Travis Schultz & Partners
Law firm, Sunshine Coast
efex manages the firm's IT and cyber security in line with the ACSC Essential Eight, with one support model across all its offices as it grew from 5 to more than 70 staff.
Read the case studyEssential Eight assessment: know where you stand and what to fix first.
When your board, insurer or a major client asks how well protected you are, an Essential Eight assessment gives you a clear answer: your maturity level, the gaps that matter most, and a prioritised plan to close them.
ISO 27001 certified · SMB1001 Gold · 14,000+ Australian customers · 24x7 SOC
01 // The Essential Eight
Eight controls that make you much harder to attack
The Australian Signals Directorate's Australian Cyber Security Centre (ACSC) recommends these eight mitigation strategies as a baseline for every organisation.
- Control 01
Patch applications
Closes the known holes attackers scan for
- Control 02
Patch operating systems
Keeps outdated, exploitable systems off your network
- Control 03
Multi-factor authentication
A stolen password alone won't get them in
- Control 04
Administrative privileges
Limits how far an attacker can get
- Control 05
Application control
Stops unapproved and malicious programs running
- Control 06
Microsoft Office macros
Blocks a common way malware arrives by email
- Control 07
User application hardening
Shuts down risky features in browsers and apps
- Control 08
Regular backups
Recover fast if ransomware hits
02 // Maturity levels
Measured in maturity levels, not a pass or fail
The ACSC measures each control against maturity levels from zero to three. Each level defends against more capable attackers. Most organisations start by reaching Maturity Level 1 across all eight controls, then build towards Maturity Level 2.
Maturity Level 0
Weaknesses in the controls that leave the organisation open to common attacks.
Maturity Level 1
Protection against opportunistic attackers using widely available tools.
Maturity Level 2
Protection against attackers willing to invest more time and effort.
Maturity Level 3
Protection against more capable, adaptive attackers.
03 // The assessment
What you get from an assessment
We review your IT environment against the Essential Eight and give you a clear, actionable report tailored to your environment.
What we look at
Your workstations and servers
How key systems are configured, patched and protected, including operating system updates, administrator rights and installed applications.
Your Microsoft 365
The security settings across email, Teams, SharePoint and OneDrive, including multi-factor authentication, sharing permissions and account recovery.
Your internet-facing assets
Your domains, public IP addresses and online services, to find anything exposed or forgotten that an attacker could see from outside.
How your team works
A short conversation about how your people access systems, back up data and respond to incidents, because strong technology still fails if everyday habits don't hold up.
What you get
Your maturity level
Where you stand today across each of the eight controls.
Your key gaps
The weaknesses that leave you most exposed, explained without jargon.
A prioritised roadmap
What to strengthen first, so effort goes where it reduces the most risk.
Until 30 November 2026 this assessment is available as a free cyber security audit.
04 // After the assessment
Reach and keep your target maturity level
Every efex Managed Cyber plan is built around the Essential Eight. Managed Cyber Essentials and Premium are informed by or aligned with Maturity Level 1, and Managed Cyber Apex is aligned with Maturity Level 2 and includes an Essential Eight gap analysis assessment and report.
Compare managed security plans05 // Why efex
Trusted by more than 14,000 Australian businesses.
14,000+
customers across Australia
400+
staff, including 140+ technicians
25+
locations nationally
24x7
security operations centre protecting your business
We hold ourselves to the highest security standards.
efex is independently audited, with 90+ security controls monitored around the clock.
View our certifications at trust.efex.com.au- ISO/IEC 27001:2022 certified
- CyberCert SMB1001 Gold
- Essential Eight aligned
- Microsoft Solutions Partner
Organisations that rely on efex every day
06 // FAQ
Questions, answered.
The Essential Eight is a set of eight mitigation strategies published by the Australian Signals Directorate's Australian Cyber Security Centre. Together they form a baseline that makes it much harder for attackers to compromise your systems.
Find out how you measure up.
Start with a free cyber security audit or the 3-minute self-check. You'll see your gaps and what to fix first.
Free audit offer ends 30 November 2026