In short: State your maturity level for each of the eight strategies, define the environment it covers, date it and say how it was assessed. If you fall short of the level the buyer requires, declare the gap with a remediation plan and target date rather than overclaiming. Never describe an assessment as a certification. Back every claim with evidence you can produce if asked.
Essential Eight requirements now turn up in tenders and RFPs well beyond government. Defence, Commonwealth and state agencies set them, and regulated buyers increasingly ask too. We covered where those requirements come from in Essential Eight Requirements for Suppliers: A Condition of Doing Business.
This article is about what happens next: writing the response. Most responses go wrong in one of two ways. They say too little, or they claim too much.
What does an Essential Eight requirement in a tender ask for?
Usually it starts with a single field asking for your maturity level. Then evaluators probe the scope behind it. A July 2026 analysis of government tenders found buyers look for:
- a rating for each of the eight strategies, not one overall level
- the environment that was assessed
- the date of the assessment
- who carried it out
The same analysis notes that the security schedule is often a pass/fail gate rather than a scored criterion. Buyers also ask how the requirement reaches your subcontractors, not just your own business.
The level you need depends on the buyer. Defence requires all Defence Industry Security Program (DISP) members to achieve and maintain full Maturity Level 2. For other buyers, the tender’s security schedule sets the level.
On 15 October 2026, ASD launched the Essentials series, an evolution of the Essential Eight. Its June 2026 announcement put the Essential Eight’s retirement about two years out, but its latest guidance leaves the timing open, saying it will advise “in due course”. How that flows through to tender requirements remains to be seen. For now, ASD advises organisations to keep meeting their current obligations, and today’s Defence requirements still name Essential Eight maturity levels.
How should you structure your Essential Eight response?
1. Rate each strategy separately. A single maturity level hides more than it shows, and evaluators know it. Set your response out strategy by strategy:
| What to include | Why it matters |
|---|---|
| The strategy (for example, patch applications, multi-factor authentication, regular backups) | Evaluators check each one against the requirement |
| The maturity level achieved | Shows exactly where you meet the bar and where you don't |
| The environment covered | Stops a narrow assessment reading as an organisation-wide claim |
| Notes on exceptions | Shows you know your gaps rather than hoping no one asks |
2. Define the scope. State which systems the rating covers and which it doesn’t. A rating for your corporate Windows fleet is not a rating for the system you’ll use to deliver the contract.
3. Date it and say how it was assessed. Self-assessed and evidence-based ratings carry different weight, and evaluators will ask which yours is. Be upfront.
4. Answer the question the buyer asked. If the schedule asks for Maturity Level 2, lead with your Level 2 status, even if the honest answer is “partially”. Don’t bury it under a description of your security program.
5. Have the evidence ready. Whatever you state, assume the buyer can ask you to prove it, before award or after.
What if the tender requires a higher maturity level than you’ve reached?
Declare the gap, and pair it with a plan. For each strategy that falls short, set out the controls involved, the work required, a target date and who owns it.
That won’t get you through every pass/fail gate. But claiming a level you can’t support creates a contractual problem you’ll carry for the life of the contract, and a known gap with a credible plan is a stronger answer than a claim that falls apart under scrutiny. Even Defence builds an uplift path into DISP for members that fall short.
The practical lesson is timing. Uplift work touches every device, and a tender window is rarely long enough to complete it. The best time to find your gaps is before the tender opens.
What should you never claim in a tender response?
- That you’re “Essential Eight certified.” An Essential Eight assessment is evidence of your maturity across a defined scope at a point in time. It is not a certification.
- A substitute for IRAP. If the tender requires an assessment under the Infosec Registered Assessors Program (IRAP) of a system the government must authorise, that’s a separate, formal exercise. An Essential Eight rating doesn’t replace it.
- Someone else’s assurance as your own. The July 2026 analysis points out that a hosting provider’s IRAP assessment covers the provider’s platform, not your system. It also notes that an ISO 27001 scope can exclude the systems the buyer cares about.
- An organisation-wide level from a partial assessment. If you assessed one environment, say so.
Does the same approach work for vendor risk questionnaires?
Yes. Existing customers increasingly send vendor risk questionnaires at onboarding or renewal. Buyers regulated by the Australian Prudential Regulation Authority (APRA) in particular must assess the information security capability of third parties that manage their information assets under its information security standard, CPS 234. The structure is the same: rate each strategy, define the scope, date it, declare gaps with a plan and keep the evidence ready.
Where does the evidence come from?
We’ve written about why self-assessed controls carry less weight in Cyber Insurance in 2026: Why Evidenced Controls Matter and You Can’t Defend What You Can’t See. For a tender, the practical point is simple: every line in your response should trace back to data you can produce if the buyer asks.
Our Live Security Posture Assessment gives you that data for Essential Eight Maturity Level 1, measured from live endpoint data rather than documentation or interviews. Its findings map directly onto a tender response:
- A rating for each control: holding, partial or not in place
- Defined scope: Windows and Linux environments of up to 50 assets, including remote and rarely connected devices, with exceptions down to individual devices
- A dated result: findings within 28 days
- Your gap plan: prioritised risks, with remediation guidance mapped to the Information Security Manual
- Minimal time from your team: a kick-off call, three 30-minute check-ins on days 7, 14 and 21, and a final walkthrough
- A fixed fee: $997 with a money-back guarantee
If a tender is already open and closes in less than 28 days, the assessment won’t be finished in time for that bid. Start now and you’ll be ready for the next one.
Need Maturity Level 2 or Level 3? We assess those too, scoped to your environment. Get in touch and we’ll work through it with you.
FAQs
What Essential Eight maturity level should I state in a tender response?
State the level the tender asks about, and give your actual maturity for each of the eight strategies rather than one overall rating. Defence requires Defence Industry Security Program (DISP) members to meet Maturity Level 2. Other buyers set the level in their security schedule.
Can I say my organisation is Essential Eight certified?
No. An Essential Eight assessment is evidence of your maturity across a defined scope at a point in time. It is not a certification. Describe your result as an assessed maturity level, with its scope and date.
What if I haven’t reached the maturity level the tender requires?
Declare the gap rather than overclaiming. For each strategy that falls short, set out the work required, a target date and who owns it. A known gap with a credible plan is a stronger answer than a claim you can’t support.
Does the same approach work for vendor risk questionnaires?
Yes. Rate each strategy, define the scope, date the result, declare gaps with a remediation plan and keep evidence ready. Buyers regulated by the Australian Prudential Regulation Authority (APRA) must assess the information security capability of third parties under CPS 234, so expect the same level of scrutiny.
How long does an evidence-based Essential Eight assessment take?
Evolution Systems’ Live Security Posture Assessment delivers Maturity Level 1 findings within 28 days. Client time is limited to a kick-off call, three 30-minute check-ins and a final walkthrough, so start before a tender opens.
Can Evolution Systems assess Essential Eight Maturity Level 2 and Level 3?
Yes. The fixed-fee Live Security Posture Assessment covers Maturity Level 1. Evolution Systems also assesses Maturity Level 2 and Level 3, scoped separately to your environment.
