What is the Essential Eight?

The Essential Eight is a set of eight baseline mitigation strategies from the ASD's Australian Cyber Security Centre (ACSC). It is the recommended baseline for protecting organisations against the most common cyber threats — ransomware, phishing, data breaches and unauthorised access. Maturity is measured across three levels: ML1, ML2 and ML3.

How much does Essential Eight compliance cost for a small business?

Consultants typically quote $5,000 to $15,000 for a single Essential Eight assessment. CyberSmart360 provides the assessment, AI-powered analysis and a 12-month remediation plan from $49 per month during the founding-member launch.

Do I need cyber security expertise to assess the Essential Eight?

No. CyberSmart360 rewrites every Essential Eight control in plain language with examples from your industry. If you can answer questions about how your business uses technology, you can complete the assessment.

Is Essential Eight compliance mandatory in Australia?

It is mandatory for Australian Government agencies. For private businesses it is not legally required, but it is increasingly expected by government contract managers, cyber insurers and supply-chain partners. The ACSC recommends that every Australian organisation implement the Essential Eight.

How long does an Essential Eight assessment take?

Most people finish their first assessment in under two hours. The assessment auto-saves every 30 seconds, so you can stop and resume at any time. AI-powered results arrive about 60 seconds after you submit.

For Australian small businesses. No cyber security expertise needed

CyberSmart360 is a self-service cyber security compliance platform built for Australian businesses. Assess your business against the ACSC Essential Eight or the ACSC Security Principles, get a plain-language action plan, and generate audit-ready — from $49/month during our founding-member launch, and it’s built for Australian small businesses with no security background required.

Built for Australian small businesses. No cybersecurity expertise required.

Complete your first assessment in under 2 hours

See how it works →

Australian data residency · No credit card required

Written for Your Industry, Not for an IT Department

Cybersecurity framework like the Essential Eight was written with government departments and larger organisations in mind, and the language shows it: technical, dense, and assuming you’ve got a dedicated IT security team down the hall. Most small businesses don’t.

CyberSmart360 rewrites every control in plain language, tailored to your industry. When you run an assessment, the questions, examples and tips are framed around how your business actually operates, not how a government agency runs.

Take one control: user application hardening. In the framework it reads something like configure web browsers to block web advertisements and stop them running legacy plugins from the internet. Here’s how we ask the same thing.

A plumbing business: Do your office computers block pop-up ads and stop old browser add-ons from running? Think about your apprentice looking up parts on the workshop PC — could a dodgy pop-up quietly install something?
An accounting firm: Are your team’s browsers set to block ads and disable outdated add-ons? For example, when staff log into client portals or ATO Online services, are those sessions protected from malicious browser content?
A GP practice: Are the browsers on your practice computers blocking pop-ups, ads and old add-ons? Think about reception accessing My Health Record or lodging Medicare claims online — are those sessions protected?

How It Works:

Industry-specific language. We don’t just strip out the jargon. We rewrite each control using the tools, terms and situations your industry deals with every day. A plumber gets plumbing examples; an accountant gets accounting ones.
Real-world analogies. Every control comes with an analogy that connects the security concept to something your team already gets. “Application control” becomes “only approved tools on the work truck” for a tradie, or “only authorised software on the practice network” for a GP.
Tips you can actually act on. Each control includes practical steps sized for your business, not enterprise recommendations with a six-figure price tag. Things you can genuinely get done this week.

Getting compliant shouldn't cost more than your car

There’s real pressure on small businesses right now.

Some government tenders and contracts now ask suppliers to show they meet the Essential Eight or the ISM before they’ll sign.
Many cyber insurers want to see evidence of basic controls — multi-factor authentication, regular patching, tested backups — before they’ll issue or renew a policy, and some point specifically to the Essential Eight.
The cost of an incident keeps climbing. The ASD’s most recent Annual Cyber Threat Report (2024–25) puts the average self-reported cost of cybercrime for a small business at $56,600 per report.

And the usual fix is expensive. Consultants typically quote $5,000 to $15,000 for a single Essential Eight assessment. For some businesses that’s a quarter of the annual IT budget, gone in a week.

There’s also the wait: weeks to get on a consultant’s schedule, then more weeks for the report to land, while your tender deadline or insurance renewal ticks closer. And when it arrives, the report often reads like it was written for someone else. “Application control” and “macro hardening” don’t mean much to a builder or an accountant.

Consultants charge $5,000–$15,000 for a single Essential Eight assessment. That’s a quarter of some businesses’ annual IT budget — gone in a week.

Frameworks are written in technical language designed for enterprise IT teams. “Application control” and “macro hardening” mean nothing to a builder or accountant.

Waiting weeks for a consultant’s schedule, then more weeks for the report. Meanwhile, your contract deadline or insurance renewal is approaching.

There's a better way — and it starts with doing it yourself.

From sign-up to a remediation plan in under 2 hours

CyberSmart360 walks you through your chosen framework step by step, turning each technical control into language your team can follow. The AI reviews your answers against the maturity model and builds a remediation plan to match. No jargon, no guesswork.

Answer Guided Questions

Work through the step by step assessment wizard at your own pace. Every question is in plain language with examples from your industry. It auto-saves, so you can close the laptop and pick up right where you left off.

Get Your AI-Powered Analysis

Submit your assessment and get your compliance score, maturity level and gap analysis in a few minutes. No waiting on a consultant to write it up.

Follow Your 12-Month Action Plan

You receive a prioritised roadmap with cost estimates, timeframes, and a clear split between what you can do yourself and what's worth handing to a professional. Track your progress as you work through it.

$56,000

Average cost of a cyber incident to Australian small businesses (source: ACSC)

Every 6 minutes

How often a cybercrime is reported to the ASD (ASD Annual Cyber Threat Report 2024–25)

Under 2 hours

To complete your first assessment

~120 seconds

From submitted assessment to your AI compliance analysis

Everything you need to get compliant — and stay that way

Plain-Language Assessments

Technical controls translated into everyday English, with industry-specific wording so a plumber, an accountant and a practice manager all know exactly what's being asked.

AI-Powered Remediation Guides

Every gap comes with a step-by-step how-to: what to fix, in what order, whether it's a job you can do yourself, and roughly what it'll cost.

Audit-Ready Reports

Generate a professional PDF compliance report in under 30 seconds — ready for government contract submissions, cyber insurance applications, or board and management reporting.

Progress Tracking

Watch your compliance score change over time, see which tasks are done, in progress or still outstanding, and where your biggest risks sit.

Explore all features →

Stop Guessing. Start Getting Compliant.

Join the Australian small businesses using CyberSmart360 to take charge of their cyber security compliance. Run your first assessment free for 7 days. No credit card, no commitment.