Question 1

What is Essential Eight compliance software?

Accepted Answer

Essential Eight compliance software helps organisations track their maturity against the Australian Cyber Security Centre Essential Eight mitigation strategies. It centralises evidence, maps controls to maturity levels, and supports audit readiness between formal assessments.

Question 2

How does Constant map to Essential Eight maturity levels?

Accepted Answer

Constant tracks your position across all eight strategies at Maturity Level 1, 2, and 3. The platform surfaces gaps, assigns remediation tasks, and records evidence so assessors can validate your real maturity position — not just documentation.

Question 3

Is Constant suitable for DISP and defence suppliers?

Accepted Answer

Yes. Constant is designed, owned, and operated in Australia with onshore data residency. This matters for DISP onboarding, government tenders, and any customer who needs a clear answer about where compliance evidence is stored and who can access it.

Question 4

Do we still need a third-party Essential Eight audit?

Accepted Answer

Many customers use Constant alongside certified assessor reviews. The platform provides ongoing visibility between audits; assessors validate outcomes and provide independent judgement that automated tools alone cannot replace.

Question 5

How is this different from generic GRC or compliance platforms?

Accepted Answer

General compliance tools are not built around the ACSC Essential Eight maturity model. Constant is purpose-built for Australian Essential Eight tracking, evidence collection, and assessor-led validation.

Question 6

Can MSPs use Constant for multiple clients?

Accepted Answer

Yes. MSP partners use Constant to scale Essential Eight assessments across client portfolios with consistent methodology, centralised reporting, and independent maturity tracking.

Strategy	ML1	ML2	ML3
Application control	Block execution from user profiles and temp folders	Application control on workstations and internet-facing servers	Application control on all servers with central logging
Patch applications	Patch internet-facing apps within 2 weeks of release	Patch non-internet-facing apps within 1 month	Patch all apps within 48 hours of critical release
Configure Microsoft Office macros	Block macros from the internet	Block macros in files from untrusted sources	Only allow vetted macros in trusted locations
User application hardening	Harden user applications per ACSC guidance	Extended hardening including web browsers	Full hardening with central policy enforcement
Restrict administrative privileges	Limit admin accounts and validate requests	Dedicated admin workstations and MFA	Just-in-time access with full session logging
Patch operating systems	Patch internet-facing OS within 2 weeks	Patch all OS within 1 month	Patch all OS within 48 hours of critical release
Multi-factor authentication	MFA for privileged users and remote access	MFA for all users accessing important data	Phishing-resistant MFA for all users
Regular backups	Backup important data and test restoration	Synchronise backups with retention policy	Immutable, offline backups with tested recovery

Essential Eight compliance software built for Australian teams

From tick-box tracking to audit-ready maturity

Built for every maturity level

What you get with Constant

Maturity dashboard

Evidence collection

Certified assessor review

Onshore by design

Essential Eight software FAQs

Start your compliance journey today

Ready to simplify your compliance process?

All Paid Plans Include