Herile IT Agency Web Design & Development
- Agency
- Website
The Problem
Your Contract Asks for Maturity Level Two and Nobody Has Measured
It shows up when a government client, a larger customer, or a cyber insurer asks for your Essential Eight maturity level. The honest answer is often a guess from an old spreadsheet.
Self-assessment
Your maturity level came from a spreadsheet, not the devices.
Self-assessment
We export Intune, Entra ID, and Defender settings and test each control on real devices.
Macros
Office macros from the internet still run on staff laptops.
Macros
Macro rules set by policy, with signed or approved macros only where staff need them.
Admin accounts
Admins browse the web and read email with privileged accounts.
Admin accounts
Separate admin accounts with no email or web access, removed when staff leave.
Backups
Backups run nightly, but nobody has tested a full restore.
Backups
A restore to a common point in time, tested as part of a recovery exercise.
A tender form asks for your Essential Eight maturity level, and the box needs a number by Friday. Your IT provider says you're mostly at Level Two. Can staff run unsigned programs from their Downloads folder? Are Office macros from the internet blocked? Do admins read email with the account they use to change firewall rules? Has anyone tested a full restore? A score that skips these checks won't survive a closer look.
We start with evidence, not interviews. We read settings from Intune, Entra ID, and Defender, test application control and macro blocking on real devices, and score each strategy against the current ASD model. Then we raise every strategy to the same level before climbing, as ASD advises. Patch windows follow: 48 hours for critical flaws in internet-facing systems, 2 weeks for the rest, and 1 month for workstations. You get a score that holds up when someone checks it.
Evidence from live settings
Scores come from exported settings and device tests, so you can show every level to an assessor.
Same level across all eight
We lift the weakest strategy first, because ASD says to reach one level everywhere before the next.
Patch windows that hold
Fortnightly scans plus 48-hour, 2-week, and 1-month patch rules set up in your own tools.
Our Essential Eight Compliance Process
From First Evidence Pull to a Defensible Maturity Level in Five Steps
You see the evidence behind every score and approve the target level, the order of fixes, and each change before it reaches staff.
We ask which contract, insurer, or customer wants a maturity level, how many devices are in scope, and which tools you run. You get a scope note and a fixed quote before any access is granted.
Projects We've Built
Business Platforms and Apps We Have Built
IT agency, HR, attendance, and booking platforms we designed and built. They show how we work on real systems, not past Essential Eight projects.
Login HR Staffing App Design & Development
- HR & Staffing
- Portal
- Dashboard
HR Attendee Attendance App Design & Development
- HR & Staffing
- Dashboard
- Mobile App
DocLink Doctor Booking App Design & Development
- Business
- Medical
- Booking System
What's Included
What You Get With an Essential Eight Assessment
Every project covers scope, evidence collection, a scored assessment of all eight strategies, an uplift plan, the fixes your plan includes, and a retest.
Compare Options
DeveloperLook vs Managed IT Provider vs DIY Checklist
Your IT provider knows your network, and an Essential Eight checklist is a cheap first pass. Here is where each one fits.
| Feature | DeveloperLookBest fit | Managed IT provider | DIY checklist |
|---|---|---|---|
| Scoping | Every in-scope device listed | Often the devices they manage | Whatever you remember to include |
| Evidence | Exported settings and device tests | Dashboard reports, varies by provider | Yes or no answers |
| Scoring method | Each requirement, current ASD model | Often a summary rating | Self-scored, no second check |
| Fixes | Pilot group, then every device | Strong, if it's in their contract | Done by your own staff |
| Cost | Fixed price from $900 | Bundled into monthly fees | Free, apart from staff time |
| Speed to start | Scoping call within days | Fast, they already have access | You can start today |
| Second opinion | Outside view of your setup | Grades its own setup | No outside view |
| Ongoing patching | Handed back with run sheets | Runs it every month | Depends on staff time |
DeveloperLook
Managed IT provider
- Scoping
- DeveloperLook: Every in-scope device listedManaged IT provider: Often the devices they manage
- Evidence
- DeveloperLook: Exported settings and device testsManaged IT provider: Dashboard reports, varies by provider
- Scoring method
- DeveloperLook: Each requirement, current ASD modelManaged IT provider: Often a summary rating
- Fixes
- DeveloperLook: Pilot group, then every deviceManaged IT provider: Strong, if it's in their contract
- Cost
- DeveloperLook: Fixed price from $900Managed IT provider: Bundled into monthly fees
- Speed to start
- DeveloperLook: Scoping call within daysManaged IT provider: Fast, they already have access
- Second opinion
- DeveloperLook: Outside view of your setupManaged IT provider: Grades its own setup
- Ongoing patching
- DeveloperLook: Handed back with run sheetsManaged IT provider: Runs it every month
What Our Clients Say
What Clients Say After Launch
Feedback from teams we have built platforms, apps, and websites for.
We had a pretty specific idea of what we wanted our website to become, but I wasn’t sure how easily we could explain all of it to a development team. There were quite a few moving parts, and we were working toward a deadline, so I expected a few things to get lost along the way. That never really happened. They understood what we were trying to achieve, kept us updated throughout the process, and got everything ready within the agreed timeline. The final site feels much easier to navigate, works beautifully on mobile, and is noticeably smoother for our customers. It was a huge relief seeing the original idea actually turn into the website we had in mind.
The mobile experience is probably my favourite part of the new site. We had spent a lot of time making sure the desktop version looked right, and the team kept pushing us to think about how everything would actually feel on a phone too. They were right. The navigation is clean, the interactions feel natural, and everything we’ve tested so far works exactly as it should. They also went through the links, forms, integrations, and other details more than once before launch, which I really appreciated. And even after going live, we could still reach out when something came up. The whole process felt friendly, organised, and surprisingly straightforward.
What I appreciate most is that the website is actually easy for us to manage now. We can update content ourselves instead of sending a developer a message every time we need to change something small. They also paid attention to the technical SEO side, which mattered to us because we didn’t want a new website to create problems for the traffic we already had. I’ve probably asked more questions than I should have since launch, but every question has been handled patiently and without any fuss. The team is easy to work with, they explain things clearly, and when we need something changed, they focus on getting it done rather than making the process complicated.
1,250+
Projects shipped
10+
Years of experience
5 stars
Clutch rating
5 stars
GoodFirms rating
Excellent
Trustpilot rating
Top 3%
Upwork Top Rated Plus
1,250+
Projects shipped
10+
Years of experience
5 stars
Clutch rating
5 stars
GoodFirms rating
Excellent
Trustpilot rating
Top 3%
Upwork Top Rated Plus
Want results like these?
Tell us what you are building. You get a reply within 24 hours on business days, then a written estimate.
Work Culture
Why Australian Teams Trust Us With Their Maturity Score
A maturity level only helps if it survives a closer look. These habits keep the score honest and the fixes safe for busy staff.
We score what we see
A setting counts only when we can show it in an export or a device test. Your level then holds up when someone asks for proof.
Pilot group before everyone
Application control and macro rules go to a small group first. Staff who need a blocked tool get an approved path before the rule goes wide.
Plain talk about Level Zero
If a strategy sits at Maturity Level Zero, the report says so. You hear it from us before a tender reviewer or insurer finds it.
Read-only access first
Scoring uses read-only roles that you can revoke in one click. Change rights come later, and only for the fixes you approve.
Calls in your business hours
We work remotely with Australian teams and book calls in AU business hours. Updates arrive in writing, so nothing depends on memory.
Fixed price after scoping
You get a fixed quote once device counts and tools are known. Extra devices or tenants are priced before any work on them starts.
Overview
Who handles essential 8 compliance for Australian businesses?
DeveloperLook handles essential 8 compliance for Australian businesses, scoring all eight strategies from live settings instead of a questionnaire. Each project includes a maturity assessment, a ranked uplift plan, and fixes in Microsoft 365, Intune, and Entra ID. Projects start at $900 and take 2 to 10 weeks, with no certificate promised because none exists.
DEVELOPERLOOK
Project facts · Essential Eight Compliance
- Service
- Essential Eight compliance (maturity assessment, uplift plan, Microsoft 365 fixes, retest)
- Typical timeline
- 1 to 2 weeks to assess, 4 to 10 weeks to uplift
- Platforms
- Windows 11, Windows Server, Microsoft 365, Intune, and Entra ID
- Built with
- Intune, Defender for Endpoint, App Control for Business, PowerShell
- Experience
- 10+ years of development experience and 1,250+ shipped projects
- Post-launch support
- 30 days of questions and retest help
- Communication
- Calls in US, UK, and AU business hours
- Starting price
- From $900 USD, fixed scope after a scoping call
Reviewed 26 Oct 2026 by Saimul Islam
Good fit
Suppliers to Australian government agencies
Your agency client's contract names Maturity Level Two, and the security schedule asks for evidence you can't produce from a spreadsheet.
Businesses renewing cyber insurance
Your cyber insurance renewal asks about MFA, backups, and admin accounts, and you want answers you can prove before you sign the form.
IT managers with a board deadline
Your board asked for an Essential Eight score by next quarter, and you need an outside view of the settings your team built.
Teams already running Intune and Defender
Your devices already run Intune and Defender, but nobody has checked whether the policies meet essential 8 compliance requirements at Level One.
Firms after a phishing scare
Your team clicked a fake invoice link last month, and you want the eight baseline controls in place before the next attempt arrives.
Not a fit
Need a UK certificate
You need a Cyber Essentials certificate for a UK contract. Our Cyber Essentials Certification Support page covers that scheme and its question set.
Want monthly patching
You want someone to run patching every month after the uplift. Patch Management Services covers that ongoing work instead.
Need an official certificate
You need an official Essential Eight certificate. ASD doesn't issue one, so any provider selling a certificate is selling its own document.
Budget under $900
Your budget is under $900 and you run fewer than 10 devices. ASD's free guidance and a self-check are a better first step.
Not sure we're the right fit?
Book a free call or message us. We'll tell you honestly whether we're the right team.
Pricing
Transparent Starting Prices for Essential Eight Compliance
These are starting points in USD. Your final price depends on your device count, target maturity level, and number of tenants, and you get a fixed proposal after a free scoping call.
For Agencies
White-Label Essential Eight Services for MSPs and IT Partners
You own the client relationship. We supply the scoring, the uplift plan, and the Intune and Entra ID policy work under your brand. Your clients get an outside view, and you add no security staff.
How the partnership works
White label: your client only ever sees your brand
Your clientSees only your brand
You, the agencyOwn the relationship
DeveloperLookBehind your brand
Share the client brief
Send the device count, tenant details, and the level the client's contract names.
- Client needs
- You share the details
- Details received
We score and plan
We run the assessment with read-only access and draft the uplift plan for your review.
- Scope and plan
- Proposal to resell
- Your quoteYOUR LOGO
Fix and hand off
We apply approved fixes, rerun the score, and hand you a white-label evidence pack.
- Done by our team
- Your brand on it
- Handed to your clientDone
- Your client
- You, the agency
- DeveloperLook
Share the client brief
Send the device count, tenant details, and the level the client's contract names.
- Client needs
- You share the details
- Details received
We score and plan
We run the assessment with read-only access and draft the uplift plan for your review.
- Scope and plan
- Proposal to resell
- Your quoteYOUR LOGO
Fix and hand off
We apply approved fixes, rerun the score, and hand you a white-label evidence pack.
- Done by our team
- Your brand on it
- Handed to your clientDone
Partner with DeveloperLookDelivered under your brand
The Right Technology for Your Project
Technology Stack
We work inside the Microsoft tools most Australian businesses already pay for, and use ASD's own guidance to decide what counts as done.
- Microsoft Entra ID
- Microsoft Authenticator
- YubiKey
- Windows Hello for Business
- Microsoft Intune
- App Control for Business
- Microsoft Defender for Endpoint
- Attack surface reduction rules
- Windows Update for Business
- Defender Vulnerability Management
Azure Backup- PowerShell
- ASD Essential Eight maturity model
- Essential Eight assessment process guide
- Microsoft Excel
- Jira
01 / 04
FAQ
Frequently Asked Questions
Straight answers on cost, timelines, maturity levels, certification, and what the eight strategies cover.
Saimul IslamFounder & CEO, DeveloperLookStill have questions?
Send a message or book a call with the team.
Essential Eight work with us starts at $900 for a maturity assessment of up to 25 devices. Level One uplift starts at $3,100, and Level Two uplift starts at $6,600 for up to 150 devices. Prices are in USD and fixed after a free scoping call.
Most assessments take 1 to 2 weeks, and uplift takes 4 to 10 weeks. Level One across all eight strategies usually fits in 4 to 5 weeks for up to 75 devices. Level Two takes longer, because application control and phishing-resistant MFA need pilot testing first.
The Essential Eight is a set of eight mitigation strategies from the Australian Signals Directorate (ASD) that make common cyber attacks harder. ASD recommends them as a baseline, drawn from its wider Strategies to Mitigate Cyber Security Incidents. The maturity model grades each one from Level Zero to Level Three.
ASD lists eight: patch applications, patch operating systems, multi-factor authentication, restrict administrative privileges, application control, restrict Microsoft Office macros, user application hardening, and regular backups. Together they make malicious code harder to run, limit how far an attacker moves, and let you recover lost data quickly.
Maturity Level Two is the middle target level, aimed at attackers who spend more time on a target and use better tools. Compared with Level One, it adds phishing-resistant MFA, Microsoft's recommended application blocklist, yearly ruleset reviews, and central event logging. ASD's FAQ suggests Level Two may suit large enterprises.
Victorian organizations follow the same national ASD model, because there is no separate Victorian version of the Essential Eight. Start with a scored assessment, pick a target level, and lift all eight strategies to it in order. State public sector bodies may carry extra obligations, so confirm those with your department.
Endpoint tools enforce several strategies directly on each device. Intune pushes application control, macro rules, and browser hardening, while Defender for Endpoint reports missing patches and blocked attack techniques. The product alone doesn't meet the model: assessors check whether its settings match each written requirement.
You can't get an official certificate, because ASD doesn't certify organizations against the Essential Eight. What you can get is an assessment against the maturity model, ideally by someone independent, following ASD's Essential Eight assessment process guide. We prepare the evidence pack an assessor, customer, or insurer can check.
Most businesses target Level One or Level Two. ASD's FAQ suggests Level One may suit small to medium enterprises, Level Two large enterprises, and Level Three critical infrastructure. If a contract names a level, that sets your target, and ASD advises reaching it across all eight strategies before climbing higher.
Yes. We deliver essential 8 compliance services Australia-wide, fully remotely, with calls booked in AU business hours. Read-only access and screen sharing cover the assessment. After handover you get 30 days of questions and retest help, plus run sheets your own IT team can follow.
Saimul IslamFounder & CEO, DeveloperLookStill have questions?
Send a message or book a call with the team.
Free 30-min callGoogle Meet
Book a call
Book a free 30-minute call
In 30 minutes on Google Meet we walk you through how we would build it, how long it takes and what it costs. Then you get a written estimate.
Calendar not showing? Book on cal.com or send a brief.