One-Off Engagement

Essential Eight Maturity Assessment

A senior engineer assesses your environment against the ASD Essential Eight Maturity Model and produces a formal report with documented evidence, gap analysis and a phased roadmap to Maturity Level Two — exactly what cyber insurers, tenders and vendor questionnaires increasingly ask for. One fixed price, no ongoing commitment.

On-Site Assessment

A senior engineer comes to your site — walking the office, observing workflows and reviewing admin consoles against the eight Essential Eight controls specifically.

Formal Maturity Report

A Breakwater-branded PDF: executive summary, maturity heatmap across all eight controls, control-by-control findings with evidence, gap analysis and a phased roadmap to ML2.

Walkthrough Call

A walkthrough call where we present the report, explain the maturity scores, and talk through the roadmap to ML2. You leave with a clear picture of where you sit today.

No Ongoing Obligation

The assessment stands alone. Implement the roadmap yourself, with your current provider, or with us — quoted separately off the findings, never as a condition of the assessment.

How the Engagement Works

A structured four-step process, start to finish, with a formal report at the end.

  • Book the assessment. Pick a date that suits you. We send a short pre-engagement email covering what we need access-wise — read-only admin on Microsoft 365, the backup console and the network controller — and ask for any active cyber insurance or vendor questionnaires as input.
  • On-site visit. A senior engineer walks your office, talks to whoever handles IT day-to-day, and reviews admin consoles against the eight Essential Eight controls.
  • Formal report delivered. We review your tenancy remotely against the Maturity Model, score each control from ML0 to ML3 with documented evidence, and send the PDF through — typically within a week of the on-site visit.
  • Walkthrough call. We present the maturity scores, answer your questions, and talk through the roadmap to ML2. The report is yours to keep either way.

Frequently Asked Questions

Three things: an on-site assessment of your environment by a senior engineer focused on the eight ASD Essential Eight controls, a written PDF report with a maturity heatmap across all eight controls, control-by-control findings with evidence and gap analysis, and a phased roadmap to reach Maturity Level Two, plus a walkthrough call where we present the report and answer your questions. The report is yours to keep and act on, regardless of whether you engage Breakwater IT for anything further.

The Strategic IT Review covers your whole IT environment across a four-stage framework — Stabilise, Secure, Optimise and Extend — and is the right starting point if you want a broad health check. The Essential Eight Maturity Assessment goes deep on the eight specific controls ASD publishes for cyber resilience, scoring each one against the Maturity Model from ML0 to ML3 with documented evidence. If you need formal compliance evidence for a cyber insurer, a tender response or a vendor questionnaire, this is the report that answers that question directly.

No. The assessment is a one-off engagement that stands on its own. The report ends with a phased roadmap to lift your maturity — but there's no obligation to act on it with us. You can implement the roadmap yourself, with your current provider, or come back to us later if and when it makes sense. If you do want Breakwater to implement and maintain the controls, that's quoted separately as ongoing managed support under our Complete tier.

Typically one week. The on-site visit is a single session booked at a time that suits you. We then spend a day reviewing your tenancy remotely against the eight controls, build the report, and send it through with the walkthrough call scheduled five to seven business days after the on-site visit. Larger or more complex environments may take slightly longer but the price doesn't change.

The first part of the visit is a walk-through of the office with whoever handles IT day-to-day — we hear their account of the environment before opening a laptop. The remaining time is spent reviewing admin consoles against the eight Essential Eight controls: application control, patch management, Microsoft 365 security configuration, multi-factor authentication, administrative privilege restriction, daily backups, incident response and user application hardening. We need read-only access to your Microsoft 365 admin centre, backup console and network controller, arranged beforehand by email.

Related Services

Cyber Security Compliance

Looking for ongoing Essential Eight implementation and documentation rather than a one-off assessment? Cyber Security Compliance is built into our Complete tier, with Breakwater actively implementing and maintaining the controls over time.

View Service
Strategic IT Review (Fixed-Price)

Want a broader health check across your whole IT environment rather than Essential Eight depth? The Strategic IT Review is our other fixed-price product — same shape, a four-stage framework instead of control- by-control maturity scoring.

View Service

Find out exactly where you sit against the Essential Eight.

Book the Essential Eight Maturity Assessment and we'll have a formal report in your hands within a week of the on-site visit.

Book the Assessment