How to Prepare for the Essential Eight Assessment, Explained

You can prepare for an Essential Eight assessment before anyone tests a control.

However, your team needs to agree on the target maturity level, the systems in scope, and the people who can provide the evidence and access needed for assessment work.

That preparation gives the assessment a clear boundary and gives your team time to investigate gaps, check exceptions and collect records before a tender, customer or insurer asks for proof of your cybersecurity compliance position.

It also helps the assessor test the environment your business actually relies on.

This article explains how to prepare for that process. It covers scope, owners, access, evidence, gaps and exceptions, and shows why a completed self-assessment is a starting point for formal testing.

What Should You Prepare Before an Essential Eight Assessment?

Prepare four things before the Essential Eight assessment starts: the purpose and target, system boundary, control owners and assessment access. The next four checks turn them into a testable plan.

Confirm Why You Need the Assessment and the Required Maturity Level

Start with the original request and write down why the assessment is needed and which maturity level applies. Before you move on to scope, owners and evidence, confirm the following details:

• Trigger: Tender, client review, a cyber insurance question, board request or internal uplift;
• Required outcome: Readiness review, maturity assessment or independent validation;
• Target: Maturity Level One, Two or Three, plus the environment named in the request; and
• Delivery: Due date, report recipient and any assessor qualification requirement.

Together, these details define the required result. ASD’s Essential Eight maturity model is cumulative, so the target applies across all eight strategies.

For instance, if a tender asks for evidence of Maturity Level Two, a checklist score alone won’t satisfy that evidence request.

These details can also expose a different requirement.

When a buyer needs a customer-facing certificate rather than an Essential Eight maturity assessment, consider comparing Essential 8 and SMB1001 before starting the wrong workstream. SMB1001 is a tiered Australian certification standard, so it answers a supply-chain question about certification status rather than a maturity question about control effectiveness.

Define the Systems, Users and Providers in Scope

Define the assessment boundary in writing, including anything your team depends on to deliver services or handle sensitive information. Use that boundary to identify the systems, users and providers the assessment needs to cover:

• Workstations, laptops, servers, network devices and remote-access systems;
• Internet-facing services;
• Microsoft 365 and other cloud platforms;
• Business applications, browsers, PDF software and Office;
• Standard, privileged, service and emergency-access accounts;
• Backup platforms, protected workloads and recovery locations; and
• Systems administered by managed IT, cloud, software or backup providers.

Next, reconcile the list against your asset, identity, endpoint-management and provider records. Also, document every exclusion and its reason.

A production assessment limited to head-office laptops won’t answer a client asking about the whole environment. The finished boundary also identifies your evidence owners.

Name an Owner for Each Control and Evidence Source

Assign each control and evidence source to the person who can demonstrate it. Use this ownership map as a starting point:

Control or Evidence Area	Likely Owner or Source
MFA, conditional access and macro settings	Microsoft 365 or identity administrator
Application control, hardening and patching	Endpoint administrator or managed IT provider
Backup coverage and restoration	Backup administrator or provider
Scope, exceptions and final response	System owner or compliance lead

Once ownership is clear, add a due date and provider contact to each evidence request. Ask the same owners to confirm assessment access so exports, tests and approvals don’t stall the work.

Arrange Access, Approvals and Assessment Contacts

Assessment work should not start until people have the access and approval they need to test the scope safely.

So, before testing begins, agree the following arrangements with the people responsible for each system:

• Controlled standard and privileged test accounts;
• Access to representative endpoints, servers, consoles and reports;
• Written approval for agreed scripts, tools and test activities;
• Contacts for internal administrators and relevant providers;
• A secure method for transferring sensitive evidence; and
• An agreed place to produce, store and retain the assessment report.

Then, confirm who can approve access and answer technical questions. If the assessor cannot view or test a control, the result may be recorded as no visibility.

With the target, boundary, owners and access ready, the checklist can now focus on control gaps.

How Can You Use the Redscale Checklist to Prepare?

Use Redscale’s free Essential Eight self-assessment checklist to build an evidence list before formal assessment work starts.

Keep each checklist statement exactly as it appears in the tool, then record whether it is in place across the agreed scope and what proves the answer.

The checklist gives you a structured first-pass view of your readiness. It does not confirm a maturity level. A formal assessment still needs to test the implementation and effectiveness of the controls in scope, because Essential Eight implementation is judged by how each control behaves on real systems, not by whether a setting or policy exists.

Record Every Checklist Statement in a Working Sheet

Record each statement from the checklist, then add the details that turn it into an assessment-preparation task.

Record against each checklist statement	Why it matters
Current status: in place, partly in place or unknown	Shows where your team needs to investigate rather than assume.
Systems covered	Confirms whether the answer applies across the agreed assessment boundary.
Accountable owner	Identifies who can explain the control and approve any change.
Evidence location	Gives the assessor a configuration, report, log or test result to review.
Gap or exception	Creates a remediation item where coverage is incomplete or unavailable.

Use the checklist score as a readiness signal only. The useful output is the working sheet behind it: what your team can prove, what needs checking and what needs remediation.

Treat an Unconfirmed Answer as a Gap to Investigate

Treat any checklist answer that your team cannot support with evidence as a gap to investigate.

A policy, an assumed Microsoft 365 setting or assurance from a provider may indicate that a control exists, but it does not demonstrate that it works across the scope.

Record the item as unknown until someone verifies it.

For instance, if your team marks “MFA protects administrator and privileged accounts” as in place, identify the privileged accounts in scope and save the policy, role export and sign-in evidence that support the answer.

The following sections explain what to do after completing each group of statements in the checklist.

Application Control

Use the five Application Control statements in the checklist to confirm that approved software is documented, unauthorised applications are restricted, rules are centrally managed and blocked activity is reviewed.

For each statement:

• Compare the approved-software register with applications found on in-scope devices;
• Save the application-control policy, endpoint configuration and recent blocked-event records; and
• Record any applications, scripts or installers that must remain available as exceptions.

Your working sheet should show which devices and user groups the rules cover.

If one office, device type or provider-managed system uses different controls, record that limitation.

Patch Applications

Use the five Patch Applications statements to check:

• How your team identifies application vulnerabilities
• Applies updates
• Prioritises internet-facing services
• Includes third-party software
• Removes unsupported applications.

To confirm those points and prepare the supporting evidence, work through the following checks:

• Match the application inventory against vulnerability scans and patch-compliance reports;
• Confirm the reports include third-party applications, browsers, PDF software, email clients and exposed services; and
• Record missed updates, failed deployments and end-of-life software for remediation.

A vulnerability assessment is what turns that comparison into a usable list, showing which known weaknesses sit on which in-scope systems.

Do not rely on a report that covers only part of the environment. If an application is not visible in your reports, investigate whether it is outside the tool’s coverage or absent from the asset inventory.

Restrict Microsoft Office Macros

Use the five Restrict Microsoft Office Macros statements to check that macros are disabled where they are not needed, internet-originated macros are blocked and only authorised users can run approved macros.

Use those checklist responses to identify the settings, exceptions and test results your team needs to provide:

• Identify the policy that manages macro settings
• List users or business applications with approved macro exceptions
• Retain configuration exports and a test result that shows users cannot bypass the restriction.

This helps separate a centrally enforced restriction from a setting that individual users can change.

Patch Operating Systems

Use the five Patch Operating Systems statements to check that supported operating systems are identified, vulnerabilities are monitored, updates are applied to schedule and failed deployments are followed up.

To support those checklist responses, bring together the records that show how operating-system patching is managed in practice:

• Compare the asset inventory with operating-system patch reports;
• Identify unsupported versions and internet-facing systems that need priority treatment; and
• Keep evidence of failed-patch follow-up, not only successful deployment figures.

This gives your team a way to distinguish broad patch coverage from a system that has actually been brought up to date.

Multi-Factor Authentication

Use the five Multi-Factor Authentication statements to confirm MFA coverage for cloud email and productivity platforms, administrator and privileged accounts, remote access, important applications and sensitive data.

For each statement:

• List the accounts and services in scope;
• Save MFA and conditional-access policy exports, exclusion lists and recent sign-in records; and
• Investigate older authentication methods, service accounts or third-party systems that may sit outside MFA coverage.

If phishing-resistant MFA is used for higher-risk access, record where it applies and why those accounts were prioritised.

Regular Backups

Use the five Regular Backups statements to check that critical data, systems and configurations are protected, backup frequency reflects recovery needs, backups cannot be altered or deleted easily and restoration is tested.

Use those checklist responses to confirm what is protected, how recovery is tested and which records support each answer:

• Compare the backup-coverage report with the systems and data in scope;
• Retain job history, protection settings and recovery procedures; and
• Keep a restoration-test record showing what was recovered, when the test occurred and who accepted the result.

A successful data backup job supports the checklist answer, because it shows the protected workloads and the schedule behind that answer. A completed restoration test gives stronger evidence that your team can recover what the business relies on.

Once these records are complete, the checklist becomes a preparation tool rather than a score alone.

It should leave your team with an evidence pack for controls that appear to be in place, plus a remediation register for gaps, unknowns and exceptions.

What Evidence Will an Assessor Need?

An assessor will need a defined scope, proof that each control operates in that scope, and records of any gaps, exceptions or alternate controls.

Prepare an evidence pack with:

• Scope records: Assessment boundary, asset inventory, user groups, administrator accounts, cloud services, business applications and managed providers.
• Control configurations: Application-control rules, browser and macro policies, patch settings, MFA and conditional-access policies, privileged-access roles, and backup-protection settings.
• Operational records: Vulnerability scans, patch-compliance reports, blocked-application events, access reviews, sign-in logs, backup job history and recovery procedures.
• Testing results: Application-blocking tests, macro-restriction tests, MFA coverage checks, restoration-test records and any other technical validation performed during preparation.
• Exceptions and alternate controls: The affected system, reason, risk owner, compensating control, approval and review date.
• Previous work: Prior assessment reports, remediation tickets and evidence showing that earlier findings have been closed or retested.

Organise the pack by Essential Eight strategy. For each control, include the relevant systems, accountable owner, evidence date and a link or location for the supporting record.

This makes it easier to show how the evidence relates to the agreed scope rather than presenting a folder of disconnected reports.

Put the strongest evidence first. ASD’s assessment process guide ranks simulated control testing highest, followed by live configuration reviews.

Reports and screenshots can support the assessment, while policies and interviews alone provide weaker assurance.

For example, a written backup policy shows what your team intends to do. A successful restoration test shows that recovery was tested. Keep both, but lead with the restoration record.

How Should You Record Gaps and Exceptions?

Record gaps and exceptions in one register that tracks the affected control, available evidence, remediation owner, due date and retest result.

Create a new row whenever a checklist statement is missing, partly implemented, unknown or subject to an exception. Then complete it in this order:

• Identify the requirement and scope: Record the Essential Eight strategy, target maturity requirement and affected system, account, application or provider.
• State the current position: Mark the item as missing, partly implemented, unknown or not applicable. Link the evidence that supports that finding.
• Define the remediation action: Write the specific change needed to close the gap.
• Assign ownership and timing: Name the accountable owner, target date and priority.
• Retest before closing the item: Add the new evidence and record whether the control now operates across the required scope.

Also, your register should contain:

• Essential Eight strategy and maturity requirement
• affected scope
• current outcome
• evidence available
• gap or limitation
• remediation action
• accountable owner and target date
• priority
• retest result
• exception details, where applicable.

Do not close a gap through risk acceptance alone. For an exception, record the affected scope, reason, compensating control, accountable approver and review date.

What Happens After the Preparation Stage?

Your preparation completes the first stage of the assessment. Next, the assessor confirms the scope and approach, tests the controls, then issues a report with findings and remediation actions.

The assessment work usually follows this sequence:

• Confirm the scope and assessment approach: The assessor confirms the target maturity level, systems in scope, exclusions, representative sample, testing methods and any access limitations. Your team should resolve any scope questions before testing starts.
• Test the controls and review evidence: The assessor reviews configurations, reports, logs and test results to determine whether the controls operate across the agreed scope. Your team provides access, answers technical questions and supplies any missing records.
• Review gaps, exceptions and alternate controls: Findings from testing are compared with the gap register. Your team may need to provide further evidence, clarify an exception or demonstrate how a compensating control addresses the protection objective.
• Receive the assessment report and remediation plan: The report records the assessment outcomes, evidence limitations, gaps and recommended actions. Use it to update your remediation register, assign owners and schedule retesting for material findings.

When Should You Ask for Essential Eight Assessment Support?

Ask for support when your assessment identifies controls that your team cannot validate or maintain before a tender, client review or insurer request.

This often happens when different people or providers manage patching, MFA, backups and reporting, which is the split managed security services are built to consolidate under one accountable owner.

The assessment may identify the gap. Your team still needs to collect evidence, complete the fix and show that the control works.

Without an accountable owner, this work can stay open until an external deadline creates pressure.

Where ongoing ownership is the issue, Redscale Managed Security Services can help your team manage the work behind these controls.

Our managed security services include vulnerability remediation, identity controls, security monitoring and reporting. It gives your team current evidence for the next request.

Then, Redscale SMB1001 certification support service can help prepare the required controls and evidence, whenever a buyer needs recognised certification rather than an Essential Eight assessment result. Getting SMB1001 certification runs on its own timeline, because the tier, the required controls and the supporting evidence all need to be in place before an assessor signs off.

Book a free discussion session with our team and let’s build a remediation plan your team can maintain.

FAQ