Stop grading Essential Eight maturity in a spreadsheet.
Rampart Nexus is where auditors run Essential Eight assessments end to end — scoring, sign-off, findings, and client reporting — with one version of the truth per engagement, not a file called final_v3_USE_THIS.xlsx.
The framework was never the hard part. Keeping the file honest was.
Every audit shop has one: a shared workbook that's been passed between assessors for two years, with a macro nobody wants to touch and a "final" tab that isn't.
- Every assessor phrases the same requirement differently
- Sign-off is an email, not a state
- One tab per client, copy-pasted and drifting
- Findings live in comments, not a register
- One broken formula and the whole score is wrong
- Requirements pulled straight from the ASD framework, worded the same way every time
- Draft → in review → signed off, enforced by role
- Every client and engagement scoped and isolated
- A real findings register — severity, owner, target date
- Scoring runs from the framework, not a formula you inherited
Eight mitigation strategies. One place to assess all of them.
Rampart Nexus is structured around the ASD Essential Eight exactly as published — nothing renamed, nothing reordered — so what's on screen matches what you'll write in the report.
Patch Applications
Closing known vulnerabilities in internet-facing software before they're exploited.
Patch Operating Systems
The same discipline, applied to the OS layer that everything else runs on.
Multi-factor Authentication
A second, verified factor on the accounts and services that matter most.
Restrict Administrative Privileges
Admin rights granted by need, reviewed on a schedule, revoked when work ends.
Application Control
Only approved, trusted executables and scripts are allowed to run.
Restrict MS Office Macros
Macros disabled by default, only enabled from vetted, signed sources.
User Application Hardening
Browsers and everyday apps configured to shrink their own attack surface.
Regular Backups
Backups taken, tested, and kept isolated from the accounts that could delete them.
Every control sits at a level. Rampart Nexus shows you the climb.
Maturity isn't pass or fail — it's how much tradecraft an organisation can currently resist. Rampart Nexus scores each of the eight strategies against all four levels and rolls them up automatically.
Gaps in the basics
Controls aren't yet in place, or don't hold up against the intent of the strategy. The starting point for most first assessments.
Resists opportunistic attempts
Enough is in place to stop attackers relying on publicly available, low-effort techniques and default tooling.
Resists targeted effort
Controls hold up against adversaries willing to invest more time — social engineering, some tailoring, more patience.
Resists sophisticated tradecraft
Controls are tuned to slow down and detect adversaries who adapt their approach specifically to get past them.
Everything an assessment needs, none of it in a cell reference.
Rampart Nexus covers the full lifecycle of an engagement — not just the scorecard.
Sign-off workflow
Draft, in review, signed off — with the transition rules your firm actually wants, and a locked record once a client accepts it.
Findings register
Every gap becomes a tracked finding — severity, recommendation, owner, and target date — sorted and scoped per assessment.
Role-based access
Viewer, Assessor, Auditor, Admin, Owner — each sees and can change exactly what their role allows, enforced on the server, not just hidden in the UI.
Multi-client organisations
Every client engagement lives in its own isolated organisation — nothing bleeds across clients, ever, by design not by convention.
Client-ready reporting
Executive summary, per-control scorecards, and the findings register in a single report, built from live assessment data.
Partner & licensing console
Reseller-friendly — manage multiple client organisations and licenses under a partner account, or run a single license yourself.
Built for how an audit engagement is actually staffed.
Viewer
Client-side stakeholders who need visibility into progress and findings, without edit access.
Assessor
Does the day-to-day scoring and submits an assessment for review when it's ready.
Auditor
Owns the findings register and the accuracy of the assessment as it's being built.
Admin / Owner
The only roles that can sign off an assessment, manage users, or revert a submission to draft.
Bring your next Essential Eight engagement into Rampart Nexus.
15 minutes, your actual framework, no slide deck.