Essential Eight vs SOC 2

Essential Eight vs SOC 2: which assurance to offer first

An Australian SaaS or IT provider deciding what to show customers at home and abroad is choosing between two different kinds of proof. The Essential Eight evidences a maturity level against ASD's model, with no certificate, while a SOC 2 report is an attestation by a CPA firm on the design and, for a Type 2, the operating effectiveness of controls over a period. Each answers a different buyer question, so the first decision is which question your customers are actually asking. Domestic government and critical-infrastructure buyers usually ask about the Essential Eight, while US and multinational enterprise buyers, and their procurement questionnaires, more often ask for a SOC 2 report.

Pursue the Essential Eight first when your customers are Australian government agencies or suppliers who must show a maturity level, and when your technical controls are not yet consistently in place. The model asks for evidence on each of the eight strategies, including restore-tested backups (ISM-1515) and recurring application control ruleset validation from Maturity Level Two (ISM-1582). Pursue SOC 2 first when a named enterprise customer requests an attestation report and when your controls are already documented and stable enough to run for a meaningful period. Confirm with each customer whether a SOC 2 Type 1 or Type 2 report satisfies their request, and whether they accept an internal Essential Eight assessment in place of an external one.

Doing both is justified when you sell to Australian government and to overseas enterprises at the same time, because the two cover different ground. The Essential Eight does not produce a report that a US buyer can read as a SOC 2, and a SOC 2 does not show the ASD maturity level. Sequence the work so the shared controls, such as access management and change control, are designed once and evidenced twice. Neither assurance replaces the other, and neither is a certificate. Before you commit budget, ask your auditor and your ASD assessor for written scope, and ask the CPA firm how it will treat the Essential Eight evidence in its testing.

What each framework covers, proves and recurs

This table sets Essential Eight maturity assessment against a SOC 2 examination on scope, what is issued, the period covered, distribution limits and recurring work. Read each row as a question to put to your assessor or auditor before committing.

Dimension	Essential Eight (ASD)	SOC 2 (AICPA)
What it covers	Eight mitigation strategies: patch applications, patch operating systems, multi-factor authentication, restrict administrative privileges, application control, restrict Microsoft Office macros, user application hardening and regular backups	Trust Services Criteria: 61 criteria in the 2017 TSC, including 33 common criteria; security is always in scope, other categories only when chosen
Structure	Maturity Levels Zero to Three, with Levels One to Three setting requirements for all eight strategies	Common criteria CC1 to CC9, plus optional availability, confidentiality, processing integrity and privacy criteria, with points of focus that are guidance, not separate requirements
What is produced	A maturity level assessed per strategy against the model; there is no ASD certificate	A CPA-issued report: Type 1 covers system description and control design at a date; Type 2 adds an opinion on operating effectiveness over a period
Period covered	Assessment reflects implementation and effectiveness at the time of assessment; confirm with your assessor how evidence dates are set	Type 1 is a point in time; Type 2 covers a period, and no generally accepted minimum period is set, so confirm the window with your auditor
Who issues or assesses	Assessed against ASD's model by the organization or an assessor it engages; confirm who your customers will accept	A CPA firm acting as service auditor under AT-C 205, which requires written representations from management
Reporting restrictions	Not a published report; disclosure terms are set by your own contracts and confirmed with your customers	A SOC 2 report is generally restricted in use; a SOC 3 report is general use and can be freely distributed, with less detail
Recurring obligations	Maintain controls and re-check each strategy; certain ML2 and ML3 tasks recur, such as annual application control ruleset validation from ML2 and annual trusted publisher review at ML3	Ongoing controls and periodic examinations; confirm with your auditor the cadence customers expect and how changes to scope are handled

Who needs each one, by market and customer

Australian government buyers and their prime contractors often write cyber requirements into procurement contracts, and the Essential Eight is the baseline most often referenced in Australian public-sector security language. The requirement, however, comes from the contract. Neither the Essential Eight nor SOC 2 is a legal mandate for a supplier unless the reader's contract, tender or security schedule says so, so read the clause before deciding what to build.

Contract wording: Check whether the clause asks for a stated Essential Eight maturity level, evidence of assessment against the model, or an independent report. These lead to different work.
No certificate exists: The Essential Eight produces no ASD certificate, so buyers who ask for proof will expect an assessment record, not a badge.
Maturity level target: Confirm which level the buyer expects for each of the eight strategies, since Levels One to Three each set requirements for all eight.
Sharing limits: A SOC 2 report is generally restricted in use, so it may not be shareable with every tender panel member. Ask the buyer which evidence format they will accept.
Scope of the assessment: Confirm which systems and environments the buyer considers in scope before you agree to a maturity claim.

Ask the buyer or prime contractor in writing which evidence they accept and whether a SOC 2 report would be considered in place of, or alongside, an Essential Eight assessment.

Where the work overlaps and where it does not

The supplied sources include no official Essential Eight to SOC 2 mapping. The CIS Navigator maps CIS Controls to SOC 2, and ASD's assessment evidence guide references NIST CSF 2.0 and NIST SP 800-171r3, so confirm any direct crosswalk with ASD, your CPA firm or your assessor before you rely on one. The cards below show where the same operating evidence can serve both.

Access control and privileged accounts

Multi-factor authentication and restricted administrative privileges are the Essential Eight strategies closest to the logical access criteria in CC6. Essential Eight evidence shows how each strategy is implemented and how well it works at your target maturity level. A SOC 2 Type 2 report tests whether the access controls operated across the whole examination period. The MFA and privileged access events that Maturity Level Two requires you to centrally log can also serve as CC6 evidence. Confirm with the CPA firm which accounts and systems fall inside the system boundary, because an account left out of scope will not appear in the report.

Backups and restore testing

Essential Eight requires backups to be restore-tested to a common point in time as part of disaster recovery exercises at every maturity level (ISM-1515). A SOC 2 report only reaches recovery criteria if availability is in scope, so the restore test does not automatically become an availability control in the report. The same exercise can support CC7 system operations evidence if you document the test, its scope and its results. Ask your CPA firm whether restore tests should be run and recorded on a fixed schedule so that a Type 2 period contains several of them. A restore test with a dated result is the evidence both assessments need.

Logging and event monitoring

Maturity Level Two adds central logging of application control, PowerShell, command line, privileged access and MFA events, protection of event logs, and timely analysis of internet-facing server logs. SOC 2 does not list log sources in the same way. Under CC7 the auditor tests the monitoring you describe in your system description, so the log sources you commit to determine what gets tested. A log source that Essential Eight requires but your SOC 2 description omits creates a gap in one assessment or the other. Decide the log sources once and map each one to both assessments.

Application control and change management

Application control is an Essential Eight strategy with its own recurring work. Application control rulesets must be validated at least annually from Maturity Level Two (ISM-1582), and the Microsoft Office trusted publisher list must be reviewed at least annually at Maturity Level Three (ISM-1676). In a SOC 2 report, these ruleset and allowlist changes fall under the change management criteria in CC8. Route each ruleset change through the same approval and record process you describe for system changes. Ask the CPA firm whether the annual reviews can serve as operating evidence for CC8 over the examination period.

Patching and risk treatment

Patching applications and operating systems is an Essential Eight strategy that the maturity model grades by level. SOC 2 has no patch timeframe of its own. CC7 covers system operations and CC9 covers risk mitigation, so the auditor tests the patch timelines and vulnerability decisions you write into your own policy. If your Essential Eight target sets faster expectations than your SOC 2 policy, the auditor will test against the policy, and the gap will show. Check the timelines in both before you commit to them, and keep records of every exception and who approved it.

System description and scope

A SOC 2 report starts with management's system description, prepared against the AICPA's 2018 description criteria (DC 200). The Trust Services Criteria have 61 criteria across five categories, and the four categories beyond security are included only when you put them in scope. Points of focus guide control design but are not separate requirements. Essential Eight has no system description. Its assessment covers the in-scope systems at the maturity level you choose. Use the assessment boundary and the SOC 2 system boundary together, so that customers see one consistent account of what is covered.

Who assesses, what is issued and how often

This table compares who evaluates each framework, what document or status the work produces, the period it covers and how often it recurs. Read it as a check on what you can hand a customer at the end of the work, not only on what the work costs. The main takeaway is that Essential Eight yields an internal maturity position with no certificate, while SOC 2 yields a third-party report that customers may ask to read.

Dimension	Essential Eight (maturity assessment)	SOC 2 (CPA attestation report)
Who assesses	No ASD-issued assessor or accreditation scheme is described in the supplied material. Confirm with ASD who may perform an assessment and whether your customers accept an internal or external assessor.	A CPA firm's service auditor, who must hold the appropriate professional standing to perform attestation engagements under AT-C section 205.
What is issued	No ASD certificate exists. Maturity is evidenced by assessing each of the eight strategies for implementation and effectiveness against the maturity model.	A signed service auditor's report. Type 1 covers the system description and control design as of a date. Type 2 adds an opinion on operating effectiveness.
Evidence the work depends on	Configuration evidence, logs, patch records, restore tests and privileged access records, mapped to each strategy and maturity level.	Written representations from management, the system description, control design and samples of operating evidence over the period.
Period covered	A point-in-time maturity position against the model you assess. Confirm with your assessor how they record the assessment date and scope.	Type 1 is as of a single date. Type 2 covers an observation period. There is no generally accepted minimum period, so confirm the length with your auditor.
Renewal cycle	No fixed renewal is set by ASD in the supplied material. Recurring tasks such as annual application control ruleset validation (ISM-1582) keep the position current.	Reports are issued on the audit cycle you agree with the CPA firm. Type 2 reports are normally refreshed for each new period, so plan for recurring fieldwork.
Who may read the output	The maturity position is your own document unless you choose to share it. Confirm what evidence you must keep for customer or regulator requests.	Use of a SOC 2 report is generally restricted to specified parties. A SOC 3 general use report can be distributed freely and carries less detail.
Confirm before you commit	Who may assess Essential Eight in your jurisdiction and which evidence your customers will accept.	Your auditor's scope, the Trust Services Criteria categories included and the observation period length for a Type 2 report.

What recurring work each route creates after the first pass

The Essential Eight does not end at the first maturity assessment, and the recurring work grows as you move up the levels. At Maturity Level One you are mostly keeping the eight strategies in place. From Maturity Level Two, the ASD model expects central logging of application control, PowerShell, command line, privileged access and multi-factor authentication events, with event logs protected and internet-facing server logs analysed in a timely way. Someone must own that log pipeline, watch the alerts and keep retention and access settings correct, so the logging budget is an operating cost, not a one-off project. Backups carry a recurring duty at every level: they must be restore-tested to a common point in time as part of disaster recovery exercises. Schedule those exercises now, record the results and decide who signs off a failed restore.

Application control and Microsoft Office trusted publisher lists create calendar-driven tasks. From Maturity Level Two, application control rulesets must be validated at least annually, and at Maturity Level Three the Microsoft Office trusted publisher list must also be reviewed at least annually. Each review needs a named owner, a dated record and a change path for any rule that no longer matches the approved software estate. Confirm with your assessor how they expect that evidence to be kept between assessments.

SOC 2 recurs as an observation period plus a reporting cycle, and the report is only as current as the evidence behind it. A Type 2 report adds an opinion on operating effectiveness over a period, and the AICPA leaves that period to the engagement, so ask your CPA firm to set it in writing. Across that window, you must collect evidence for each control in the 2017 Trust Services Criteria, including the common criteria CC6 to CC9 on access, system operations, change management and risk mitigation. Management also signs a representation letter for the examination, so the people who sign it need to understand the controls they are attesting to. Ask the firm to confirm the 2022 revised points of focus they will test against, and plan for the report to be refreshed on whatever cycle your customers require.

What drives cost and effort on each side

Essential Eight and SOC 2 cost different things. Essential Eight costs sit mostly in engineering and evidence work, while a SOC 2 report adds a CPA firm's fees on top of the same control work. The cards below set out what you pay for, what recurs and what to ask for in a written quote.

Internal staff time

Both paths consume your own people before any assessor is engaged. For Essential Eight, engineers must configure and evidence each strategy at your target maturity level. For SOC 2, control owners must write policies, collect population evidence and answer auditor requests across the observation window. Ask who on your team owns each control and how many hours per month that ownership implies, since this is usually the largest internal cost and it recurs.

Tooling and recurring operations

Logging, backup, MFA, patching and access review tools may already exist in your estate, or they may need to be added. Essential Eight expects evidence of these operating continuously, and SOC 2 tests whether they operated effectively over the period. Check which tools you already run, what licences they carry and whether they can export the logs and records an assessor will sample.

Assessor fees and what they buy

A SOC 2 is performed by a CPA firm, so the report carries a fee for the examination itself. The Justice Department's October 2024 proposed rule (89 FR 86116) cited vendor-sourced estimates of $5,000 to $25,000 for a SOC 2 Type 1 and $30,000 to $100,000 for a Type 2. No comparable Essential Eight cost figure is supplied here, because the maturity assessment depends on who performs it and how much evidence they review. Ask each assessor for a fee tied to a written scope.

Scope: categories and systems

SOC 2 scope drives effort directly. Security and its common criteria always apply, but availability, processing integrity, confidentiality and privacy add criteria only when you include them. Each additional system, environment or subservice organization adds sampling and documentation. Essential Eight scope is the set of workstations, servers and applications where you claim a maturity level. Decide the boundary in writing before a quote is issued, because a wider boundary changes both fees and internal hours.

Type 1 versus Type 2 choice

A Type 1 report tests control design at a single date, while a Type 2 report adds an opinion on operating effectiveness over a period. The Type 2 period has no generally accepted minimum, so it should be long enough for the service auditor to test operation. This choice changes both the fee and the evidence you must keep running. Confirm with the auditor whether a Type 1 first will be accepted by your customers before paying for a Type 2 window.

Remediation before assessment

Gaps found during a readiness review often cost more than the assessment itself. On the Essential Eight side, a missing control such as application control or restore-tested backups may need a platform change before evidence can be produced. On the SOC 2 side, a design gap found in a Type 1 can require a new control and a new observation period. Ask for a readiness review with a written list of gaps and an estimate of remediation effort before committing to a full assessment.

Sequencing both routes so evidence is reused

The sequence below shows how an Australian provider can close Essential Eight gaps, scope a SOC 2 examination and let one evidence set serve both, while keeping each route's proof separate and clearly labeled.

Confirm what customers and contracts actually ask for
Start by listing each customer, contract and jurisdiction that requests assurance, and record whether the request names an Essential Eight maturity level, a SOC 2 report, or a general security questionnaire. Sales, legal and the security lead should sign off the list. The step closes when every request is mapped to one of three outcomes: an Essential Eight level, a SOC 2 report of a stated type, or an answer to a questionnaire. Confirm the exact wording with each customer, because a request for a SOC 2 report and a request for evidence of controls are not the same ask.
Close Essential Eight gaps at the target level first
Where a customer or contract specifies a maturity level, the security team assesses each of the eight strategies against the ASD maturity model for that level and records the gaps. Engineering and IT operations own the remediation, with the CISO approving priorities. Some Maturity Level Two work introduces recurring tasks, such as validating application control rulesets at least annually and restore-testing backups, so the owners of those tasks must be named now. The step closes with a gap register that shows which controls are implemented and evidenced at the target level.
Define the SOC 2 system boundary and categories
Document the systems, people, data flows, subservice organizations and locations that make up the service in scope for the SOC 2 examination. Choose which Trust Services Criteria categories to include beyond security, which covers the common criteria for every SOC 2. Security is required; availability, processing integrity, confidentiality and privacy are added only when the customer commitments justify them. The step closes with a draft system description and an agreed category list, reviewed by the CPA firm before the observation period starts.
Choose Type 1 or Type 2 from customer need
Decide whether the customer needs a Type 1 report, which covers the system description and the suitability of control design as of a date, or a Type 2 report, which adds an opinion on operating effectiveness over a period. Ask the customer what they will rely on and whether their procurement team accepts a point-in-time view. The decision is recorded with the CPA firm and the reason stated. Ask each firm for a written quote tied to the chosen type, since the cost and effort of a Type 2 are materially higher than a Type 1 according to the Justice Department's regulatory analysis (89 FR 86116), which cited vendor-sourced estimates for both.
Build one evidence repository and control owner list
Create a single evidence repository and a control owner list that cover both the Essential Eight controls and the SOC 2 controls in scope. Each control gets one named owner, one evidence location and one review date. Where a control serves both routes, such as access reviews, backup restore tests or incident logging, it is recorded once and tagged to each framework. The step closes when every in-scope control has an owner and evidence location, and the security lead confirms the list matches the system boundary.
Confirm the cross-framework mappings before reuse
Before any evidence is tagged to both routes, have the security lead and the CPA firm check the mapping between the Essential Eight controls and the SOC 2 criteria in writing. ASD publishes Essential Eight baseline profiles in OSCAL and an evidence guide that maps to other frameworks, but a mapping shows a relationship, not equivalence, and the CPA firm decides what it accepts as evidence for a SOC 2 criterion. The step closes with a signed-off mapping sheet listing which evidence serves which route, and which evidence serves only one.
Run the observation period on implemented controls
For a Type 2 examination, the observation period starts only after the controls in scope are implemented and their evidence is captured consistently. Control owners collect evidence on the schedule set in the repository, and the service auditor samples it. Essential Eight evidence such as central logs, patch records and privileged access reviews feeds the same repository. The step closes when the auditor has completed testing and issued the report, and the evidence set is archived so the Essential Eight assessment can reuse it without a second collection cycle.
Review the gap register and report outputs together
After each cycle, the security lead reviews the Essential Eight gap register, the SOC 2 exceptions and the customer requests together. Control owners update the evidence repository, and any control that changed is re-mapped before it is used for the next customer answer. The step closes when the reviewed register, the report distribution rules and the next review date are recorded. Confirm with the CPA firm whether a SOC 2 report can be shared with each customer, because use of a SOC 2 report is generally restricted, while a SOC 3 report is general use.

What buyers ask before choosing or combining these frameworks

Is there an Essential Eight certificate I can give customers?

No. The Essential Eight is a set of mitigation strategies, not a certification scheme, so there is no ASD certificate to issue or display. Maturity is evidenced by assessing how each of the eight strategies is implemented and how well it works against the Essential Eight Maturity Model, which runs from Maturity Level Zero to Three. The assessment output is evidence you can share with customers under your own terms, usually as an assessment summary rather than a certificate. Ask any assessor to show you exactly what document they will deliver, who signs it, and what it does and does not claim.

Can a SOC 2 report cover the Essential Eight?

Not directly. A SOC 2 examines controls against the AICPA's Trust Services Criteria, and it is not built around the eight ASD mitigation strategies. Some Essential Eight controls, such as multi-factor authentication, restriction of administrative privileges and logging, overlap with SOC 2 criteria in the security category, so evidence can often be reused. The overlap is partial. Ask your CPA firm to map the Trust Services Criteria to your Essential Eight scope and to show which Essential Eight items the SOC 2 does not test at all, such as patch timeliness or application control rulesets, before you assume coverage.

How long does a SOC 2 Type 2 take, and how many months of observation do I need?

There is no generally accepted minimum observation period for a SOC 2 Type 2 report. The period should be long enough for the service auditor to form an opinion on operating effectiveness, and that choice is made with the auditor. The Journal of Accountancy's 2011 guidance on service organization controls reporting describes this principle without fixing a number of months. Plan around three drivers: the length of the examination period you agree, how mature your controls and evidence already are, and how quickly your staff produce what the auditor requests. Ask the CPA firm for its proposed period and the reasoning behind it, in writing.

What does a SOC 2 engagement need from our internal staff?

Most of the effort falls on internal staff, not the auditor. Your team must write or confirm the system description, define the in-scope services and systems, assign control owners, and produce evidence such as access reviews, change tickets, incident records and vendor reviews on the schedule the period requires. Management must also sign the written representations that the service auditor obtains under AT-C section 205. Expect ongoing requests throughout the observation period, not a single handover. Ask the firm for a request list and a named evidence owner before signing.

Can a provider run our Essential Eight assessment or SOC 2 readiness in-house?

DeployOpen plans, implements, hardens, documents and supports self-hosted open-source platforms inside your own infrastructure, and it prepares systems, controls and evidence for compliance assessments. It does not issue audit reports, attestations or certifications, and it does not replace the independent CPA firm for SOC 2 or the assessor for Essential Eight maturity evidence. Most engagements are fixed-scope, with scope, deliverables and timelines agreed in writing before work starts. Ask any provider which parts it performs, which parts an independent party must perform, and whether your own staff must own the operational evidence.

What should I ask for in a quote for either assurance route?

Ask each provider to break the quote into components: scope and in-scope systems, the Essential Eight maturity levels or Trust Services Criteria covered, the examination type and period, the independent assessor's fee, your internal effort, and any recurring items such as annual re-assessment, surveillance or continuous evidence collection. Separate one-time work from recurring work. Identify what drives cost up, including the number of systems, the number of custom integrations, and how many controls you must remediate first. The U.S. Justice Department's October 2024 regulatory analysis cited vendor-sourced estimates of $5,000 to $25,000 for a SOC 2 Type 1 and $30,000 to $100,000 for a Type 2, which is a US-market reference point, not a quote for your environment. DeployOpen does not publish prices. A quote follows from written scope.

Which should we pursue first, Essential Eight or SOC 2?

Start with the assurance your largest customers or regulators ask for first, then check whether the work overlaps. If your customers are mainly in Australia, the Essential Eight maturity work usually comes first because it sets the technical baseline. If you sell into the United States and customers request a SOC 2 report, a Type 1 can show control design at a date before you commit to a longer Type 2 period. Many organizations do the technical hardening once and then extend evidence collection for the second assurance. Confirm with your customers which document they will actually accept and whether they need a general use report or a restricted one.

How DeployOpen prepares Essential Eight and SOC 2 readiness

DeployOpen plans, implements, hardens, documents and supports self-hosted open-source platforms inside your own infrastructure, and prepares systems, controls and evidence for compliance assessments. We do not issue audit reports, attestations or certifications, so independent assessors and CPA firms remain responsible for those outcomes.

How we scope

Engagements are fixed-scope, with scope, deliverables and timelines agreed in writing before work starts.
The written scope states which Essential Eight strategies and maturity level, or which SOC 2 categories and period, are in view.
Scoping confirms which systems, cloud accounts and identity sources fall inside the boundary of the assessment.

How we build

We implement and configure the technical controls needed for the chosen Essential Eight maturity level in your environment.
We document control design and evidence collection so an assessor can trace each control to a system and an owner.
We run security testing against the in-scope systems to check that controls operate as documented before assessment.

How we hand over

Handover includes configuration records, runbooks and evidence collection procedures your team can operate without us.
We map delivered controls to the Essential Eight model or SOC 2 criteria so your assessor has a clear starting point.
Deliverables are listed in the written scope, so you can confirm acceptance against a defined set of artefacts.

How we support

Ongoing support, upgrades and continuous testing are available as a retainer, which suits recurring review tasks.
Recurring work such as annual ruleset validation or restore testing can be scoped into a retainer or handled by your team.
Ask any provider for a quote that separates one-time build effort from recurring evidence, review and assessment costs.

Essential Eight vs SOC 2