Essential Eight

Your insurer asked about the Essential Eight. Answer with evidence.

The Essential Eight is ASD's eight security basics against the most common attacks. Insurers, government buyers and larger clients now ask about it. We check where you stand, give you a priced plan, do the work and keep you there, with written evidence you can hand over.

Real Bytes is a Brisbane based managed IT and security provider, certified to SMB1001 Gold through CyberCert. We run our Essential 8 compliance services Australia wide for businesses whose insurers, government buyers or larger clients ask about it. Most of the work is done remotely.

Book a gap check Find your target level 07 3114 2808

Gap check against the model
Priced plan, your call
Quarterly evidence

Reviewed by Blake Bath, General Manager, on 31 October 2026.

A business owner and an engineer going through a printed checklist together at a cafe-style office table — **Level One, properly**On all eight, with evidence. Then Level Two where someone asks.

The eight, in plain words

What each control does for you.

Three jobs: stop bad code running, limit how far an attack spreads, and get you back.

Stop code running

Only approved programs run, apps patched, macros locked down, browsers tightened.

App control
Patching
Macros off

Target level picker

Which level do you actually need?

It depends on who's asking and what you hold. Three questions.

Three questions about who's asking and what you hold. You get the level to aim for and what to do first.

Who's asking about it? (pick all)

What data do you hold?

What did they actually name?

Aim for

Level One on all eight, with evidence

Level One is the floor ASD sets against opportunistic attacks, and most insurer questions are about the same controls.

What to do first

Answer the insurer's questions with dated evidence, not a level you can't back up.
Every Essential Eight control maps to at least one ASD Essentials principle, so this work carries over.

Book a gap check

How we actually do it

What's behind the work.

Scored against the modelEach control assessed against ASD's published requirements, not a vendor checklist.
Policies tested on us firstChanges built and tested on our own tenant, then pushed to clients through Inforcer.
Patching in the backgroundOperating systems and apps updated through our RMM, with reports that show what landed.
Application control in stagesAudit first, then enforced for a pilot group, then everyone. Never left in audit.
Backups tested by restoringA restore is the evidence. A successful job isn't.
Evidence registerScope, setting, test result and review date for each control.

The Australian rule

Even government agencies find Level Two hard.

Commonwealth entities have had to reach Level Two since 1 July 2022 under the Protective Security Policy Framework. ASD reports that 22% reached overall Level Two in 2025, up from 15% in 2024. ASD tightened the Level Two requirements in November 2023.

For a private business it isn't law, but it's the language insurers, tenders and larger clients use. Getting there takes steady work, not a one-off project.

What's changing

The ASD Essentials and your Essential Eight work.

Released 15 October 2026Chapters for enterprise IT, cloud and operational technology.
No changeover dateBoth stay available during the transition.
The work carries overEvery Essential Eight control maps to at least one Essentials principle.
The rating doesn'tASD says maturity ratings don't automatically translate. Evidence is the starting point for a gap analysis.

Keep meeting whatever your contracts and insurer currently name. We'll map your evidence to the Essentials as clients and regulators start asking for it.

When this is the wrong choice

When the Essential Eight isn't the right frame.

You need a certificateThe Essential Eight has none. SMB1001 gives you one, using much of the same evidence.
Your systems are mostly operational technologyFactories and plant need an OT approach. ASD's Essentials has an OT chapter.
You run entirely on SaaS with no devices to manageLook at the ASD Essentials cloud chapter alongside identity and backup basics.

Mistakes we see

Five ways Essential Eight work goes wrong.

Averaging the controlsCalling the business Level Two because MFA is.
Application control stuck in auditAudit isn't control.
Patching only WindowsBrowsers, PDF tools and edge devices get missed.
No MFA on remote accessEmail done, VPN forgotten.
Evidence that's a year oldInsurers ask about now, not the last project.

How we take it on

Our Essential 8 compliance services Australia wide, in four steps.

Step 1Gap check
Each of the eight scored against the model, in plain words.
Step 2Priced plan
What to fix first, how long and what it costs. You decide.
Step 3Do the work
In a set order, with staff told what's changing and why.
Step 4Keep you there
Quarterly checks and fresh evidence for insurers and boards.

One baseline. Plenty around it.

Where Essential Eight work connects to the rest.

Get help your way

Six ways to reach us. Pick whichever suits you.

Helpdesk hours are Monday to Friday, 8am to 5pm AEST. On Advantage and above, emergencies get a response within 1 hour and outages within 2, with 24/7 best-effort escalation.

Questions

What people ask about Essential Eight compliance.

Do we have to do the Essential Eight?

For most private businesses it isn't law. Commonwealth entities must reach Level Two under the Protective Security Policy Framework, and insurers, government buyers and larger clients often ask about it.

Which level should we aim for?

Level One on all eight, with evidence, is the floor. Level Two when a contract, regulator or the data you hold calls for it. Level Three is rarely practical across the board for a small business.

How long does it take?

The gap check takes a few weeks depending on size. Reaching Level One across all eight is usually a few months of staged work, and each stage lowers risk as it lands.

Is the Essential Eight being replaced?

ASD released the ASD Essentials on 15 October 2026. Both stay available during the transition and no changeover date has been set. Every Essential Eight control maps to at least one Essentials principle, so the work carries over, though the ratings don't automatically translate.

How is this different from SMB1001?

SMB1001 is a certification for small business with tiers from Bronze to Diamond, and you get a certificate. The Essential Eight is ASD's technical baseline with no certificate. Much of the evidence overlaps, and we hold SMB1001 Gold ourselves.

How much does it cost?

The gap check and uplift are quoted after a short scoping call, at our project rate of $195 an hour ex GST. You get a priced plan and decide what goes ahead.

Next step

Find out where you stand on all eight.

Talk to an engineer. We'll tell you plainly which controls you have covered, which you don't, and what it takes to close the gap. Our Essential 8 compliance services Australia wide start with that one conversation.

Book a gap check 07 3114 2808