Australian cybersecurity
If your Essential Eight position is unclear, Kritical turns the maturity model into a scoped technical baseline, visible gaps and a clear remediation sequence across the systems your organisation controls — assessed, not certified, and quoted.
On this page
Jump to the part that matches the problem or decision in front of you.
We identify the users, devices, applications, administrative paths and recovery systems in scope, then compare the observed implementation with the nominated Essential Eight maturity target. Your organisation explains its risk context and business constraints; Kritical records the technical evidence and the work required to improve it.
The controls interact. Application control and patching depend on inventories and ownership. Macro settings and user application hardening affect real workflows. Restricting administrative privileges, multifactor authentication and regular backups need tested recovery and exception paths. We assess dependencies so one improvement does not quietly break another service.
We aim to provide continuity through a consistent lead or delivery group where the agreed scope and service model support it. Your proposal sets out the contact model, cover and handover arrangements that apply.
We review the supplied information, then confirm the scope, written price and expected timing.
A findings document is not an improvement. We scope and price the actual technical work to close each gap.
Every finding names the requirement, the observed state, the evidence and the owner responsible for closing it.
The remediation plan identifies prerequisites, affected users, technical changes, pilot groups, maintenance windows, communications, rollback and evidence to retain. Work may include Microsoft 365, Entra ID, Intune, Windows, application management, privileged access, backup, network or monitoring changes according to the agreed environment.
Deliverables can include a scoped maturity matrix, supporting evidence record, prioritised findings, exception record, remediation backlog, implementation plan, completed technical changes, representative verification and an operating handover. The engagement states which items were assessed, improved, deferred or excluded.
Kritical does not provide certification or an independent government accreditation through this service. Maturity is assessed only for the agreed scope and evidence available. Your organisation retains risk decisions, policy approval and any requirement to appoint an independent assessor.
The first call confirms the systems in scope and the maturity target, and results in a written, scoped price before any assessment begins. In an agreed remediation phase, changes are sequenced around a pilot group and a defined rollback, so the wider fleet only moves once the approach is proven.
The Australian Cyber Security Centre is the source for the current Essential Eight maturity model. We use the version and applicability agreed at the start of the engagement.
Read the current maturity levels and requirements directly from the Australian Cyber Security Centre.
An Essential Eight assessment identifies a maturity position and improvement work. The next specialist path depends on the evidence: control ownership and security remediation, or the performance of the system carrying the control.
Yes, if the boundary and limitations are explicit. The record identifies the users, systems, locations and control components included, and it does not extend the findings beyond that scope.
We can plan and deliver agreed technical improvements toward a nominated target. The plan records dependencies, exceptions and evidence still required rather than promising a result before the environment is assessed.
No. It is a focused mitigation baseline. Broader information, supplier, application, physical, governance and incident risks may require the ISM, NIST CSF, ISO/IEC 27001 or another governing approach.
Environment size, current maturity and the target level change the cost too much for one published number. Send us your environment and you get a written, scoped quote.
There is no independent Essential Eight certification body. Maturity is a self-assessed or third-party-assessed technical baseline against the Australian Cyber Security Centre's model, and Kritical is explicit that this service is assessment and remediation, not accreditation.
Frameworks are useful when they help you decide what to protect, which gaps matter and what evidence should exist.
Kritical assesses configuration, prioritises remediation and implements agreed security improvements across identity, endpoints, networks and infrastructure.
When licences, accounts, email, shared files and devices are difficult to administer together, Kritical brings them into one coherent environment — configured and checked against agreed requirements, with ongoing administration scoped separately as your business changes.
Kritical assesses backup and disaster-recovery arrangements against the systems your organisation needs to restore.
Tell us what you want to achieve, what you have today and when it matters.
