What does Essential Eight Maturity Level 1 actually cost?
Updated 18 August 2026 · 9 minute read
Short answer
For a typical 20-person Australian business, reaching Essential Eight Maturity Level 1 costs roughly $10,000 to $17,500 as a one-off implementation, plus about $735 a month in licences — around $37 per user per month. The single biggest lever is Microsoft 365 Business Premium at $32.90 per user per month, which bundles the tooling behind five of the eight strategies. Most of the total is labour rather than licensing, and three of the eight strategies cost nothing but configuration and discipline.
The short answer
Nobody publishes this number, so here it is. For a 20-person Australian business starting from Microsoft 365 Business Standard with no security tooling in place, reaching Maturity Level 1 across all eight strategies costs approximately $10,000 to $17,500 in one-off implementation work, and about $735 a month in ongoing licences.
That works out at roughly $37 per user per month in licensing, plus a project cost of between $500 and $875 per user depending on how much cleanup is required.
The range is wide for one reason: the licensing is nearly fixed, and the labour is not. A business with clean, documented systems lands at the bottom. A business with unsupported servers, shared admin passwords and software nobody can account for lands at the top, or above it.
Licences are the smaller half. Labour is between half and two-thirds of the first-year cost — and labour is the part that varies with how much mess is already there.
Why the licensing question has one dominant answer
Microsoft 365 Business Premium is the reason this is affordable at all. At $32.90 per user per month it bundles Intune, Defender for Business and Entra ID P1 — the tooling behind application patching, operating system patching, multi-factor authentication, restricting administrative privileges and user application hardening.
Bought separately those components cost more than the bundle. Defender for Business is $4.50 per user per month standalone and Entra ID P1 is $10.50, so a business on Business Standard adding both is paying around $36 per user per month for less capability than Business Premium provides at $32.90.
Microsoft repriced Microsoft 365 on 1 July 2026. Business Basic and Business Standard both rose; Business Premium was held. That has quietly narrowed the gap between Standard and Premium, which changes the maths for a lot of businesses that chose Standard years ago and never revisited it.
| Licence | Price | What it contributes to Maturity Level 1 |
|---|---|---|
| Microsoft 365 Business Premium | $32.90 | Intune, Defender for Business, Entra ID P1 — the tooling for five of the eight strategies |
| Microsoft 365 Business Standard | ~$21 | Office and email only. No security tooling — everything below has to be added |
| Defender for Business (standalone) | $4.50 | Endpoint protection, if you're staying on Standard |
| Entra ID P1 (standalone) | $10.50 | Conditional Access — needed to enforce MFA properly rather than per-user |
| Microsoft 365 Backup | $0.15 per GB/month | Backups of Exchange, SharePoint and OneDrive. Consumption-billed |
The three strategies that cost nothing
This is the part that surprises people. Three of the eight strategies require no purchase at all at Maturity Level 1. They are configuration changes and standing habits, and they are free in licensing terms.
That does not make them easy. Restricting administrative privileges is usually the most politically difficult thing on the list, because it means taking local admin away from people who have had it for years — including, frequently, the person signing off the project.
- Restrict Microsoft Office macros — a policy setting. Blocking macros from the internet is free and takes minutes to apply, though flushing out which internal macros are genuinely in use takes longer.
- User application hardening — disabling Flash, ads and Java in browsers is configuration, delivered through Intune, which Business Premium already includes.
- Restrict administrative privileges — removing local admin rights and separating admin accounts costs no money at all. It costs goodwill, and it needs the business owner to back it publicly.
- Regular backups sit close to free too, if you already pay for Microsoft 365 Backup or an equivalent. What is not free is proving the restore works, which is labour and is the step almost everyone skips.
Where the labour actually goes
The hours below are our own project estimates for a 20-user business with reasonably standard Microsoft 365 systems. They are not vendor figures and they are not a quote. Application control is consistently the hardest strategy at Maturity Level 1, and it is where projects overrun.
| Strategy | Typical hours | At $165/hr |
|---|---|---|
| Discovery — application and OS inventory | 4–8 | $660–$1,320 |
| Multi-factor authentication and Conditional Access | 8–12 | $1,320–$1,980 |
| Patch applications | 8–12 | $1,320–$1,980 |
| Patch operating systems | 6–10 | $990–$1,650 |
| Restrict administrative privileges | 8–16 | $1,320–$2,640 |
| Application control | 12–24 | $1,980–$3,960 |
| Restrict Office macros | 2–4 | $330–$660 |
| User application hardening | 4–8 | $660–$1,320 |
| Backups, plus a tested restore | 8–12 | $1,320–$1,980 |
| Total | 60–106 | $9,900–$17,490 |
Application control is roughly a quarter of the project on its own. Any quote that treats it as a couple of hours has either scoped it wrong or is planning to deploy it in audit mode and call that done.
Worked example: a 20-person Brisbane business
A professional services firm, 20 staff, all on Microsoft 365 Business Standard, MFA switched on for email only, patching left to whenever Windows gets around to it, and backups running to a NAS that has never been restored from.
That is an ordinary starting point, and it is roughly Maturity Level 0 across most strategies.
| Line | Cost |
|---|---|
| Business Premium, 20 users at $32.90 (up from Standard, so +$240/mth) | $658/month |
| Microsoft 365 Backup, approx. 500 GB protected at $0.15/GB | $75/month |
| Ongoing licences, total | $733/month |
| Licences over twelve months | $8,796 |
| One-off implementation, 60–106 hours at $165 | $9,900–$17,490 |
| Ongoing maintenance — patch cadence, access reviews, restore tests | 4–8 hrs/month |
| First-year total, excluding maintenance time | $18,700–$26,300 |
What it costs to stay there
Maturity Level 1 is not a certificate you earn once. It is a set of ongoing cadences, and a business that reaches Level 1 and then stops doing the work is back at Level 0 within a few months without anything visibly changing.
Holding the line takes roughly four to eight hours a month for a business this size: applying patches within the required windows, reviewing who has administrative access, checking that backups still cover what matters, and running a genuine test restore on a schedule. Whether that is internal time or part of a managed service, it is real and it is recurring.
For context, our own managed IT is $115 per user per month, which includes this maintenance rather than billing it separately. The point is not the specific number — it is that the ongoing work has to live somewhere, and a project quote that ends at go-live has left it out.
What moves the number most
- Unsupported operating systems. Anything running an OS past vendor support cannot reach Level 1 at all, and replacement hardware is a separate capital cost that dwarfs the project.
- Line-of-business software that demands local admin rights. One badly behaved application can add days to the administrative privileges work, and occasionally forces a vendor conversation you cannot win quickly.
- The number of distinct applications in use. Application control effort scales with variety, not headcount — a 50-person business running six applications is easier than a 15-person business running forty.
- Whether anyone knows what you actually have. Businesses without an asset inventory spend the first chunk of the project building one, which is why discovery is a line item rather than a freebie.
- Servers. The figures here assume a Microsoft 365 environment with no on-premises servers. Each server adds patching, backup and access-control work.
Is it worth it?
Cyber insurers and government tenders increasingly ask about Essential Eight maturity by name, so for a lot of businesses the honest answer is that the cost of not doing it is losing work you would otherwise win. That is a commercial calculation rather than a security one, and it is usually the one that gets the project approved.
The security argument is simpler. Maturity Level 1 is explicitly aimed at stopping attackers using widely available, commodity techniques. It will not stop a determined, targeted attacker — that is what Levels 2 and 3 are for — but the overwhelming majority of what actually reaches an Australian small business is commodity.
One caution worth stating plainly: ASD's guidance is to reach the same maturity level across all eight strategies before progressing. Spending on one strategy while another sits at Level 0 buys very little, because the weakest strategy is the one that defines your real exposure.
Quick answers
How much does Essential Eight Maturity Level 1 cost?
For a 20-person Australian business, roughly $10,000 to $17,500 as a one-off implementation plus about $735 a month in licences — around $37 per user per month ongoing. Licensing is the smaller half; labour is between half and two-thirds of the first-year cost, and it varies with how much remediation is needed before the controls can be applied.
Do I need Microsoft 365 Business Premium for the Essential Eight?
You don't strictly need it, but it is the cheapest realistic route for most small businesses. At $32.90 per user per month it bundles Intune, Defender for Business and Entra ID P1, which together underpin five of the eight strategies. Adding Defender for Business and Entra ID P1 to a Business Standard licence separately costs about $36 per user per month for less capability.
Which Essential Eight strategy costs the most to implement?
Application control, consistently. It typically takes 12 to 24 hours for a 20-user business — around a quarter of the whole project — because it requires knowing every application in use, building a rule set, testing it against real workflows, and handling the exceptions. It is also the strategy most often quietly left in audit mode, which is not the same as implemented.
Can we reach Maturity Level 1 without spending anything?
Three of the eight strategies are configuration rather than purchase: restricting Office macros, user application hardening, and restricting administrative privileges. If you already hold Business Premium licences you could make meaningful progress on those with internal time alone. But reaching Level 1 across all eight, with evidence, is not a no-cost exercise — and restricting admin rights costs political capital even where it costs no money.
Are these prices including GST?
No. Every figure on this page is in Australian dollars excluding GST, on annual-commitment licensing. Monthly-commitment billing typically runs about 20% higher, and pricing through a Cloud Solution Provider varies. Microsoft repriced Microsoft 365 on 1 July 2026, so figures published before that date are out of date.
How long does it take to reach Maturity Level 1?
For a 20-person business with no major blockers, six to ten weeks of elapsed time is realistic. The work itself is 60 to 106 hours, but it can't all be done at once — patching and application control need observation periods, and removing administrative privileges works far better staged than done overnight.
Want this costed for your business, not a hypothetical one?
Take the free three-minute assessment to see where you actually sit, then book a 30-minute review and we'll put real numbers against your gaps — including an honest answer if some of them aren't worth closing yet.