Essential Eight evidence, collected automatically
Attest collects security evidence automatically from your existing systems, locks it in tamper-proof storage the moment it arrives, maps it to Essential Eight maturity levels one, two and three, and generates reports your insurer and auditor can independently verify. No spreadsheets. No screenshots. No manual uploads.
Why questionnaires and screenshots fall short
Most Essential Eight answers given to insurers are self-assessed: a ticked box, a screenshot, a spreadsheet. They show what someone believed was configured on one day. They don't show whether MFA covers every account, whether backups ran last week, or whether a new device missed the policy. Attest replaces that snapshot with evidence collected from the source systems on a schedule, so gaps show up as gaps rather than as a “yes.” For an in-depth analysis of evidence collection mechanics, read our comprehensive Essential Eight Evidence Guide, or see how these controls connect to APRA CPS 234.
Annual Spreadsheets
Static point-in-time answers decay the moment configurations drift. Insurers and auditors increasingly challenge unverified self-assessment questionnaires during claim scrutiny.
Manual Screenshots
Screenshots of admin consoles are labour-intensive, lack cryptographic timestamps, and fail to prove whole-of-environment coverage across unmanaged or newly deployed devices.
Attest Evidence Ledger
Recurring, automated extraction directly from telemetry sources into tamper-proof WORM storage. Gaps are surfaced objectively, producing defensible audit records.
Essential Eight maturity assessment software: 8 mitigation strategies
Attest assesses all eight mitigation strategies. Maturity levels L1, L2 and L3 are selectable per tenant. The evidence sources below are from the Attest connector list.
Application control
Verifies that only approved execution binaries, scripts, and installers execute on endpoints and servers.
Patch applications
Evidences vulnerability scan cadence, patch deployment timeliness, and removal of unsupported software.
Configure Microsoft Office macro settings
Audits macro execution controls, blocking of untrusted internet macros, and digital signature requirements.
User application hardening
Assesses browser security configurations, disabling of legacy web components, and PDF execution isolation.
Restrict administrative privileges
Tracks privileged account inventory, separation of administrative duties, and periodic re-authorisation.
Patch operating systems
Monitors operating system patch currency, security update deployment speeds, and legacy OS decommission.
Multi-factor authentication
Evidences MFA enforcement across all user logins, remote access, and privileged administrative consoles.
Regular backups
Validates automated backup execution, air-gapped or immutable retention, and periodic restoration test records.
From raw telemetry to sealed evidence
How Attest transforms live infrastructure and endpoint telemetry into cryptographic proof for insurers and auditors.
Connect
Secure, tenant-bound connectors, each authorised with the minimum permissions required. No connector can cross tenant boundaries.
Collect
A full baseline at onboarding, then recurring collection at defined intervals. If a source is unavailable, the gap is recorded honestly.
Lock and Chain
Evidence is written to WORM storage (S3 Object Lock in Compliance mode), hashed with SHA-256, and chained to the previous record in your tenant's own chain.
Map and Report
Evidence is mapped through universal controls to Essential Eight. Each report's hash is recorded in the ledger and can be checked via QR code or endpoint where enabled.
Defensible evaluation: Honest evidence states
A control only produces PASS when the evidence is present, fresh, complete, structurally valid, from the correct source and within scope. Otherwise the result is UNKNOWN — insufficient evidence — never PASS.
| Evaluation State | Meaning & Audit Criteria |
|---|---|
| PASS | All required evidence is present, fresh, valid, and confidence is HIGH. |
| FAIL | Evidence is present and evaluation determines non-compliance against the target maturity level. |
| UNKNOWN | The available evidence cannot prove this control. Attest never infers a pass from missing telemetry. |
| NOT ASSESSED | Intentionally outside the agreed assessment scope or tenant profile. |
| EXCEPTION | Governance-approved exception with documented reason, registered owner, and formal expiry date. |
What you receive: Audit-ready deliverables
Every assessment produces comprehensive documentation structured for external audit scrutiny and insurance underwriters.
Standard Assessment Deliverables
- Essential Eight Assessment Report: Executive summary, RAG scorecard across L1, L2 and L3, and specific remediation findings.
- Evidence Proof Appendix: Cryptographic SHA-256 hashes, timestamps, event IDs, and data source identity records.
- Assertion & Non-Assertion Statements: Clear boundaries stating exactly what was and wasn't assessed in your environment.
- Governance & Chain-of-Custody Statement: Verifiable custody trail confirming evidence integrity.
Optional Services & Solutions
- Urgent Cyber Insurance Evidence Pack: Rapid evidence packaging for imminent policy renewals or underwriter questionnaires (from A$10,000, any Attest tier).
- Essential Eight Uplift Services: Structured technical uplift pathways from Level 1 to 2 (from A$25,000) and Level 2 to 3 (from A$50,000).
- MSP Multi-Tenant Automation: White-label portfolio management and tenant propagation for managed service providers.
Attest pricing and plans
Transparent pricing with no hidden seat fees. Direct alignment with Australian maturity expectations.
Attest Standard
Essential Eight evidence foundation for growing Australian businesses.
- Essential Eight ML1, ML2 & ML3 coverage
- Up to 8 compliance reports per year
- Automated evidence collection from core connectors
- SHA-256 evidence hashing in AWS Sydney
- Standard email support
Attest Professional
Comprehensive evidence packaging for regulated entities and insurers.
- All 8 mitigation strategies across all maturity levels
- Up to 12 compliance reports per year
- Advanced cloud & identity connector portfolio
- Cryptographic report verification via QR & API endpoint
- Prioritised engineering & audit support
Attest Enterprise & Sovereign
Dedicated deployment for enterprise, government, and defence supply chains.
- 24+ compliance reports per year with custom cadence
- Customer-managed KMS encryption keys (BYOK)
- ASD ISM March 2026 alignment & custom universal controls
- SAML SSO & SCIM automated tenant provisioning
- Dedicated compliance specialist & SLA guarantees
Frequently asked questions
Objective answers on Essential Eight maturity assessment, evidence storage, and verification.
Turn Essential Eight into Verified Evidence
Move beyond self-assessed spreadsheets and manual screenshots. Generate objective, cryptographic proof that satisfies underwriters, auditors, and boards.