Essential Eight & NIST CSF
Cube Cyber assesses and uplifts Australian organisations against the ASD Essential Eight and aligns security programs to the NIST Cybersecurity Framework, honest maturity ratings, costed uplift plans and hands-on implementation, not just a scorecard. Together the two frameworks answer the questions boards and government stakeholders actually ask: are the baseline controls in place, and is the overall program sound.
Book An Essential Eight Assessment
These engagements begin where frameworks meet reality:
The natural moments are before a maturity claim has to be made externally, in a tender, to an agency, to an insurer, before budget season, when a costed uplift plan turns a vague ask into a fundable program, and after significant environmental change, since maturity ratings age quickly. With the ASD's announced evolution of the Essential Eight into the Essentials series, there is also a transition reason: a well-evidenced maturity position now is the strongest baseline to carry into the new framework.
Core capabilities & deliverables
Essential Eight maturity assessment
Assessment against the current maturity model using operational evidence, configuration, logs and observed practice, not vendor dashboards. You receive the maturity level you actually hold, per strategy, with the gaps to the target level made explicit.
Uplift planning and implementation
A prioritised, costed uplift plan sequenced by risk and effort, then hands-on implementation support across the eight strategies, patching, application control, macro settings, hardening, admin privilege, MFA, backups, drawing on our architecture and managed security practices where the work is technical.
NIST CSF current and target profiles
Assessment against the NIST Cybersecurity Framework and development of a target profile, giving executives a defensible, widely recognised way to measure and communicate security posture over time, and to frame investment decisions.
Framework integration
One body of evidence serving multiple masters: Essential Eight maturity, NIST CSF profile, ISO 27001 controls and insurer questionnaires, mapped once rather than assembled separately for each audience.
Ongoing maturity management
Maturity is a state, not a certificate, and it decays. We provide periodic reassessment and drift monitoring, aligned with our managed services where clients want the controls operated as well as measured.
Essentials series transition readiness
With the ASD evolving the Essential Eight into the Essentials series, we help organisations preserve and map their maturity investment into the new structure as guidance lands, so the transition is a translation exercise rather than a restart.
Assessment and uplift engagements follow four stages:
Assess
Evidence-based assessment of each strategy at the target maturity level, with findings that distinguish what is implemented, partially implemented and absent.
Build
A costed, sequenced uplift plan, quick wins first, structural work staged, expressed so it can go straight into budgeting and project planning.
Uplift
Implementation alongside your team, with the discipline the strategies actually require, application control that is enforced, backups that are tested, privilege that is genuinely restricted.
Sustain
Reassessment, drift monitoring and evidence maintenance, so the maturity level claimed is the maturity level held, continuously.
Work aligns to the ASD Essential Eight maturity model and ISM, and the NIST Cybersecurity Framework. Worth noting: the ASD has announced the Essential Eight will evolve into the new Essentials series, with deprecation expected from 2027, current maturity investment carries forward, and we design uplift programs with that transition in view.
NIST Cybersecurity FrameworkFrequently asked questions
The ASD's eight baseline mitigation strategies for Australian organisations: patch applications, patch operating systems, multi-factor authentication, restrict administrative privileges, application control, restrict Microsoft Office macros, user application hardening, and regular backups. Each is assessed at maturity levels, and together they block the attack techniques most commonly seen against Australian organisations.
It depends on your threat profile and obligations: Maturity Level Two is the benchmark most government-aligned contracts and frameworks reference, while organisations facing more capable adversaries target Level Three. The honest answer comes from your risk context, and we advise on the target as part of assessment rather than assuming the highest level is automatically right.
It is evolving. The ASD has announced the Essential Eight will transition into a new Essentials series, with deprecation expected to begin around 2027 and the Essential Eight remaining the live, assessable baseline until then. Existing maturity investment carries forward, the underlying controls remain sound, and a well-evidenced position now is the strongest starting point for the transition.
They answer different questions and work best together. The Essential Eight is a prescriptive technical baseline, what to implement; NIST CSF is a program-level framework, how the whole security function is organised and measured. Australian organisations commonly run the Essential Eight inside a NIST CSF or ISO 27001 program structure, and we map the evidence so it serves both.
Because tooling reports settings, not operation. Application control that runs in audit mode, backups that have never been restored, and MFA with legacy exceptions all look implemented on a dashboard and fail at assessment, or worse, during an incident. An evidence-based assessment tells you the level you would defend in front of an agency, an insurer or an attacker.
Both, and the combination is the point. Assessment without implementation capability produces reports; our architecture, engineering and managed security practices deliver the uplift itself, application control, privileged access, backup integrity, hardening, and then keep it operating so next year's assessment is boring.
We're here to help.
Talk to a practitioner, not a call centre. Tell us what you're trying to solve and we'll come back to you within one business day. If you're dealing with an active incident, call us directly.
Send us a message
Tell us what you're trying to solve and we'll get back to you within one business day.
We use the details you provide to respond to your enquiry. Your information is stored in our Microsoft 365 environment and handled in line with our Privacy Policy, which explains how to access or correct it and how to make a complaint.