Essential Eight and Third-Party Risk: Extending ASD's Maturity Model to Vendors and Managed Service Providers

Can you reach your Essential Eight target if your vendors cannot?

Most Australian organizations treat the Essential Eight as an internal project. Patch the fleet, roll out phishing-resistant MFA, lock down macros, test the backups. Then they hand domain administrator rights to a managed service provider whose own maturity they have never assessed.

That is the gap. The Australian Signals Directorate (ASD) built the Essential Eight maturity model around your environment, but your environment is now operated, hosted, and patched in large part by third parties. If your MSP runs a monthly patch cycle, you cannot meet a 48-hour patching requirement for critical vulnerabilities in internet-facing services. If your SaaS providers hold sensitive data behind password-only logins, your MFA strategy has a hole in it.

ASD has been explicit about this for years. Its guidance on engaging managed service providers, first published in 2018 and updated in October 2021, was written after a string of MSP compromises and recommends that your contract require the MSP to implement cybersecurity guidance such as the Essential Eight. The maturity model itself names third parties directly. At Maturity Level One, multi-factor authentication must be used to authenticate users to third-party online services that process, store, or communicate your organization’s sensitive data.

So the practical question for a TPRM or security lead is not “are we Essential Eight compliant?” It is “which of our Essential Eight controls are actually performed or undermined by a vendor, and how would we know if they slipped?”

Why do Essential Eight programs break at the vendor boundary?

Four patterns show up again and again.

The MSP holds the keys, and nobody assessed the MSP

ASD’s MSP guidance describes malicious actors using compromised MSP workstations to move laterally into customer domain controllers, and using legitimate support accounts provisioned by MSPs to deploy malware into customer networks. Restricting administrative privileges is one of the eight strategies, yet many organizations exempt their MSP’s accounts from the very controls they apply internally. If the MSP is not inside your assessment scope, your administrative privilege maturity is a guess.

The vendor answers “yes” to “are you Essential Eight compliant?”

The Essential Eight is not a pass or fail certification. Maturity is assessed per mitigation strategy, from Maturity Level Zero to Maturity Level Three, and an organization’s overall level is effectively set by its weakest strategy. A vendor that is at Maturity Level Two for MFA and Maturity Level Zero for application control is not “Essential Eight compliant” in any useful sense. A yes or no question gets you a yes, and no evidence.

Contract patch SLAs do not match the maturity model

Since the November 2023 update, ASD’s model requires patches, updates, or other vendor mitigations for vulnerabilities in online services to be applied within 48 hours of release when vulnerabilities are assessed as critical by vendors or when working exploits exist. That applies from Maturity Level One. Plenty of MSP and hosting contracts still promise “monthly patching” or “patching within 30 days.” The contract is now the control, and it is the wrong one.

Third-party online services sit outside the asset list

Your scanners cover your fleet. They do not cover the SaaS payroll platform, the outsourced contact center portal, or the marketing agency’s file share that holds customer lists. The maturity model’s MFA requirements extend to third-party online services and third-party online customer services that process your sensitive data, and those services also carry external exposure you cannot see from inside your network. Without continuous external monitoring of those vendors, you find out about a problem when they tell you, or when someone else does.

How do you map the Essential Eight to your third parties?

Start by sorting vendors into three relationships, because each one touches the Essential Eight differently:

• Operators. MSPs, MSSPs, and outsourced IT who perform Essential Eight controls on your systems. Their performance is your maturity.
• Hosts. SaaS, cloud, and other online service providers that process, store, or communicate your sensitive data. Your MFA obligations reach them directly, and their security posture affects your data.
• Suppliers. Software and hardware vendors whose products you patch. Their vulnerability disclosure, patch release, and end-of-support practices set the clock for your patching strategies.

SAFE TPRM captures this at intake: what the vendor does, what access it has, and what data it handles. That context determines which assessment the vendor receives. Here is how each strategy translates into a vendor question.

Strategy-by-strategy vendor questions

• Patch applications. For operators and hosts: what is your documented timeframe for applying critical patches to internet-facing services, and can you show it was met for the last three critical vulnerabilities? Is it 48 hours or better?
• Patch operating systems. For operators: how do you patch operating systems of internet-facing servers and network devices you manage for us, and how do you identify unsupported operating systems?
• Multi-factor authentication. For hosts: does the service support MFA for our users, and is it phishing-resistant? For operators: is MFA enforced on every remote access path your staff use into our environment?
• Restrict administrative privileges. For operators: are your accounts in our environment attributable to named individuals, limited to least privilege, and revalidated at least every 12 months? Do you use just-in-time access for domain administration?
• Application control. For operators: is application control implemented on the workstations your staff use to administer our systems?
• Restrict Microsoft Office macros. For operators: how are macros controlled on administrative workstations?
• User application hardening. For operators: are administrative workstations hardened using ASD and vendor guidance?
• Regular backups. For operators and hosts: who performs backups of our data, how is restoration tested, and can privileged accounts on your side delete or modify our backups?

Our MSP and MSSP security questionnaire, patch management questionnaire, and identity and privileged access questionnaire give you ready-made question sets for strategies 1 to 4.

Ask for maturity per strategy, with evidence

Replace “are you Essential Eight compliant?” with “what maturity level have you assessed for each of the eight strategies, when, and who performed the assessment?” Ask for the assessment report or a summary of it. For Tier 1 operators, ask for evidence on the highest-risk strategies: patch timeframe reports, MFA configuration, privileged account lists. SAFE TPRM’s Document Analyzer can extract relevant content from the evidence the vendor uploads and map it to your questions, so analysts review the gaps instead of reading every page.

Write ASD’s recommendations into the contract

ASD’s MSP guidance gives you a clause list. The contract should:

• Require the MSP to implement cybersecurity guidance such as the Essential Eight and maintain a good internal security culture.
• Oblige the MSP to notify you of any cybersecurity incident that may endanger your network, including compromise of MSP systems used to administer or store your information.
• Define security clearances expected of MSP staff working on your systems.
• Require attributable accounts, MFA on remote access, and logging of hosts and networks used to connect to your environment.
• Oblige the MSP to provide detailed logs if you have security concerns. ASD recommends retaining event logs for at least 18 months.

Then set the patch SLA to match the maturity level you are targeting, not the vendor’s standard schedule.

Monitor between assessments

A vendor’s maturity assessment is a snapshot. Patching performance drifts, new services go live, certificates expire. SAFE TPRM’s Outside-In monitoring watches each vendor’s attributed external infrastructure for vulnerabilities on observed services, exposure changes, breach signals, and credential exposure, and shows what changed and why. A new critical vulnerability on an operator’s internet-facing service is exactly the kind of event that should trigger a reassessment.

Close the loop when something is found. A gap against your target maturity, such as an operator without MFA on one remote access path, becomes an issue with an owner, a due date, and either a remediation plan or a documented exception approved by the right person. Track the age of those issues. A vendor gap that stays open for 180 days is a risk acceptance decision whether or not anyone made it deliberately, and your risk committee should see it that way. Our vendor risk assessment process guide covers how to set those thresholds.

What breaks when you apply this to 200, 1,000, or 5,000 vendors?

At 200 vendors, you might have five operators, 60 hosts, and the rest suppliers. Assessing the five operators against all eight strategies with evidence is real work, but a team of two can do it.

At 1,000 vendors, you have perhaps 250 hosts holding sensitive data. Verifying MFA support and posture for each one manually is a full-time job for several people, and the answers go stale within months as services change.

At 5,000 vendors, a common size for large enterprises and government agencies once software suppliers are counted, manual tracking of supplier end-of-support dates and patch release practices simply does not happen. Teams fall back to annual questionnaires and hope.

SAFE TPRM keeps this tractable. Risk-based intake lets you send deep assessments to operators and high-risk hosts while lighter profiles cover the rest. AI-assisted answers drawn from documents the vendor already provided cut questionnaire turnaround, and reassessments pre-fill from prior responses. San Francisco Health Plan uses SAFE to speed up third-party risk assessments by 90%. Outside-In monitoring covers the long tail of hosts and suppliers between assessments, so your analysts spend time on the vendors whose posture actually changed.

What trade-offs come with holding vendors to Essential Eight levels?

Your target versus theirs. If your organization targets Maturity Level Two, should every vendor? For operators who administer your environment, yes, at least for the strategies they perform. For a small SaaS provider, demanding Maturity Level Two across the board will stall procurement and may not reflect the risk. Tie the requirement to the relationship type and data sensitivity.

Self-assessment versus independent assessment. Independent Essential Eight assessments cost money and time. Self-assessments are cheap and optimistic. Most programs accept self-assessment for Tier 2 and require independent evidence for Tier 1 operators.

Evidence burden versus vendor goodwill. Every evidence request costs the vendor time. Ask for everything and response rates drop.

SAFE TPRM helps resolve these. Questionnaire profiles let you set different requirements by tier and relationship type, chosen from the context captured at intake. Outside-In monitoring gives you independent external evidence on patching exposure without asking the vendor for anything. And vendor interaction tools, including reuse of documents already submitted, reduce how often you go back to the vendor with the same question.

Why SAFE TPRM for Essential Eight-aligned vendor programs?

We built SAFE TPRM because third-party cyber risk is where well-run internal programs most often come apart. SAFE does not assess your vendors’ Essential Eight maturity for you, and it does not certify anyone. It supports the assessment, evidence review, monitoring, remediation, and reporting work that lets you hold vendors to the standard you set.

• Context-driven intake. Capture the vendor’s role (operator, host, supplier), access, and data at intake. The Intake Score reflects inherent risk; the Exposure Score tracks residual risk as evidence arrives. The two stay separate so you can see both.
• Questionnaires and AI-assisted review. Send strategy-by-strategy question sets, let vendors answer with AI suggestions drawn from their own documents, and use AI review to flag gaps and conflicts with citations to the source evidence. Your analysts make the call.
• Outside-In continuous monitoring. Monitor vendors’ domains, certificates, internet-facing services, vulnerabilities on observed services, email security, breach signals, and credential exposure, with change explanations.
• Issues and remediation. Turn a missing control or a patch SLA breach into an issue with an owner, a due date, and an exception path. Trigger reassessment when monitoring shows a material change.
• Reporting. Portfolio dashboards and one-click reports show where vendor gaps sit against your target, for the risk committee or the board.

For how the Essential Eight sits alongside other frameworks, see our guide to TPRM compliance frameworks. To see the workflow end to end, watch SAFE TPRM in action or schedule a demo.

Frequently Asked Questions

Does the Essential Eight apply to third parties and managed service providers?

What changed in the November 2023 Essential Eight update that affects vendors?

What should we ask an MSP about the Essential Eight?

Do government agencies have to hold vendors to Essential Eight Maturity Level Two?

How does the Essential Eight relate to APRA CPS 234 for regulated entities?

Can continuous monitoring tell us whether a vendor meets Essential Eight patching timeframes?