The Australian Cyber Security Centre's Essential Eight is the baseline cybersecurity framework for Australian organisations. This interactive tool lets you assess your current maturity level across all eight strategies — and understand exactly where your gaps are.
Complete the checklist below to generate your personalised Essential Eight maturity snapshot.
Discuss your results with a former ASX-listed CISO — no obligation.
The Essential Eight is a set of eight mitigation strategies developed by the Australian Cyber Security Centre (ACSC) to help organisations protect themselves against the most common cyber threats. Originally developed for the federal government, it has become the de facto baseline cybersecurity framework for Australian businesses of all sizes and sectors.
Unlike compliance frameworks that focus primarily on documentation and policy, the Essential Eight is control-focused — it specifies technical and procedural controls that, when implemented, materially reduce the likelihood and impact of cyber incidents including ransomware, data breaches, and business email compromise.
Whilst not currently mandatory for most private sector organisations, the Essential Eight is increasingly referenced by:
Regulators — APRA, OAIC, and sector-specific regulators use it as a benchmark for assessing security posture. Insurers — cyber insurance providers routinely ask about Essential Eight compliance during underwriting. Enterprise clients — government supply chain and procurement teams require it from vendors. Investors — sophisticated investors conducting security due diligence reference it as a minimum bar.
Prevent unapproved or malicious programs from executing on systems.
Remediate known security vulnerabilities in applications within defined timeframes.
Restrict and control Office macro settings to reduce malicious document risk.
Configure browsers and office applications to reduce attack surface.
Limit administrative access to only those who need it, and only when needed.
Remediate known security vulnerabilities in operating systems promptly.
Require multiple verification methods for access to systems and data.
Maintain tested backups of data, software, and configuration to enable recovery.
Each of the eight strategies is assessed at one of four maturity levels. The ACSC recommends that most organisations target Maturity Level Two as a practical minimum — Level Three is required for government entities and those in critical infrastructure.
The control does not exist or is implemented in a way that is ineffective. There are significant vulnerabilities that adversaries are likely to exploit.
Basic controls are in place but incomplete. Protection exists against opportunistic, non-targeted threats but would not withstand a determined adversary.
Controls are broadly in place and effective. Protection against targeted threats using common tools and techniques. Recommended minimum for most organisations.
Controls are fully implemented and verified. Protection against sophisticated, targeted threats. Required for government entities and critical infrastructure.
For each control, select: ✓ Yes (fully in place), ~ Partial (partially implemented), or ✗ No (not in place). Answer honestly — this is for your benefit.
Note: This is a high-level self-assessment tool. It does not replace a professional gap analysis. For a detailed assessment of your Essential Eight maturity, book a discovery call.
This assessment gives you a baseline — a clear picture of where you stand relative to the ACSC's recommended controls. The next step depends on your situation.
If you answered "No" or "Partial" to most controls in Strategies 5, 7, and 8 (admin privileges, MFA, and backups), those are your highest-priority items — they directly address ransomware, which remains the most common and damaging threat to Australian SMBs.
If you're approaching a compliance requirement — whether for a government contract, an enterprise client, or a regulatory obligation — you'll need more than a self-assessment. A professional gap analysis with a documented remediation plan will be required.
A note on honesty: The value of this assessment depends entirely on accurate self-reporting. We've seen organisations score themselves at Maturity Level 2 or 3 and then discover during an actual audit that key controls had significant gaps. If you're unsure about a control, mark it as 'Partial' rather than 'Yes' — it will give you a more useful picture.
A self-assessment is a starting point. Moving from here to a documented, defensible Essential Eight programme involves:
Portcullis Security delivers all of the above as part of a fractional CISO engagement. If you'd like to discuss your results and understand what a practical remediation programme would look like for your organisation, book a free 30-minute discovery call.