Applies to your whole business; there's no partial scope. Your decision is which level. 

A clear written picture of where you stand, and what has to change to reach your target level.

Get full drafted copies of context specific documents that are required at each level of the standard.

The SelfCybr team will work with your stakeholders to collect all the required evidence and present it the way an assessor expects it.

We deal with the certification body or assessor on your behalf. We will send you the submission for final signature before managing the certification process for you. Certification platform fee is included.

Most businesses already have an IT provider, and the controls are theirs to configure — we tell them exactly what's needed and check the result. If you'd rather we did the work, or you don't have a provider, you can add that service on when getting started.

Applies to your whole environment; there's no partial scope. Your decision is which maturity level. 

A clear written picture of where you stand, and what has to change to reach your target level.

Patching schedules, backup and restore procedures, application control and access policies — the documentation that makes your maturity level defensible and repeatable, rather than a point-in-time snapshot.

We collect and package the evidence for your maturity level, so you can hand it straight to a tender response, an insurer, or a customer's security questionnaire without rebuilding it each time.

Regular technical meetings with the SelfCybr team to work with your stakeholders to implement the technical controls to the maturity requirements. Implementation is included here, because with the Essential Eight the technical work is the engagement.

Clear roadmap for what is required and recommendations for achieving the next level of maturity (if applicable).

The Essential Eight has no formal certification — anyone offering you one is selling something else. What you get is an assessed maturity level with the evidence to back it, which is what tenders and insurers actually ask for.

The one standard where scope is a real decision. We define your scope statement with you at the start — it can cover your whole business, a single product line, or one site. Getting this right is the difference between a manageable certification and an unmanageable one.

ISO is built on your risk assessment, not a fixed control list. We run the assessment with you, produce the risk treatment plan, and write the Statement of Applicability — the document your auditor will open first.

ISO prescribes a mandatory document set — information security policy, SoA, risk methodology, objectives, and the operational procedures underneath them. All drafted for your business at your defined scope.

Stage 1 tests whether your documentation holds up. Stage 2 tests whether you're actually doing it. We collect and package evidence for both, so the auditor finds what they're looking for without a scramble.

ISO requires you to audit yourself and hold a documented management review before the certification body will proceed. We run the internal audit and chair the review, and produce the records your auditor will ask for.

We prepare your submission and deal with the accredited certification body through Stage 1 and Stage 2. Their audit fees are paid directly to them — you're never paying us a margin on someone else's invoice.

Certification lasts three years, with a surveillance audit each year in between. The management system has to keep running — internal audits, management reviews, risk reassessment. We'll tell you what that costs to maintain before you commit, not after you're certified.