Department of Planning, Lands and Heritage (DPLH)

Engagement: ACSC Essential Eight maturity assessment with targeted uplift plan

The challenge

DPLH wanted clear, defensible visibility of its Essential Eight posture across diverse environments and suppliers—and a pragmatic path to reach target maturity without disrupting critical services.

What we did

Working with cyber, infrastructure, and application leads, we delivered a focused assessment and an actionable roadmap:

Baseline & verification: Reviewed configurations, change records, and samples from SOE/RMM, M365, identity, and backup platforms; validated with spot checks and evidence packs.

Maturity scoring: Assessed each strategy (Application Control, Patch Apps/OS, Configured MS Office, User App Hardening, MFA, Backups, Restrict Admin) against the ACSC model; reconciled gaps with control owners.

Quick wins & risk-based plan: Issued a 90-day quick-wins list (e.g., MFA coverage gaps, macro settings, privilege recertification) and a phased roadmap to reach the agreed target level.

Operating model hooks: Embedded uplift tasks into existing change/incident workflows and defined simple KPIs/KRIs for monthly reporting.

Executive narrative: Produced a concise board pack translating maturity scores into risk and service impact.

Results

Clear, auditable maturity baseline with evidence for each control.

Roadmap to target maturity with owners, timelines, and dependencies agreed.

Lightweight metrics to track progress and sustain gains.