The short version: If your client sells to government or Defence, expect to be asked for proof of Essential Eight Maturity Level 2, not a promise. Build one evidence pack per client: a dated scan or export for every control, a short gap list with owners and dates, and a signed director statement. Start four weeks before the tender closes, because gaps take longer to fix than to find.
What are tenders and DISP asking for?
They are asking for the same thing: evidence that the supplier meets Essential Eight Maturity Level 2. Defence's cyber and assurance page says assessments against the top 4 ended on 15 November 2025, and that all Defence Industry Security Program (DISP) members must achieve and maintain full Maturity Level 2.
Defence's eligibility page says the standard applies to the corporate ICT systems used to correspond with Defence. That scoping detail matters. It can shrink the job.
Is the Essential Eight a legal requirement?
Not for most suppliers. The Commonwealth Procurement Rules require agencies to manage security risk in their procurements, and the Australian National Audit Office reports that Protective Security Policy Framework (PSPF) policies 6 and 10 set the mandatory supply chain requirements for non-corporate Commonwealth entities. That flows down to you as tender questions and contract clauses. Law firm HWL Ebsworth describes agencies updating tender templates to ask how tenderers manage cyber risk.
So your client rarely breaks a law by missing ML2. They lose the tender or the membership.
What goes in the evidence pack?
One pack per client, one section per Essential Eight strategy. Each section holds the same four things.
| Item | What it is | Example |
|---|---|---|
| Status | Met, not met, or needs review | "Not met: 2 users excluded from MFA" |
| Evidence | A dated export from the system | Conditional Access policy list, 9 Oct 2026 |
| Owner | Who fixes a gap | Client IT lead or MSP engineer |
| Fix date | When it will be met | 30 Oct 2026 |
Add a one-page cover: scope (which systems), assessment date, and a director statement. The client signs it, not you.
Which controls cause the most trouble?
The Microsoft 365 controls are quick to evidence. The rest take longer. Plan your weeks around that.
- Easy to prove in Microsoft 365: MFA, Conditional Access, admin account separation, Office macro settings, user application hardening, patching status from Intune.
- Slow to prove: application control, restricted admin privileges that stand up to a review, and tested backups. The ML2 post explains the detail.
- Logging: ASD's ML2 changes add centralised event log collection and analysis. Many small clients have logs but nobody reads them.
ASD's assessment process guide describes how assessors test and gather evidence. Read it once so your pack matches what an assessor expects.
If you're a small business
Ask your IT provider for the pack, in writing, before the tender is due. You sign the statement, so read every "met". Ask for the evidence behind three of them at random. If it is a screenshot with no date, ask for a new one.
Be honest about gaps. A "not met" with a fix date is a better answer than a "met" an assessor can disprove. Defence itself expects an uplift program for members who fall short.
If you're an MSP
Run this four-week plan for each client.
- Week 1: scope the systems. Scan the tenant. List every control as met, not met or needs review.
- Week 2: fix the quick wins and save dated evidence as you go.
- Week 3: tackle application control and admin privileges. Record exceptions and who approved them.
- Week 4: re-scan, build the pack, get the director to review and sign.
Charge for it. It is a fixed-scope deliverable with a clear buyer deadline. Our post on the evidence problem covers how to file the proof.
Worked example
A 25-person engineering firm bids for a Defence subcontract and its prime asks for ML2 evidence. Its MSP scans the Microsoft 365 tenant in week 1 and finds MFA excluded for two service accounts, no application control and no tested restore. The MSP closes the MFA gap in a day, starts application control in audit mode, runs a restore test and saves the log. By week 4 the pack shows 5 controls met, 3 with fix dates and an honest note on each. The director signs. The prime sees dated proof instead of a yes.
Where CYBERWHITE fits
CYBERWHITE scans a Microsoft 365 tenant against 107 Essential Eight ML1 and ML2 controls in about 5 minutes and shows each control as met, not met or needs review, with evidence. Controls outside Microsoft 365, such as backups and policies, are recorded through attestation, and CYBERWHITE does not claim to verify them. 164 remediation actions are mapped and 61 deploy in one click, with snapshot and rollback. It does not guarantee a tender win or DISP membership. Try the free Essential 8 assessment, read the Essential 8 guide, see MSP solutions or pricing. To see what an assessor would still ask for, book a free proof check. We scan one tenant with you.
Your checklist
- Confirm the tender or DISP scope: which systems, which maturity level.
- Scan the tenant and mark every control met, not met or needs review.
- Save dated evidence for each control.
- Give every gap an owner and a fix date.
- Fix MFA and admin exceptions first.
- Record application control and backup test results.
- Re-scan in the final week.
- Have the director review and sign the cover statement.
Sources
- Department of Defence: DISP cyber and assurance, and eligibility and suitability pages
- Australian Signals Directorate: Essential Eight assessment process guide and maturity model changes, cyber.gov.au
- Australian National Audit Office: Management of cyber security supply chain risks
- HWL Ebsworth: update to the Commonwealth Procurement Rules
Keep reading: Essential 8 Maturity Level 2 and The evidence problem and Cyber insurance questionnaire: an MSP walkthrough and Supplier security questionnaire: answer it in a day