Free Essential Eight Self-Assessment | Perth

0 of 8 answered

1.Which best describes how your business controls which applications can run?

Anyone can install or run almost any software on their work computer.We use antivirus, but staff can still install most software themselves.Only approved software can run on most business devices.Application control is enforced and reviewed across all devices.

2.How quickly are security updates applied to applications (browsers, PDF readers, etc.)?

Updates happen occasionally, whenever someone gets around to it.Critical updates are usually applied within a couple of months.Critical updates are applied within about two weeks.Critical updates are applied within 48 hours, with regular vulnerability scanning.

3.How are Microsoft Office macros configured across your business?

Macros are left on default settings - they run for anyone who opens a file.Mostly default settings, with a few manual exceptions.Macros are blocked except for a small number of approved users or locations.Macros are blocked by default, with documented, regularly reviewed exceptions.

4.How are web browsers and everyday applications configured?

Default settings - nothing has been changed.A few security settings have been adjusted on some devices.Browsers are configured to block risky content like ads and untrusted plugins.Browser hardening is enforced and centrally managed across all devices.

5.Who has administrator access on your business computers?

Most staff have admin rights on their own computers.Some staff have admin rights they probably don't need.Admin rights are limited to IT staff or dedicated admin accounts.Admin accounts are separate from everyday accounts and reviewed regularly.

6.How quickly are operating system (Windows/macOS/server) updates applied?

Irregularly - updates get delayed or skipped.Usually within a couple of months.Critical updates within about two weeks.Critical updates within 48 hours, with regular vulnerability scanning.

7.Where is multi-factor authentication (MFA) currently enabled?

We don't use MFA anywhere.MFA is enabled for a few accounts or systems.MFA is enabled for email and remote access for all staff.MFA is enforced everywhere it's supported, including admin accounts.

8.How does your business handle backups?

We don't have a formal backup process.Important data is backed up, but restores aren't tested.Backups run regularly and are tested occasionally.Backups run regularly, are tested, and a copy is kept separate from production (offline or immutable).

Answer all 8 questions to see your readiness summary.

What the Maturity Levels Mean

The Essential Eight assesses each of its eight strategies against four maturity levels, from Maturity Level 0 (not yet implemented) to Maturity Level 3 (aligned against sophisticated, highly adaptive attackers).

Importantly, your overall maturity level isn't an average - it's determined by your weakest area. A business that's excellent at backups and patching but has no MFA is still only Maturity Level 0 overall, because a single major gap undermines the rest.

Set your target using business risks and the requirements of clients, insurers and regulators. This readiness checklist cannot assign or verify a maturity level.

FAQs

Is this self-assessment accurate?

It identifies reported gaps using eight introductory questions. It cannot assign an official maturity level. It's a useful starting point, but it isn't a verified result - an independent assessment reviews evidence (configurations, policies, and logs) to confirm your actual maturity level.

How long does it take?

About 2 minutes. There are 8 questions, one for each Essential Eight strategy, with plain-English answer options.

What maturity level should my business be aiming for?

Choose a target based on your risks and applicable contractual, insurer and regulatory requirements. A qualified assessment can help define that target; this checklist cannot confirm compliance.

Is my information saved or sent anywhere?

No. This self-assessment runs entirely in your browser - your answers and results aren't recorded, stored, or sent to us unless you choose to contact us afterwards.

What happens after I get my result?

You'll see a readiness summary and reported areas to review. If you'd like a verified result and a prioritised, costed roadmap, you can book a full Essential Eight assessment with our team.

Essential Eight Self-Assessment