Free Essential Eight Self-Assessment | Perth

0 of 8 answered

1.Which best describes how your business controls which applications can run?

Anyone can install or run almost any software on their work computer.We use antivirus, but staff can still install most software themselves.Only approved software can run on most business devices.Application control is enforced and reviewed across all devices.

2.How quickly are security updates applied to applications (browsers, PDF readers, etc.)?

Updates happen occasionally, whenever someone gets around to it.Critical updates are usually applied within a couple of months.Critical updates are applied within about two weeks.Critical updates are applied within 48 hours, with regular vulnerability scanning.

3.How are Microsoft Office macros configured across your business?

Macros are left on default settings - they run for anyone who opens a file.Mostly default settings, with a few manual exceptions.Macros are blocked except for a small number of approved users or locations.Macros are blocked by default, with documented, regularly reviewed exceptions.

4.How are web browsers and everyday applications configured?

Default settings - nothing has been changed.A few security settings have been adjusted on some devices.Browsers are configured to block risky content like ads and untrusted plugins.Browser hardening is enforced and centrally managed across all devices.

5.Who has administrator access on your business computers?

Most staff have admin rights on their own computers.Some staff have admin rights they probably don't need.Admin rights are limited to IT staff or dedicated admin accounts.Admin accounts are separate from everyday accounts and reviewed regularly.

6.How quickly are operating system (Windows/macOS/server) updates applied?

Irregularly - updates get delayed or skipped.Usually within a couple of months.Critical updates within about two weeks.Critical updates within 48 hours, with regular vulnerability scanning.

7.Where is multi-factor authentication (MFA) currently enabled?

We don't use MFA anywhere.MFA is enabled for a few accounts or systems.MFA is enabled for email and remote access for all staff.MFA is enforced everywhere it's supported, including admin accounts.

8.How does your business handle backups?

We don't have a formal backup process.Important data is backed up, but restores aren't tested.Backups run regularly and are tested occasionally.Backups run regularly, are tested, and a copy is kept separate from production (offline or immutable).

Answer all 8 questions to see your estimated maturity level.

What the Maturity Levels Mean

The Essential Eight assesses each of its eight strategies against four maturity levels, from Maturity Level 0 (not yet implemented) to Maturity Level 3 (aligned against sophisticated, highly adaptive attackers).

Importantly, your overall maturity level isn't an average - it's determined by your weakest area. A business that's excellent at backups and patching but has no MFA is still only Maturity Level 0 overall, because a single major gap undermines the rest.

For most Perth SMBs, Maturity Level 1 is a realistic and proportionate baseline target - addressing the most common attack techniques without requiring enterprise-level resourcing.

FAQs

Is this self-assessment accurate?

It's a quick way to estimate roughly where your business sits against the Essential Eight, based on your own answers. It's a useful starting point, but it isn't a verified result - an independent assessment reviews evidence (configurations, policies, and logs) to confirm your actual maturity level.

How long does it take?

About 2 minutes. There are 8 questions, one for each Essential Eight strategy, with plain-English answer options.

What maturity level should my business be aiming for?

Most small and medium Perth businesses should aim for Maturity Level 1 as a baseline, with Level 2 recommended for businesses handling sensitive data, facing higher-value targeting, or needing to satisfy cyber insurance and tender requirements.

Is my information saved or sent anywhere?

No. This self-assessment runs entirely in your browser - your answers and results aren't recorded, stored, or sent to us unless you choose to contact us afterwards.

What happens after I get my result?

You'll see an estimated overall maturity level and which areas are holding it back. If you'd like a verified result and a prioritised, costed roadmap, you can book a full Essential Eight assessment with our team.

Essential Eight Self-Assessment