Essential Eight implementation cost: what drives it

What does Essential Eight implementation cost, and why does it vary so much?

There is no published price for an Essential Eight uplift, and no ASD certificate to buy. The cost is set by the maturity level you are targeting and the systems in scope, so a board or contract deadline to reach Maturity Level Two or Three is a scoping decision before it is a budget line. The Essential Eight is a set of mitigation strategies, and maturity is shown through assessment of each strategy's implementation and effectiveness, so what you pay for is the work to implement the controls and the evidence that an independent assessor will test. DeployOpen quotes from a written scope and does not publish prices. Your organization owns its controls, and only an independent assessor issues a conclusion on maturity.

The control count shows how the work grows. In the ISM v2026.09.4 Essential Eight profiles, ML1 contains 46 controls, ML2 contains 87 and ML3 contains 123. Moving to ML2 adds 41 controls, much of it centralized event logging, log protection, analysis and incident reporting, so a central log platform becomes a prerequisite and a recurring cost. Moving from ML2 to ML3 adds 39 controls and replaces 3 (ISM-1691, ISM-1695 and ISM-1873) with stricter versions, bringing in driver and firmware patching, just-in-time administration, Secure Admin Workstations and backups that even backup administrators cannot change during retention. Ask any quote to show which profile controls are in scope and how each one maps to a system, team or licence.

Quotes vary most on four line items: licensing for application control, logging and endpoint tools, the people and process work, and ongoing monitoring after the assessment. Application control at ML1 can be met with AppLocker, but Microsoft's guidance says ML2 and ML3 require Windows Defender Application Control, and the logging of allowed and blocked events adds endpoint and SIEM licensing. Ask for each licence named, whether it is one-time or annual, and who pays for it. Recurring review tasks also carry cost. Application control rulesets must be validated at least annually from ML2 (ISM-1582), and the Microsoft Office trusted publisher list at least annually at ML3 (ISM-1676). Confirm with your own licensing advisers and vendors which tools you already hold before you ask for a fixed price.

Which costs are one-time, which recur, and who gets paid for each

This table lists each cost component of an Essential Eight uplift, who is paid for it, whether it is one-time or recurring, and the main driver. Read it as a checklist for asking quotes to separate fixed implementation work from licences and standing reviews. The main takeaway is that most of the recurring cost comes from licences and from annual review tasks that continue after the assessment.

Cost component	Who is paid or who bears it	One-time or recurring	Main cost driver
Internal staff time	The organization's own staff, paid through existing payroll	Both: one-time during uplift, then recurring for reviews	Number of systems in scope and how many teams must change process
Implementation partner work	An external partner paid under a written, fixed scope	One-time for configuration, documentation and evidence preparation	Target maturity level, estate size and how much existing tooling is reused
Application control licensing	Software vendor or reseller, depending on the licence model	Usually recurring, billed per licence term	Whether the platform must support WDAC-level control at ML2 and ML3
Endpoint and logging tools	Tool vendors, or the organization for self-hosted open-source platforms	Recurring for subscriptions and hosting, one-time for setup	Volume of events retained and the log analysis required at ML2
Backup platforms and storage	Backup software vendor and the infrastructure or cloud provider	Recurring for storage and capacity, one-time for design	Retention periods and whether immutable storage is needed at ML3
Independent assessment	The independent assessor, not the implementation partner	Typically one-time per assessment cycle, repeated over time	Scope of systems sampled and the evidence the organization has ready
Ongoing monitoring and review	Internal owners, a managed service provider, or a retained partner	Recurring	Annual ruleset and trusted publisher reviews, drift checks and patch cadence

What pushes the cost up or down

Essential Eight cost is set less by the eight strategies than by the target level, the size of the estate, and what the organization already owns. Each card below names one driver, what it does to the bill, and the decision that keeps it under control.

Target maturity level

The ISM baseline profiles hold 46 controls at ML1, 87 at ML2 and 123 at ML3, so ML2 roughly doubles the ML1 set. Every ML1 control is also in ML2, which means ML1 work is not thrown away when you move up. Set the target level in writing before scoping, and confirm whether the business actually needs ML2 or ML3 or whether a contract or regulator names a level. Sequencing ML1 first lets you spend on the higher-cost items only once the foundation is stable.

Central logging at ML2

Moving to ML2 adds 41 controls, much of it centralized event logging, log protection, analysis and incident reporting. A central log platform is a prerequisite, so this is often the largest new spend for organizations without a SIEM. Ask whether existing logging can be extended, how many endpoints and servers feed it, and how much retention the business needs. Open-source log platforms can reduce licence cost, but they shift effort to the team that deploys and tunes them.

Application control licensing

Application control is where licensing most often surprises teams. Microsoft's guidance says ML1 can be achieved with AppLocker, while ML2 and ML3 require Windows Defender Application Control, which can change which Microsoft licences apply. Confirm with your vendor which licence tier covers WDAC, endpoint detection and log capture in your tenant before buying. Reuse what you already own where the vendor confirms it in writing, and price the gap separately.

Endpoint and server count

Patching, application control, hardening and backups are all priced per managed asset, so the number and type of endpoints and servers drive both tooling and labor. Count assets by class: workstations, servers, drivers and firmware on hardware, and cloud workloads. ML3 patching of drivers and firmware and the Secure Admin Workstation model add effort per device. Retire unsupported systems before the assessment, because replacing them is usually costlier than patching them.

Patching and backup starting point

The current state of patching and backups sets the remediation effort. An estate with a documented inventory, regular scan cycles and tested restores needs configuration work. An estate without those needs discovery, scanning baselines and restore testing before any control can be evidenced. Ask the implementation partner to report the gap by strategy and to confirm which backup tooling already produces immutable copies, because immutability at ML3 is often the costliest backup change.

Third parties and locations

Each location, managed service provider and SaaS vendor that administers or stores your systems widens the scope. Privileged access held by a provider must be validated and monitored like internal access, and provider-run logs must reach your central platform. Ask each provider to state which Essential Eight controls it runs, which it only supports, and which it does not touch. Clear responsibilities in the contract prevent duplicate tooling and gaps at the boundary.

Why application control and central logging drive licence spend

Application control and central logging are where licence spend most often rises during an Essential Eight uplift, because the tooling each level needs is not the same. Microsoft's guidance says Maturity Level 1 application control can be achieved with Microsoft AppLocker, while Maturity Levels 2 and 3 require Windows Defender Application Control (WDAC) because of the additional ISM requirements. Moving from AppLocker to WDAC is a configuration and policy effort, but it also determines which endpoint and management licences the organization must hold on its devices.

Central logging is the larger driver at ML2. The ISM profiles add 41 controls when moving from ML1 to ML2, much of it centralised event logging, log protection and analysis, and incident reporting, so a central log platform is a prerequisite. ISM-1660 covers the logging of allowed and blocked application control events, which means the platform must ingest those events from every in-scope endpoint and server. Microsoft's guidance uses Defender for Endpoint P2 with Windows event logs captured in Microsoft Sentinel and Microsoft Defender XDR as one reference design. Ask your vendor and your Microsoft account team which licences that design needs, how log ingestion is billed, and how retention affects the price. Also check the Microsoft 365 License Maps portal, which summarises licences by maturity level, but confirm entitlements against your own agreement, because the maps are a community project by Microsoft employees and not official Microsoft documents.

An open-source or self-hosted logging platform can replace some or all of the licensed design, but it is a choice to test rather than a default. Confirm that the platform can collect application control events, protect and analyse logs as ML2 expects, and support incident reporting before you remove licence costs from the plan. Its costs then move to storage, hosting, engineering time and the ongoing work of keeping collectors and rules current. Ask the implementation partner to map each ML2 logging control to the component that satisfies it, so that licence decisions follow the controls rather than the other way around.

How an uplift moves from gap assessment to sustained maturity

The sequence turns a chosen maturity target into a costed plan, implemented controls, documented processes and evidence that an independent assessor can test, then keeps that position through recurring reviews. Each phase has a defined output, so the organization can see where cost is being spent and what it has bought.

Scope the target level against the ISM profiles
The organization decides which maturity level it needs, then maps that level to the matching Essential Eight baseline profile in ASD's Information Security Manual (ISM) OSCAL release. ML1 contains 46 controls, ML2 contains 87 and ML3 contains 123 in the v2026.09.4 profiles, so the target level alone sets the size of the work. The output is a written scope naming the systems, business units and user populations in or out of the assessed boundary. Confirm with the sponsor who signs off the scope, since a narrow boundary reduces cost but can leave gaps that an assessor will question.
Run the gap assessment against each control
Staff or a consultant compare the current state of each strategy against the controls in the chosen profile, using configuration exports, patch and vulnerability reports, privileged account listings and sample backup restores. The gap assessment records, for every control, whether it is met, partly met or missing, and what evidence exists today. The output is a control-by-control gap register. Ask any partner to show a sample of the register before work starts, so the format is clear and the findings trace back to specific systems.
Build a costed remediation plan
Each gap is grouped into work the organization can do with existing licences and staff, work that needs new tools, and work that needs people or process changes. The plan prices each group, separates one-time items such as deployment and policy drafting from recurring items such as licence renewals and annual ruleset reviews, and identifies who pays for what. The output is a sequenced, costed plan approved by the business owners. Request that the quote itemize licences, labour and any managed service fees separately so the recurring portion is visible.
Implement the technical controls
Engineers deploy and configure the technical measures in the plan, such as patch tooling, application control policies, multi-factor authentication, privileged access separation, user application hardening and backup immutability. At higher levels this also includes central event logging, which the ISM profiles make a prerequisite for ML2. The output is a configured environment with change records and test results for each control. Confirm which controls will run in the organization's own tenant or data centre and which will depend on a provider's service, because that determines who maintains them later.
Document the process controls
Process controls cover the procedures, roles and records that the technical controls depend on, including patch deadlines, privileged access requests, backup test restores, incident handling and approvals for application control exceptions. Staff write or update these documents and train the people who run them. The output is an approved set of procedures with named owners and review dates. An assessor will test whether people follow these procedures, so the documents should describe what actually happens in the environment.
Collect and organize the evidence
The organization gathers evidence that each control operates over time, not only that it was configured once. Typical evidence includes scanner reports, central log samples, access review records, change tickets, restore test results and exception approvals, mapped to the control identifiers in the profile. The output is an evidence set indexed by control, ready for review. Microsoft describes Essential Eight assessment and remediation as a point-in-time activity and recommends ongoing compliance monitoring for configuration drift, so plan how evidence will be refreshed after the assessment.
Obtain the independent assessment
An independent assessor tests the implemented controls and the evidence against the maturity model and the chosen profile, then reports its findings. Essential Eight has no ASD certificate, so the outcome is an assessment report from the assessor rather than a certification issued by ASD. The organization owns its controls and any remediation of findings, and the implementation partner, if one was used, prepares systems and evidence without issuing the result. The output is the assessor's report and a remediation list for any gaps it identifies. Confirm the assessor's independence from the implementation work before engaging them.
Sustain the level through recurring reviews
Once a level is reached, the organization runs the recurring tasks that keep it, such as validating application control rulesets at least annually from ML2, reviewing the Microsoft Office trusted publisher list at least annually at ML3, reviewing privileged access, testing backup restores and tracking patch cadences. Each recurring task needs a named owner, a schedule and a record of completion. The output is a standing review calendar and drift monitoring that flags when a control stops operating. Ask any provider to state which recurring costs are in the quote and which are excluded, since these costs continue after the initial uplift is complete.

What keeps costing money after the assessment

Essential Eight maturity is not a one-time purchase. Microsoft describes Essential Eight assessment and remediation as a point-in-time activity, which means a level achieved today can drift if the recurring tasks lapse. From ML2, application control rulesets must be validated at least annually (ISM-1582), and at ML3 the Microsoft Office trusted publisher list needs an annual review (ISM-1676). Each review needs a named owner, usually someone in endpoint or security engineering, plus time booked into their calendar. Ask any consultant quoting the work which of these reviews they perform for you and which they hand back to your staff.

The other recurring work is operational and easy to underfund. Patch cadences for applications and operating systems need scanning, triage and deadline tracking every cycle. Privileged access and general user access need periodic reviews that remove stale accounts and confirm that dedicated admin accounts are still in use. Backup restore tests must be run and recorded, and at higher levels the backup platform's retention and immutability settings should be checked after any administrator change. Your identity and endpoint team typically owns the access reviews, the backup owner owns restore tests, and the patch owner owns cadence reporting. Drift monitoring, such as configuration compliance checks in Microsoft Purview Compliance Manager or equivalent tooling in a self-hosted stack, should be assigned to someone who receives the alerts.

A managed service provider or retainer can take over the scanning, reporting, restore testing and drift monitoring, and an implementation partner can re-run the gap check against the ISM baseline profiles when the organization changes. Before signing, ask the provider to list each recurring task, the frequency, the evidence it produces and who approves exceptions. Confirm in writing whether the retainer covers ruleset validation and publisher list reviews or only the technical checks around them, because those reviews need an accountable person inside your organization. Retainer scope, response commitments and reporting cadence should all appear in the written scope before work starts.

What inflates the cost and how to avoid it

Most overruns in an Essential Eight uplift come from a small set of avoidable decisions made early: the target level, the sequence of purchases, and the work nobody planned to own. Each card below names one trap, what it does to cost, and the step that keeps the budget tied to the contract requirement.

Targeting ML3 when ML2 is required

Each step up the maturity model adds controls. The ISM profiles contain 87 controls at ML2 and 123 at ML3, and moving from ML2 to ML3 adds 39 controls and replaces 3. Teams that aim higher than the contract asks often buy driver application control, just-in-time administration and immutable backups before they are needed. Confirm the required level in writing with the customer or regulator, and scope the work to that level before any tool is priced.

Buying tools before the gap assessment

Licences for application control, logging and endpoint detection are often the largest recurring line in an uplift budget. Purchasing them before a gap assessment against the ISM baseline profiles risks paying for capability that duplicates what the estate already has, or missing a requirement the chosen product cannot meet. Run the gap assessment first and let the list of unmet controls drive the tool list, including a check of whether existing licences already cover the need.

Underestimating the ML2 logging build

Moving to ML2 adds 41 controls, much of it centralised event logging, log protection, analysis and incident reporting. A central log platform is a prerequisite, so the work includes log source onboarding, retention design, parsing, alert rules and access control on the logs themselves. Teams that treat logging as a licence line rather than a build project usually discover the gap during the assessment. Ask for a log source inventory and a onboarding plan with effort estimated per source class.

Application control rulesets without validation

Application control is where many uplift budgets grow after the first deployment. The ruleset must be validated at least annually from ML2, and ML2 and ML3 require Windows Defender Application Control rather than AppLocker. Rulesets built without a documented owner tend to drift as software changes, generating exceptions and rework. Budget for ruleset validation as a recurring task and confirm who approves changes before the first enforcement date.

Leaving process controls undocumented

Several Essential Eight controls depend on process as much as technology: patch deadlines, privileged access approvals, backup restore tests and exception handling. An assessor needs evidence that these run consistently, not only that the tools are configured. When documentation is written after the assessment starts, consultant hours rise sharply because evidence must be reconstructed from logs and tickets. Write procedures and record evidence as each control goes live, and ask any partner to name the document set they will deliver.

Skipping recurring review owners

Essential Eight is a point-in-time assessment of implementation, so maturity depends on repeated tasks such as scanning cadences, privileged account reviews, trusted publisher list checks at ML3 and configuration drift monitoring. Without a named owner, these tasks lapse and the level is lost before the next review. Microsoft recommends compliance monitoring for drift, which adds a licence cost, but the larger cost is staff time. Assign each recurring task to a role and include its hours in the operating budget from the start.

What to ask for in a written quote

A fixed-scope quote for an Essential Eight uplift should state the target maturity level first, and it should name the ISM Essential Eight baseline profile that level maps to. ASD publishes ML1, ML2 and ML3 profiles in OSCAL, and in the v2026.09.4 release those profiles contain 46, 87 and 123 controls respectively. A quote that says only "Maturity Level 2" without the profile, the control set and the version it was scoped against leaves the reader unable to tell later whether the work is complete. Ask the partner to list the systems, business units, cloud subscriptions and sites in scope, and to say what is excluded, such as legacy operational technology, unmanaged devices or a single acquired subsidiary. Each excluded system is a gap the assessor will test separately.

The quote should also split the licences and tools. Ask, line by line, which licences the client already holds and which the partner will procure, configure or require. For application control at ML2 and ML3, Microsoft's guidance points to Windows Defender Application Control rather than AppLocker, and for central logging it points to a Microsoft Sentinel and Defender XDR stack. Open-source and self-hosted alternatives may fit the client's environment, but the quote should name the product and the version the partner will deploy, and confirm that the client's own licence terms allow it. Next, require a deliverables list that names each document, configuration baseline, runbook and evidence set handed over, along with who signs off on each one.

Finally, the quote must state who performs the independent assessment and whether that work is excluded. DeployOpen prepares systems, controls and evidence, but an assessor independent of the implementer issues the assessment outcome, and the Essential Eight is not a certification with an ASD certificate. Confirm in writing that the assessor fee is outside the partner's price, and ask for the recurring support terms: which annual reviews fall in scope, such as the application control ruleset validation required from ML2 and the trusted publisher review required at ML3, and whether they are covered by a retainer. DeployOpen scopes and agrees deliverables in writing before work starts, so an unclear item should be resolved before signature, not during delivery.

Essential Eight cost questions buyers ask

Is there an official Essential Eight certificate, and what does it cost?

No. The Essential Eight is a set of mitigation strategies published by the Australian Signals Directorate, not a certification scheme, so ASD issues no certificate and there is no certificate fee. Maturity is shown through an assessment of each strategy's implementation and effectiveness against the Essential Eight Maturity Model. The cost you will pay comes from the work to reach a level and the independent assessment you choose to commission. Ask any provider who offers a certificate which body issues it and on what basis, and confirm the assessment's scope and deliverables in writing before you sign.

Which Essential Eight maturity level should we target?

Target the level your risk profile, contracts and regulators require, then price that level, not the highest one. Maturity Levels One to Three each set requirements for all eight strategies, and each step adds controls against more capable adversary tradecraft. Start with a gap assessment against the ISM Essential Eight baseline profiles so you know how far each strategy sits from the target. Ask whether a higher level is needed for a specific customer or obligation, because moving up a level usually costs more than the step before it.

Does ML2 cost roughly double ML1 because it has double the controls?

Not necessarily. The ISM Essential Eight profiles contain 46 controls at ML1, 87 at ML2 and 123 at ML3, so ML2 roughly doubles the control set. Cost does not scale linearly with control count, though. Much of the ML2 increase is centralized event logging, log protection, analysis and incident reporting, so a central log platform is a prerequisite and often the largest new spend. Other controls may reuse tooling you already own. Ask a provider to group the work by control family and by tool so you can see which items are new effort and which are configuration of existing systems.

Can our internal team implement the Essential Eight without outside help?

Often yes, provided you have people who can run the technical controls and keep the evidence current. Many organizations run patching, application control and privileged access work in house and bring in a partner for the gap assessment or the logging build. Check three things first: whether you have engineers familiar with your endpoint and identity platforms, whether someone owns each recurring review, and whether you can produce evidence an independent assessor will accept. Weak ownership usually costs more than a missing tool.

How much time must our internal team provide?

The internal share depends on the level, your estate and how much of the work a partner or managed service provider takes on. Expect your team to supply system owners for each strategy, access to identity, endpoint, server and backup platforms, change approvals, and staff for testing changes that touch business applications. Ask any provider to list those internal dependencies in the quote, with named roles and the approximate number of days each role is needed. Without a supplied estimate, treat any figure from a vendor as something to verify against your own environment.

What recurs after the assessment, and what keeps the level?

Reaching a level is not the end of cost. Vulnerability scanning and patch deadlines run continuously, and privileged access, backups and macro settings need periodic checks. Some controls carry fixed review cadences: application control rulesets must be validated at least annually from ML2 (ISM-1582), and the Microsoft Office trusted publisher list at least annually at ML3 (ISM-1676). Budget for licenses, log storage, monitoring and the named owner who runs these reviews. Ask for the recurring tasks, their owners and their frequency as a separate line in any quote.

Which licenses drive cost for application control and logging?

Licensing is often the largest variable. Microsoft's guidance says Maturity Level 1 application control can use AppLocker, while Maturity Levels 2 and 3 require Windows Defender Application Control because of the additional ISM requirements. For central logging of application control events (ISM-1660), Microsoft's guidance uses Defender for Endpoint P2 with Windows event logs captured in Microsoft Sentinel and Microsoft Defender XDR. Microsoft notes its Essential Eight license map is a community project by Microsoft employees, not an official Microsoft document, so confirm the current licensing with your Microsoft account team. Non-Microsoft estates will need equivalent tools confirmed against the ISM controls.

Who pays for what: the organization, the partner and the assessor

The organization owns its Essential Eight posture. It decides which maturity level it is targeting, accepts residual risk, funds the licences its tools require, and signs off every control that goes live. Most of the recurring spend sits here because the organization keeps paying for the platforms, staff time and reviews after the work is done.

Decisions and accountability: Target level, scope, risk acceptance and exceptions remain with executive owners, not with any outside party.
Licences and subscriptions: Operating system, identity, endpoint, logging and backup licences are typically bought in the organization's name. Confirm each licence tier against the target level with the vendor.
Staff time: Application owners, administrators and the security team carry day-to-day tasks such as patch deadlines, privileged access reviews and restore tests.
Recurring reviews: Application control rulesets must be validated at least annually from ML2 (ISM-1582), and the trusted publisher list for Microsoft Office at least annually at ML3 (ISM-1676). Assign a named owner for each.
Process controls: Policies, procedures and records of who approved what are the organization's to write and keep.

Before engaging anyone, confirm which licences you already hold and which recurring reviews have an owner.

How DeployOpen works on this

DeployOpen scopes an Essential Eight uplift by first agreeing the target maturity level, the systems in play and the central logging and tooling the level requires. Our work is fixed-scope, so the written scope sets the deliverables, and the organization keeps ownership of its controls and their evidence.

How we scope

We confirm the target maturity level and the ISM baseline profile it maps to before any work is priced.
We list the in-scope estate, including endpoints, servers, identity systems and backup platforms, and record what is excluded.
We identify which licences, tools and logging platforms the agreed level depends on, so the quote reflects them explicitly.

How we build

We deploy and configure self-hosted open-source platforms inside your own cloud accounts, data centers or air-gapped networks.
We implement technical controls such as patch cadence scanning, central event logging and immutable backup storage against the agreed scope.
We test each control against its stated requirement and record the results, so gaps are visible before handover.

How we hand over

We document configurations, procedures and owners for each control, written so your staff can run them without us.
We package the evidence each control produces, such as scan reports, log retention settings and restore test records, in an agreed structure.
We identify recurring tasks, such as annual ruleset validation, and assign them to named roles in your organization.

How we support

Ongoing support, upgrades and continuous testing are available as retainers, agreed separately from the uplift scope.
We can prepare systems and evidence for a later assessment, while the independent assessor issues any findings or report.
We revisit scope when the target level, estate or licensing changes, and confirm any change in writing before work starts.