Don’t guess and don’t overclaim. Work out which maturity level the clause actually names, establish your current level against ASD’s published assessment process, and respond with that honest position plus a committed uplift plan. Evaluators handle ‘Maturity Level 1 now, Level 2 by a named date’ far better than a compliance claim that collapses under one follow-up question.
You know this moment. The tender lands, procurement flags schedule 4, and there’s a clause you’ve never had to answer before: “the supplier must maintain compliance with the ACSC Essential Eight.” The deadline hasn’t moved. Nobody on the team is certain what your honest answer is.
Start with the words, because they vary and the variation decides your next two weeks. The Essential Eight — published by the Australian Signals Directorate through the ACSC at cyber.gov.au — is assessed at Maturity Levels 0 to 3, so any clause that doesn’t name a level is incomplete. Some name Maturity Level 2, mirroring what the Protective Security Policy Framework mandates for the federal entities themselves (the mandate binds them; it reaches you through this clause). Some name Maturity Level 1. Some specify the form of assurance — independent assessment, occasionally an IRAP assessor. And some just say “compliance,” in which case your first move is a clarification question to the tender contact. That question costs nothing and is answered routinely; a wrong guess costs you either the bid or an uplift you didn’t need.
While you’re reading, note two more things: whether the requirement applies at contract signature or within a period after award, and what evidence the buyer reserves the right to ask for. Those two details determine whether you’re writing a claim or a plan.
The Essential Eight is eight specific mitigation strategies: application control, patch applications, configure Microsoft Office macro settings, user application hardening, restrict administrative privileges, patch operating systems, multi-factor authentication, regular backups. Your maturity level is assessed per strategy against ASD’s published assessment process, and your overall level is the lowest across the eight. One unmanaged strategy sets the number you have to write down.
That rule is why guessing is dangerous. Most organisations that have never assessed sit lower than they’d estimate — usually because application control or administrative-privilege separation was never deliberately engineered, however good the patching is. A rapid gap assessment inside the tender window tells you the real number; what Maturity Level 1 requires and what changes at Level 2 tell you the distance to the clause.
Then write the response the evaluator can actually work with.
| Your position | What to write |
|---|---|
| At or above the named level | State the level, the assessment behind it, and the operating evidence that keeps it current |
| Below the level, gap is closable | State your current level, then a dated, resourced uplift plan to the named level — commitment, not aspiration |
| Below the level, gap is structural | Raise it with the tender contact before submission; some buyers accept transition periods, and finding out is free |
The middle row is where most bidders live, and it wins tenders more often than people expect. Evaluators working under the PSPF’s own bar deal with supplier uplift constantly. What they can’t work with is a “fully compliant” that dissolves under a single follow-up — because the clause survives into the contract, and so does your answer.
If you’re writing an uplift plan, make it read like a project, not a promise. Name the strategies currently below the level, the owner, the dates, and the form of assurance you’ll provide at completion — a self-assessment against ASD’s published process, an independent assessment, or an IRAP assessor if the tender specifies one. There’s no single central provider for any of this, so state which route you’re taking rather than leaving the evaluator to wonder. A plan with those four elements is checkable, and checkable is what scores.
Treating the clause as a paperwork question and reaching for the nearest certificate. An ISO 27001 certificate, a security policy pack, a completed questionnaire from the last deal — none of them answers a clause denominated in maturity levels, because the Essential Eight is a set of technical controls with a published assessment process, not a documentation standard. The opposite error is just as common: panicking, assuming you need Maturity Level 2 by the closing date, and either withdrawing or buying a compressed uplift the tender never demanded. Both mistakes come from skipping the same step — reading the clause precisely and measuring your real position against it before deciding anything.
Tender windows are the wrong time to discover your maturity level, so we compress the discovery: a rapid assessment against ASD’s process, a response position you can defend, and a scoped uplift plan with dates a bid team can commit to. Win it, and we run the uplift and the operations behind it, with governance and evidence maintained so the mid-contract “please demonstrate” letter is a lookup, not a project. Commercials are scoped to the engagement. Book the readiness call before the deadline gets closer — and bring the clause.
The tender closes in two weeks. Can we get compliant in time?
Almost certainly not, if ‘compliant’ means reaching a maturity level you’re not at — and you don’t need to. What you can do inside a tender window is establish your current level honestly and commit to a dated uplift plan. That’s a credible response; a rushed claim isn’t.
Can we just answer yes and fix it after we win?
Don’t. The clause survives into the contract, and the buyer can ask you to demonstrate the maturity level mid-term. A claim you can’t evidence risks the contract itself and every future dealing with that buyer.
The clause just says 'Essential Eight compliance' with no level. What does that mean?
It’s ambiguous — the Essential Eight is assessed at Maturity Levels 0 to 3, so ‘compliance’ means nothing without one. Ask the tender contact which level they intend. Buyers answer clarification questions all day; it’s cheaper than guessing in either direction.
Who can assess our maturity level?
There’s no single central provider. It’s a mix of self-assessment against ASD’s published assessment process, IRAP assessors where formal independent assurance is required, and private consultancies and MSPs. Check whether the tender specifies which it will accept.
What does Secure60 actually do in a tender situation?
Read the clause, establish your current maturity level fast, draft the response position, then run the uplift and the ongoing operations behind it if you win. Commercials are scoped on a readiness call — bring the tender documents.
