Essential Eight
Essential Eight health check, assessment, uplift or assurance: what are you buying?
Compare an Essential Eight health check, assessment, uplift and assurance review. Understand what each engagement answers and what its scope excludes.
By Lisa Elkner4 min readChoose an Essential Eight engagement according to the decision you need to make: whether to investigate further, establish your current position, implement changes or examine continued control operation.
When comparing proposals, start with the decision you need to make. Then check what work the engagement includes and what its conclusions will support. Similar service names can conceal quite different scopes.
Which Essential Eight engagement fits the decision
| Engagement | Main question | Scope and limits to confirm |
|---|---|---|
| Health check | Where should we investigate further? | Systems and evidence considered. Strategic Cyber’s health check is indicative, not a full Essential Eight assessment or proof of maturity. |
| Assessment | What does the evidence establish within the agreed boundary? | Scope, criteria, evidence and limitations. Implementation is not automatically included. |
| Uplift | What changes will address the agreed gaps? | Implementation responsibilities, client dependencies, validation and handover. Licences alone do not establish implementation. |
| Assurance review | Do relevant controls continue to operate as intended? | Current coverage, operating evidence, changes and exceptions. Assurance is distinct from daily operation. |
A health check helps establish a starting point
Strategic Cyber’s health check is indicative only; it is not a full Essential Eight assessment. Ask which systems and evidence will be considered, what the output will contain and what remains unexamined. Treat the findings at that level of confidence. Do not assume an indicative review establishes an organisation’s maturity or satisfies an external assessment requirement.
An assessment examines a defined position
Documents, interviews, configuration records and testing can each contribute evidence. Their usefulness depends on the question being assessed. Before engaging a provider, ask what will be examined, how gaps will be recorded and which uncertainties may remain. Also confirm whether the output includes recommendations or implementation planning. An assessment does not automatically include making the changes it identifies.
Uplift implements agreed changes
Existing software may support some of that work, but licences alone do not establish implementation. Confirm what the technology can support, what must be configured and who will operate it. A useful uplift scope identifies responsibilities between the specialist, the client and its IT provider, including validation and handover. It should also identify any work the client needs to complete for the project to succeed.
Assurance considers continued operation
Assurance is a different responsibility from running the systems each day. Internal IT or an IT provider may maintain them, while assurance examines evidence of how relevant controls are operating. Uptime and ticket reports have operational value, but may not answer the particular control questions you need resolved. Agree the purpose and scope of any ongoing review rather than assuming it is included in the original project.
Compare proposals against the decision you need
Use the following questions to compare the work being offered.
- What question will this engagement answer?
- Which systems, requirements and evidence are included?
- What conclusions will the output support, and what are its limitations?
- Who implements any changes, and is that work included?
- Who validates completion and takes responsibility for ongoing operation?
- What client time, access or preparation does the work depend on?
Start from what is already known
If you already have assessment findings, share them when discussing scope. If your immediate need is an initial view, explain that too. The appropriate next step depends on your current evidence, business objectives and obligations. Not every organisation needs to purchase each type of engagement in the same order.
Discuss your current position and the decision you need to make with Strategic Cyber’s Essential Eight team.