Frameworks · Essential Eight
Coming soonEssential Eight maturity readiness
Essential Eight readiness is coming soon to TrustProof: it will take you through the eight mitigation strategies of ASD's Essential Eight Maturity Model at each maturity level, against the target level you choose. There is no Essential Eight certification: you or an assessor you engage rate your maturity, and TrustProof will keep the evidence for that assessment.
Key facts
What you can check
- Eight strategies, three levels
- Each strategy at Maturity Levels One, Two and Three, from application control to regular backups.
- Target maturity level
- You will choose a target level when the programme starts. Levels above your target can be set aside with a written justification; nothing at or below it can.
- AWS evidence, honestly scoped
- The Essential Eight is written for Windows-based networks, so read-only AWS checks (MFA, administrator access, patching coverage, backups) give part of the picture, not all of it.
- Model version
- Follows the November 2023 Maturity Model. ASD is consulting on an Essentials series to follow it; TrustProof will update the library when ASD publishes.
- Read-only AWS role
- TrustProof connects through a read-only IAM role you create from our CloudFormation template and can remove at any time. No passwords, no stored keys.
- Hosted in AWS Sydney
- TrustProof runs on AWS in the Sydney region (ap-southeast-2), encrypted at rest and in transit.
What TrustProof does
- Will walk you through each strategy and level with plain-language questions
- Will record your target maturity level and the justification for any level you set aside
- Will track patching, backup restore tests and privileged access reviews with review dates
- Will collect AWS evidence through a read-only role
- Will give your assessor their own dashboard, with two-step verification
What TrustProof doesn't do
- TrustProof does not certify, and there is no Essential Eight certification.
- It does not choose your target maturity level and is not legal advice.
- TrustProof is not affiliated with or endorsed by the Australian Signals Directorate.
FAQ
Frequently asked questions
Is there an Essential Eight certification?
No. ASD publishes the Maturity Model and an assessment process, but does not certify organisations. You assess yourself, or engage an assessor who follows the assessment process.
Which maturity level should we aim for?
Your organisation decides, based on the threats you face and what your customers, contracts or government obligations ask for. Commonwealth entities should check their PSPF obligations.
Is the Essential Eight being replaced?
ASD consulted in mid-2026 on an Essentials series to follow the Essential Eight. Until ASD publishes it, the November 2023 Maturity Model is the current version, and TrustProof follows it.
How much can the AWS scan show?
Some of it. The read-only AWS checks cover MFA, administrator access, patching coverage and backups in your AWS account. Workstations, Microsoft Office and email need their own evidence.
When will Essential Eight readiness be available?
It is coming soon. The free read-only AWS scan and One-Button Fix are available today. Talk to us if you would like to hear when it opens; this page will be updated when it does.
What does it cost?
The first AWS scan is free. One-Button Fix is A$1,499 one-off. Plans are a one-off Readiness Programme plus Continuous Monitoring from A$899 a month. All prices are in Australian dollars and include GST.