Insights from CYBORIUM

Essential Eight changes: what to test before you commit

ASD has confirmed the direction of Essentials for enterprise IT. The detailed controls are not yet final. Procurement decisions made now still need clear scope, usable evidence and room to adapt.

Discuss your evaluation Read the full ASD update
Independent by designThe client pays no fee to CYBORIUM.The selected provider pays a capped fee.The client contracts directly with the provider.

The position now

Confirmed direction. Unconfirmed detail.

ASD says the current Essential Eight will evolve into the first chapter of a broader Essentials series, grounded in the Information Security Manual and supported by practical tools and clearer implementation guidance.

ASD has not published the final controls, assessment tests, maturity model or transition timetable. Continue using the current Essential Eight baseline and avoid purchasing against requirements that do not yet exist.

View the ASD consultation update

What CYBORIUM is seeing

The market signal is not the decision.

These are recurring procurement patterns, not universal rules. They are useful because each one changes the questions an organisation should ask.

Level 2 scope is often blurred

Assessment, remediation, licences and managed services are frequently combined. A single headline price can conceal which outcomes are actually included.

Ask for a fully separated scope and price.

“Free” assessment can carry lock-in

An included assessment may lead directly into a multi-year managed service. The assessment price is not the only commercial decision.

Test the exit path before the entry price.

External deadlines weaken negotiating position

Insurance, customer and supply-chain requirements can compress timelines. Urgency increases the need for disciplined requirements.

Fix the outcome before approaching the market.

Evidence ownership is fragmented

Control proof often sits across internal teams, cloud platforms and providers. A maturity claim is only as useful as the evidence an organisation can retain and test.

Define evidence form, access and ownership.

Six procurement tests

Questions that expose avoidable cost and risk

The public version gives you the questions. CYBORIUM’s full evaluation adds weighted criteria, provider evidence, commercial comparison and a defensible recommendation.

  1. 01

    Is the target fixed?

    Name the maturity level, assessment boundary, included systems and evidence that constitutes completion.

  2. 02

    Is the price fully loaded?

    Separate assessment, remediation, licensing, implementation, monitoring and internal effort.

  3. 03

    Who validates the gaps?

    If one party assesses and remediates, define the independence check before approving uplift spend.

  4. 04

    Does scope follow risk?

    Confirm scope reflects system criticality and control outcomes. Endpoint or user counts alone are insufficient.

  5. 05

    How is maturity maintained?

    Set re-assessment timing, evidence refresh, remediation obligations and the cost of proving maturity again.

  6. 06

    Can the organisation exit cleanly?

    Confirm data portability, log retention, tool ownership, transition support and termination rights.

What good looks like

A decision record, not a vendor shortlist.

RequirementsPrioritised outcomes, scope and evidence expectations.

Market comparisonSuitable providers tested against the same criteria.

Commercial clarityComparable total cost, dependencies and contract terms.

GovernanceA recommendation leaders can challenge and defend.

The engagement boundary

The insight is public. The evaluation is built around your environment.

This page helps you recognise the right questions. The full CYBORIUM evaluation maps them to your systems, obligations, target maturity, provider evidence and commercial position.

Essential Eight evaluation questions

Should organisations stop implementing the current Essential Eight?

No. ASD has indicated strong alignment with existing controls and investment. Continue using the current Essential Eight guidance until final Essentials for enterprise IT requirements and transition arrangements are published.

What should be fixed before requesting proposals?

Set the target maturity level, assessment boundary, priority systems, evidence requirements, responsibility model and commercial scope. This makes provider responses comparable.

Should the same provider assess and remediate?

It can be efficient, but the potential conflict should be visible. Define an independent review or evidence-validation step before approving remediation spend.

What does CYBORIUM provide beyond this page?

CYBORIUM creates the requirement set, evaluation criteria, provider comparison, evidence record, commercial benchmark and negotiation pathway for the organisation’s actual environment.

Bring the evidence behind the quote.

CYBORIUM does not sell, deliver, operate, manage or invoice technology. We help your organisation evaluate the market and contract directly with the selected provider.

Discuss an Essential Eight evaluation How guided evaluations work