What Does Essential Eight Compliance Actually Cost?
By Andrew McDowell
Search for what Essential Eight compliance costs and you will find ranges so wide they are useless. Five thousand dollars. A hundred and fifty thousand. Both are true somewhere, and neither helps if you run a fifteen-person business and a client has just asked you to prove your security position.
The range is that wide because "Essential Eight compliance" is not one purchase. It is four, and they get bundled into a single question that nobody can answer without knowing which one you mean.
Here they are separately, with our own prices stated in full.
Why nobody gives you a straight answer
Vendors avoid the number because their answer genuinely depends on your size, your systems and how much of the work you want to do yourself. Consultants avoid it because scope varies. Neither is being evasive.
But the effect is the same: you leave without a number, and you cannot budget for something you cannot price.
There is a second reason worth naming. The largest compliance platforms publish detailed explainers about what compliance costs while publishing nothing at all about what they cost; five tiers behind a demo request and a feature matrix. If you are a small business, sitting through an enterprise sales cycle to discover a price, this is not a reasonable ask.
So, let us present to you the four cost point considerations, in the order you meet them.
Cost one: finding out where you stand
You cannot plan against a position you have not established. There are three ways to establish it, and the cheap ones are genuinely useful.
Do it yourself. The Essential Eight is published by the Australian Signals Directorate and it is free to read. Forty-eight controls at Maturity Level One, across eight strategies. Cost: your time.
Use a guided self-assessment. You work through the controls yourself, but the structure, the questions and the record-keeping are done for you. Cost: a subscription. We address this in its own section below.
Bring someone in. A consultant works through it with you and produces the report. Cost: a fixed fee, scoped to your business.
If you have never looked at any of this, start with our Free Office IT Security Check. About twenty questions, three minutes, no account and no sales call. It will not make you compliant and it does not pretend to. What it will tell you is whether this is a three-week problem or a three-month one, which is the thing you need before you can budget at all.
One honest caveat about doing it yourself, because it is the part people underestimate. The constraint is not knowledge. Anyone can read the forty-eight controls and form a view. The work is evidence. Proving each control is true, on a date, in a form that survives somebody asking "how do you know?"
That is the difference between believing you are compliant and being able to show it. It is also the entire reason the second and third options exist.
Cost two: the platform
Here are our numbers. They are also on our pricing page, and they are in four currencies there. Our solutions have a global fit, but we've put the figures below in Australian dollars.
Essential Eight compliance in our platform is A$74.99 per company, per month. That covers a guided self-assessment across all forty-eight Maturity Level One controls, unlimited assessments for each licensed company, evidence from your website scans attaching itself to the controls it covers, and a signed report with a shareable link.
But you should not budget A$74.99, and here is why.
Essential Eight sits on top of our Business plan rather than replacing it. Business is A$13.99 per website per month, with a four-website minimum. So the smallest configuration that can actually run an assessment looks like this:
- Business plan, four websites at A$13.99 each — A$55.96 per month
- Essential Eight, one company licence — A$74.99 per month
- Total — A$130.95 per month
That is about A$1,571 a year, excluding tax. Your first Essential Eight company licence includes a fourteen-day free trial, so the compliance half starts at zero.
We publish that sum rather than the licence price on its own because you would work it out eventually, and finding out at checkout is not a good way to meet a supplier. Doing the arithmetic for you costs us nothing and tells you something useful about how we operate.
Cost three: remediation, and the part nobody quotes
This is usually the largest cost and it is almost never in anyone's estimate. It is also where the good news is.
For most small businesses, the majority of Maturity Level One is configuration, not procurement. Multi-factor authentication. Macro settings. Restricting who has administrator rights. Keeping things patched. Hardening the applications you already run. These are settings and habits, not purchases.
We say it plainly on our consulting pages: most businesses we look at are already paying for security they are not using. If you are on Microsoft 365 Business Premium you already own a significant share of what Maturity Level One asks for, and a good deal of it has never been switched on.
Not all of it, and we will not pretend otherwise. Some capabilities people assume are included sit in higher licence tiers. But the gap between what you own and what you have enabled is usually wider than the gap between what you own and what you need to buy.
The exception, and it is a real one: application control. Restricting which programs are allowed to run is the control that most often cannot be closed cheaply by a small business. It needs tooling, and more importantly it needs someone to maintain the list as your business changes. If anyone tells you Maturity Level One is entirely free to reach, this is the control they have not thought about.
Backups are the other one worth watching. Most businesses have them. Far fewer have ever tested a restore, and an untested backup is not a control, it is a hope. That costs discipline rather than money.
Cost four: keeping it current
An assessment describes where you stood on a particular day. That is not a limitation to apologise for; it is what an assessment is. A dated position is exactly what a client, an insurer or a tender panel is asking you for.
But the position moves underneath you. People join and leave. Somebody buys a laptop. A new tool arrives that nobody logged. A supplier changes how they connect to you. The controls do not decay evenly, and the ones that lapse quietly are rarely the ones you are watching.
Whoever asked you for evidence will ask again, and they will want something recent. So the fourth cost is the ongoing one: keeping the record alive, closing gaps as you find them, and being able to reassess without starting from a blank page.
That is what the subscription is for. Not a dashboard to admire, a record that stays current between the moments someone demands it.
What we charge
The platform: the figures above. Published, four currencies, no quote required.
Consulting: a fixed fee, scoped to the size and complexity of your business, and agreed before the work starts. All software tooling is included for the engagement.
If you want the compliance platform and the website testing to keep running afterwards, they continue as subscriptions at the published prices. No re-quote, no separate negotiation, and you can stop whenever you like. We would rather you knew the follow-on cost before you booked the engagement than discovered it at the end of one.
Where to start
If a client, an insurer, a tender or your board has asked, and that is almost always what brings people to this question, the cheapest useful next step is to find out where you actually stand.
Take the free check. Twenty questions, three minutes, no account. Then you will know which of these four costs you are actually facing.
Biz Secure Online is an Australian business. Our Essential Eight product is a guided self-assessment at Maturity Level One; reports state plainly that you assessed yourself, and are informed by the ASD's Essential Eight Assessment Process Guide. Essential Eight is not a certification scheme. No organisation, including ours, can certify you against it. If you need an assessment carried out by somebody other than yourself, that is a consulting engagement, and we can talk to you about one.