Establish which maturity level the clause names, measure your current level against ASD’s published assessment process, and respond with that position plus a committed uplift plan. Evaluators can work with ‘Maturity Level 1 now, Level 2 by a named date’. A compliance claim that fails a follow-up question puts the contract at risk.
The Essential Eight — published by the Australian Signals Directorate through the ACSC at cyber.gov.au — is assessed at Maturity Levels 0 to 3, so a clause that names no level is incomplete. Clauses take four common forms:
Two further details determine whether the response is a claim or a plan: whether the requirement applies at contract signature or within a period after award, and what evidence the buyer reserves the right to request.
The Essential Eight comprises eight mitigation strategies: application control, patch applications, configure Microsoft Office macro settings, user application hardening, restrict administrative privileges, patch operating systems, multi-factor authentication, regular backups. Maturity is assessed per strategy against ASD’s published assessment process, and the overall level is the lowest across the eight. A single unmanaged strategy sets the number that goes into the response.
Most organisations that have never assessed sit below their own estimate, usually because application control or administrative-privilege separation was never deliberately engineered, however well patching is run. A rapid gap assessment inside the tender window establishes the actual level. What Maturity Level 1 requires and what changes at Level 2 set out the distance to the clause.
| Your position | What the response contains |
|---|---|
| At or above the named level | The level, the assessment behind it, and the operating evidence that keeps it current |
| Below the level, gap is closable | Your current level, then a dated, resourced uplift plan to the named level |
| Below the level, gap is structural | A pre-submission conversation with the tender contact — some buyers accept transition periods |
The middle row covers most bidders, and it wins tenders. Evaluators working under the PSPF’s own bar deal with supplier uplift continuously. A statement of full compliance that does not survive a follow-up question is the weaker position, because the clause and the answer both survive into the contract.
An uplift plan is checkable when it names four things: the strategies currently below the level, the owner, the dates, and the form of assurance provided at completion — a self-assessment against ASD’s published process, an independent assessment, or an IRAP assessor where the tender specifies one. With no single central provider for any of this, naming the route removes the ambiguity for the evaluator.
An ISO 27001 certificate, a security policy pack or a questionnaire from the last deal addresses none of what a maturity-level clause asks, because the Essential Eight is a set of technical controls with a published assessment process rather than a documentation standard.
The opposite error is equally common: assuming Maturity Level 2 is required by the closing date, then either withdrawing or purchasing a compressed uplift the tender never demanded. Both errors follow from the same omission — reading the clause precisely and measuring the current position against it before deciding anything.
Tender windows are an expensive time to discover a maturity level, so we compress the discovery: a rapid assessment against ASD’s process, a response position you can defend, and a scoped uplift plan with dates a bid team can commit to. On a win, we run the uplift and the operations behind it, with governance and evidence maintained so a mid-contract request to demonstrate compliance is answered from file. Commercials are scoped to the engagement. Bring the clause to the readiness call.
The tender closes in two weeks. Can we get compliant in time?
Reaching a maturity level you are not currently at, inside two weeks, is not realistic — and the tender does not require it. Within a tender window you can establish your current level and commit to a dated uplift plan, which is a defensible response. A rushed compliance claim is not.
Can we answer yes and fix it after we win?
No. The clause survives into the contract, and the buyer can require you to demonstrate the maturity level mid-term. A claim you cannot evidence puts the contract and future dealings with that buyer at risk.
The clause says 'Essential Eight compliance' with no level. What does that mean?
It is ambiguous. The Essential Eight is assessed at Maturity Levels 0 to 3, so compliance carries no meaning without one. Ask the tender contact which level is intended. Buyers answer clarification questions as a matter of course, and it costs less than guessing in either direction.
Who can assess our maturity level?
There is no single central provider. It is a mix of self-assessment against ASD’s published assessment process, IRAP assessors where formal independent assurance is required, and private consultancies and MSPs. Check whether the tender specifies which it will accept.
What does Secure60 do in a tender situation?
Read the clause, establish your current maturity level quickly, draft the response position, then run the uplift and the ongoing operations behind it if you win. Commercials are scoped on a readiness call — bring the tender documents.
