How much does an Essential Eight assessment cost?

Less than most published figures suggest, because those figures usually answer a different question: the roughly $2,000 amounts widely quoted are fees for the assessor training course delivered through TAFEs, not for having your business assessed. A business assessment is typically quoted per engagement, scaled by size and complexity, and ours, the Cyber Security Scorecard, is free.

Three different products share this search term, and telling them apart saves both money and confusion. The first is the Essential Eight Assessment Course, an ASD-designed training program delivered through TAFEs at roughly $2,000 per person; it certifies people to conduct assessments, and unless you are training staff as assessors it is not your product. The second is a consultant-led assessment, quoted per engagement. The third is the provider-run assessment, often free, of which ours is one. These three get blended together constantly, which is why the numbers look incoherent.

For paid engagements, the price moves on a few honest drivers. Size and sites: more systems and locations mean more evidence to examine. Depth: a directional health check is cheaper than a full evidence-gathering exercise against every control. Formality: a report bound for a tender panel, an insurer or a DISP application needs rigour and presentation a working document does not. And independence: an assessor with nothing to sell you charges for the one thing a provider cannot offer, which is distance. Ask which of these drivers your quote assumes; a price with no visible drivers is a guess with a margin.

Free assessments deserve a clear-eyed paragraph, ours included. Providers offer them because assessment is how relationships begin; that is marketing, and pretending otherwise would insult you. It also does not make the reports wrong. The test of any assessment, free or paid, is the same: are the scores backed by evidence, control by control, or is it a questionnaire with a logo? A free report built on exported settings and restore logs is worth more than an expensive one built on a phone interview, and the reverse is also true. The questionnaire model fails for a simple reason: businesses answer surveys about themselves the way drivers rate their own driving.

Now the reframe that actually matters: the assessment is the cheap part regardless of what you pay for it, because the real cost of the Essential Eight is the uplift, closing the gaps the assessment finds. That number we publish: our plans deliver the climb as a service at $79 to $199 per user per month depending on target maturity level, with full Maturity Level 1 at $139. A ten-person business can therefore price its entire journey, measurement through maintenance, before a single conversation. That order matters: businesses that buy tools before measurement routinely buy the wrong tier.

When should you insist on paying? When independence is the product. If the assessment will be evidence in a tender, a DISP application or a dispute, a report from the same provider who profits from the fixes carries an obvious conflict, however honest the provider. We offer a free assessment and we will still say it: for formal assurance, an assessor who is not bidding for the remediation is worth their fee. For deciding what to fix first, the conflict matters far less than the evidence quality. The two models also combine well: a free provider assessment to find and fix the obvious, then independent assurance once there is something worth certifying.

If you are comparing quotes, force them onto one page the same way you would any IT purchase: the same scope, the same evidence expectations, the same report format. A cheap assessment that samples three laptops and a dear one that examines your whole estate are different products wearing the same name, and the difference will be invisible until the report lands. If a provider resists writing the scope down before quoting, the comparison has already told you what you needed to know.

The honest close: if the question behind your search is really what will this whole Essential Eight thing cost us, the answer has two parts, and only one of them should ever cost money. Measurement can be free and rigorous, and ours is; remediation is the investment, and it is published. Start with the free number: the Scorecard, or 1800 456 567.