Book a demo

Essential Eight compliance software built for Australian teams

Track Essential Eight maturity, collect evidence, and stay audit-ready with certified assessor reviews - designed, owned, and operated onshore.

From tick-box tracking to audit-ready maturity

Many organisations only discover their Essential Eight gaps when an audit deadline appears. Constant gives you a live view of maturity across all eight strategies so remediation is continuous, not reactive.

Whether you are working toward Maturity Level 1, 2, or 3, the platform maps your controls, evidence, and assessor findings to the ACSC model your auditors expect.

Constant is purpose-built around the ACSC maturity model - so ML1, ML2, and ML3 requirements stay visible for every strategy, with evidence and remediation attached.

ASD Essentials is included

ASD Essentials is included in Essential Eight pricing on Constant. When you move from Essential Eight to ASD Essentials, that move is part of the Essential Eight subscription.

There is no extra cost.

ASD Essentials tracker

Maturity you can defend

Essential Eight is not a checkbox list - maturity levels change what good looks like for each strategy. Constant keeps ML1-ML3 requirements, evidence, and assessor findings in one place so you can show real progress between audits.

Built for Australian organisations

  • Government and councils working toward ACSC Essential Eight maturity
  • DISP suppliers and defence-adjacent organisations with onshore requirements
  • MSPs managing Essential Eight across client portfolios
  • Teams preparing for cyber insurance or customer security questionnaires

Eight strategies. Expand for detail

Each Essential Eight strategy has distinct maturity expectations. Expand a strategy to see how Constant helps you track it.

Application controlPrevent execution of unapproved applications.

Track allowlisting scope from user profiles and temp folders through workstations, internet-facing servers, and full server coverage with central logging - with evidence that policies are enforced.

Patch applicationsClose application vulnerabilities within ACSC timeframes.

Map patch SLAs by maturity level - from internet-facing apps within two weeks through critical patches within 48 hours - and attach scan results and change records as evidence.

Configure Microsoft Office macrosReduce macro-based malware risk.

Assess macro controls from blocking internet macros to allowing only vetted macros in trusted locations, with configuration evidence and exception handling.

User application hardeningHarden browsers and user applications.

Track hardening baselines across user applications and browsers, including central policy enforcement at higher maturity levels.

Restrict administrative privilegesLimit and control privileged access.

Evidence privileged account hygiene, dedicated admin workstations, MFA, and just-in-time access with session logging as you move from ML1 to ML3.

Patch operating systemsKeep OS fleets within patch windows.

Align OS patching to maturity timeframes and prove coverage with inventory, vulnerability, and change evidence.

Multi-factor authenticationStrengthen authentication for users and privileged access.

Track MFA coverage from privileged and remote users through phishing-resistant MFA for all users, with enrolment and policy evidence.

Regular backupsEnsure recoverable, resilient backups.

Document backup scope, restoration testing, retention, and immutable or offline backups required at higher maturity levels.

Built for every maturity level

Constant maps your controls and evidence to the ACSC Essential Eight model across ML1, ML2, and ML3.

Strategy ML1 ML2 ML3
Application control Block execution from user profiles and temp folders Application control on workstations and internet-facing servers Application control on all servers with central logging
Patch applications Patch internet-facing apps within 2 weeks of release Patch non-internet-facing apps within 1 month Patch all apps within 48 hours of critical release
Configure Microsoft Office macros Block macros from the internet Block macros in files from untrusted sources Only allow vetted macros in trusted locations
User application hardening Harden user applications per ACSC guidance Extended hardening including web browsers Full hardening with central policy enforcement
Restrict administrative privileges Limit admin accounts and validate requests Dedicated admin workstations and MFA Just-in-time access with full session logging
Patch operating systems Patch internet-facing OS within 2 weeks Patch all OS within 1 month Patch all OS within 48 hours of critical release
Multi-factor authentication MFA for privileged users and remote access MFA for all users accessing important data Phishing-resistant MFA for all users
Regular backups Backup important data and test restoration Synchronise backups with retention policy Immutable, offline backups with tested recovery

What you get with Constant

Maturity dashboard

See your position across all eight strategies with clear ML1-ML3 indicators and progress over time.

Evidence collection

Centralise control evidence, assign owners, and track what is complete before assessors arrive.

Certified assessor review

Combine platform visibility with human judgement from Essential Eight professionals who understand Australian environments.

Onshore by design

Australian-owned infrastructure and support - critical for DISP suppliers, government, and defence-adjacent organisations.

Essential Eight topics

Explore focused guidance for maturity, evidence, reporting, audiences, and assessor review.

Assessor review

Automated evidence, AI pre-review, and a certified assessor behind the result.

Continuous compliance

Continuous compliance software for Australian organisations.

Maturity assessment

Essential Eight maturity assessment software for ML1, ML2, and ML3.

Maturity Level 2

Essential Eight Maturity Level 2 requirements and the evidence behind them.

Essential Eight for MSPs

Run Essential Eight assessments across a client portfolio with one method.

Essential Eight for DISP

Essential Eight evidence for DISP and defence suppliers, hosted in Australia.

Evidence collection

Automated Essential Eight evidence collection, plus upload where needed.

Reporting

Essential Eight reports for executives, boards, and assessors.

Local government

Essential Eight for councils, with evidence and assessor review.

ML2 evidence checklist

A static Essential Eight ML2 evidence checklist assessors can follow.

ASD Essentials

The ASD Essentials transition tracker. What ASD has published, and what it has not.

Comparisons

Factual comparisons of Constant with other Essential Eight approaches.

Essential Eight FAQs

What is Essential Eight compliance software?

Essential Eight compliance software helps organisations track their maturity against the Australian Cyber Security Centre Essential Eight mitigation strategies. It centralises evidence, maps controls to maturity levels, and supports audit readiness between formal assessments.

How does Constant map to Essential Eight maturity levels?

Constant tracks your position across all eight strategies at Maturity Level 1, 2, and 3. The platform surfaces gaps, assigns remediation tasks, and records evidence so assessors can validate your real maturity position - not just documentation.

Is Constant suitable for DISP and defence suppliers?

Yes. Constant is designed, owned, and operated in Australia with onshore data residency. This matters for DISP onboarding, government tenders, and any customer who needs a clear answer about where compliance evidence is stored and who can access it.

Do we still need a third-party Essential Eight audit?

Many customers use Constant alongside certified assessor reviews. The platform provides ongoing visibility between audits; assessors validate outcomes and provide independent judgement that automated tools alone cannot replace.

How is this different from generic GRC or compliance platforms?

General compliance tools are not built around the ACSC Essential Eight maturity model. Constant is purpose-built for Australian Essential Eight tracking, evidence collection, and assessor-led validation.

Can MSPs use Constant for multiple clients?

Yes. MSP partners use Constant to scale Essential Eight assessments across client portfolios with consistent methodology, centralised reporting, and independent maturity tracking.

Start your compliance journey today

Choose the right plan for your organisation. Scale seamlessly as your compliance needs evolve.

Ready to simplify your compliance process?

Book a demo and see constant in action.

Book a Demo Explore More

All Paid Plans Include

  • Unlimited human assessor reviews

  • Evidence collection

  • AI-assisted pre-reviews

  • Compliance dashboards

  • Australian business-hours support

  • On-demand reporting

  • Control owners and tasks

  • Evidence uploads

  • Maturity and gap tracking

  • Role-based access controls

  • Framework guidance

  • 5×5 Risk Matrix

  • Australian data residency