their handling of your data has been audited.
3. Assessment and uplift, together or apart
Some firms only assess. Others assess and then do the remediation. Both models work. One firm doing both is faster and cheaper, and the people fixing the gaps already understand them. A separate assessor gives you independence. If one firm does both, ask for a later reassessment to be independently checkable, with evidence you hold.
4. Honesty about the target level
A good assessor asks who is requiring the Essential Eight and at what level before proposing work. Be wary of anyone who recommends Level Two or Three without asking why you need it.
5. What you keep
You should own the findings and the evidence whether or not you go ahead with remediation. Confirm this before you start.
Questions to ask
- Do you test controls on our systems, or is this interview based?
- How many devices and servers will you sample?
- Which version of the maturity model do you assess against?
- Will we receive the evidence as well as the report?
- Who does the remediation, and how is it priced?
- How do you handle legacy systems that cannot meet a control?
- What does reassessment involve next year?
The sixth question reveals a lot. Almost every business has something that cannot comply, such as an old application that needs administrator rights. An experienced assessor will describe compensating controls and how to document the exception.
The honest caveat: an assessment will find things you would prefer it did not
Most first assessments come back at Maturity Level Zero overall. That is normal, because the model scores you at your weakest control and one missed patch window is enough. It does not mean the business is negligent.
Be cautious of an assessor whose first report is flattering. The value of the exercise is an accurate picture, and a comfortable report is worth less than an honest one that stings.
Does the assessor need to be local?
Much of the testing can be done remotely. Some of it is better done on site, including checking physical devices, reviewing how backups are stored and sitting with the people who run your systems. For a Brisbane business, a local assessor makes that practical and makes follow up conversations easier. Ask where the engineer is based and whether the assessment includes time at your office.
How assessment fits a wider program
The Essential Eight is a baseline, not a whole security program. It does not cover continuous monitoring, incident response or staff training. Once the controls are in place, most businesses add monitoring so that a failed control is noticed. That is the role of a Security Operations Centre and services such as managed detection and response.
If you need something customers can verify independently, a certification such as SMB1001 may sit alongside the Essential Eight work.
Frequently asked questions
Who can assess the Essential Eight?
Any competent security professional can perform an assessment, as there is no single mandatory licence for private sector assessments. That is why method and evidence matter: choose an assessor who tests controls on your systems and follows the Australian Signals Directorate's process guide.
How long does an Essential Eight assessment take?
A gap assessment for a small or mid-sized business usually takes days, not weeks. Larger or multi-site environments take longer because more systems are sampled.
What is the difference between an assessment and an uplift?
An assessment measures where you are, and an uplift is the work to close the gaps. An assessment should always come first so the uplift is scoped on evidence.
Can a self-assessment satisfy an insurer?
Rarely for anything above a basic questionnaire. A self-assessment is a useful first look, but insurers and customers give more weight to an independent report backed by evidence.
How often should we be assessed?
Assess at least once a year and after major changes. Controls drift as systems and staff change, so last year's result does not prove this year's position.
What to do next
Ask two or three assessors for a sample report and their answers to the seven questions. REDD's Essential Eight assessment is carried out by an engineer from our Milton office, and the findings are yours to keep either way.