Essential 8 maturity self-assessment — where does your business stand?
Free Essential 8 self-check for Melbourne businesses: tick the controls you have in place, see your gaps in 60 seconds and what to fix first.
How many of the Essential 8 do you have?
Tick the controls you're confident are in place. No email required — just an honest gut-check.
Tick the controls you have in place to see where you stand.
Key IT's Essential 8 assessment is a free self-check that shows Melbourne businesses where they stand against the ACSC's Essential Eight in about a minute: a quick check of which of the eight controls you have in place and which are gaps. Most businesses have no clear idea how exposed they are — this gives you a starting point with no cost, no obligation and no sales pitch.
Update, 15 October 2026: the Australian Signals Directorate (ASD) has released ASD Essentials to succeed the Essential Eight. This self-check still uses the eight Essential Eight controls because insurers, tenders and clients still ask for Essential Eight evidence, and the Essential Eight stays on cyber.gov.au through a transition expected to take a year or two.
How does the Essential 8 self-assessment work?
Tick each Essential Eight control you're confident is fully in place, and the ring shows how many of the eight you have covered. Any control you can't tick is a gap to look at first. It is a quick gut-check, not a maturity rating, and nothing you tick is sent to us.
A real maturity level needs more than a tick. The ACSC rates each control against specific requirements for Maturity Levels One, Two and Three, and sets your overall level by your weakest control. "Does not yet meet Level One" means a control still has real gaps. Level One holds off opportunistic attackers using off-the-shelf tools. Level Two stands up to attackers who put more time and effort into a chosen target. Level Three is built for adaptive adversaries who rely less on public tools. For most small businesses, Level One across every control is the first goal, and our free review checks it on your real systems.
Which Essential Eight controls does the assessment check?
It checks all eight mitigation strategies the ACSC recommends as a baseline for Australian organisations:
Application control
Only approved software is allowed to run.
Patch applications
Browsers, Office, PDF readers and other apps are updated quickly.
Configure Microsoft Office macro settings
Macros from the internet and unknown publishers are blocked.
User application hardening
Browsers and apps are locked down so they cannot run malicious content.
Restrict administrative privileges
Admin rights are kept to the few who need them and reviewed.
Patch operating systems
Windows, macOS and server updates are applied on time.
Multi-factor authentication
A second check guards email, remote access and admin logins.
Regular backups
Data is backed up, protected from deletion and proven by test restores.
Our Essential Eight explained in plain English walks through each control, and vulnerability scanning finds the missing patches across your network.
What does the free Essential 8 check give you?
A count of the eight controls you have in place, out of eight.
Your strongest controls
Where you are already doing well.
The controls dragging your score down
Where to focus first.
A clear next step
Book a free review to turn the result into a plan.
Is a self-assessment the same as a formal Essential Eight audit?
No. It is a quick self-check to orient you, not an audit. A formal Essential Eight maturity assessment checks the evidence behind each answer — settings, patch records, backup restores — the kind of proof insurers and larger clients ask for. For a verified assessment and a roadmap, the next step is our Essential 8 service or a free cybersecurity health check.
Want your whole setup checked, not just the Essential Eight? Our IT audit for Melbourne businesses also covers Microsoft 365 settings, backups, the firewall and licences, and rates each Essential Eight control using ASD's Essential Eight assessment process guide.
Who should take the Essential 8 assessment?
It suits any Melbourne business that wants an honest read on its cyber maturity before someone else grades it. It is a quick first step toward Essential 8 compliance when a cyber insurance renewal, a larger client's vendor security review or a government tender starts asking about your controls. For most private businesses the Essential Eight is not a legal requirement, but insurers and buyers increasingly expect it — our article on who is judging your Essential Eight in 2026 explains why.
Frequently asked questions
How long does the Essential 8 self-assessment take?
About a minute. You tick eight plain-English controls — no technical jargon required.
Is it really free?
Yes. There is no charge and no obligation, and you do not need to become a Key IT client to see your result.
How accurate is a self-assessment?
It is only as accurate as your ticks, and it does not test the requirements for each maturity level. Our free review checks them on your real systems.
What happens after I get my result?
Tackle the gaps yourself, or book a free review where we walk through your result and outline how to lift your weakest controls.
Can I use my result for a cyber insurance questionnaire?
Use it to prepare, not as proof. It helps you answer insurer questions honestly, but an insurer may ask for evidence that the controls are actually in place. Our Essential 8 service backs your answers with maturity scoring and documentation you can hand to an insurer or broker — see what cyber insurers now require.
Does ASD Essentials make this self-check out of date?
No. Your existing Essential Eight work still counts, though ASD advises checking your controls against Essentials rather than assuming they are equivalent. Essentials starts with identity services and internet-facing devices, so MFA, tight admin rights and patched firewalls and VPNs pay off under either framework. Your result shows where your MFA, admin rights and patching stand today.
Do I have to give my details to see the result?
No. Your score appears as you tick, and nothing you tick is sent to us.
What if I score poorly?
That is exactly what the tool is for — to find the gaps before an attacker does. A low score is a starting point, not a judgement, and every control can be lifted.
Take the assessment
Tick the eight controls above now — or call 1300 053 948 to book a free review.
Related services & guides
150+ Melbourne organisations, looked after every day
From manufacturing and healthcare to finance, body corporate and professional services — a few of the businesses whose IT and security we run every day.
Elite Body Corporate
Probus GroupBook your free IT & Cyber Security Review
See exactly where your IT and security stand, and what to fix first. No jargon, no obligation.