Inside a large-scale Essential Eight uplift: What actually moves the needle

Everyone talks about Essential Eight maturity in terms of controls. Application control. Patching cadence. MFA coverage. Restricting admin privileges. All correct – but none of these are the hardest part.

The hardest part is the people – having the right ones, in the right sequence, doing the right work, inside an organisation that still has to keep operating while you rebuild its security posture.

Sarah Friggieri from Needus led change management for the Essential Eight maturity uplift for the NSW Department of Education – the largest ecosystem in the southern hemisphere. Thousands of schools. Hundreds of thousands of endpoints. Millions of users. Decades of legacy systems that couldn’t simply be switched off while the uplift happened around them.

Here’s what she learnt.

Sequencing beats urgency

Every uplift program has more urgent needs than it has people to meet them. The instinct is to hire against whichever gap feels loudest that month, but that’s how you end up with a GRC lead and nobody to implement what they've documented, or three application control specialists and nobody who can translate the roadmap into a Board-level conversation about risk appetite. We built hiring around the maturity roadmap itself – what needed to be true at each stage and who could actually deliver that stage – rather than around whichever fire was burning hottest. It's a less satisfying way to hire in the short term, but it's the only way that gets the whole program to maturity on time.

“Done it before” means something specific here

A CV full of Essential Eight experience doesn't tell you much on its own. What matters is whether someone has done it at this kind of scale, inside this kind of environment – multiple stakeholders, legacy infrastructure, a workforce that isn't primarily technical and a public accountability the private sector rarely has to answer to. We looked past the certifications to the actual environments people had operated in; someone who'd uplifted a 200-person fintech wasn't automatically the right fit for an ecosystem this size, however strong their CV looked on paper.

Capability gaps don't fix themselves with contractors

It's tempting, under time pressure, to paper over a capability gap with short-term contract resourcing. Sometimes that's the right call, but it often just defers the problem – and the cost – twelve months. Being honest early about where the internal team's capability genuinely fell short let us make deliberate calls about what to build permanently versus what to bring in for a defined phase. That distinction matters more than most uplift plans give it credit for.

What this means if you're mid-uplift (or about to start one)

If your agency is scoping an Essential Eight uplift, or already inside one and feeling the strain, there are a few questions worth asking now:

1. Does our hiring sequence actually match our maturity roadmap, or are we hiring reactively?

2. Are we assessing candidates against the scale and constraints of our own environment, or simply against a generic checklist of Essential Eight experience?
3. Where are we quietly relying on contractors to cover a gap we should be resourcing permanently?

I’m happy to talk through more of what I learnt on this program with any agency navigating similar territory – what worked, what I’d do differently and how the hiring side of an uplift can either accelerate or stall the whole thing.