Essential Eight security check
Eight plain-English questions based on the Essential Eight, the Australian Government's list of eight basic security controls. You'll get a rough maturity level for each one and what to fix first. Your answers stay in your browser unless you choose to send them to us.
Rather talk it through? Call us on 03 8400 0092 or book a free consultation.
0/100 toward Level 1
Your result
-
Multi-factor authentication
To reach Level 1: Enforce MFA on every account that reaches email, Microsoft 365 and cloud apps holding business data, then close the exceptions one by one. Passkeys are the best choice, because they also get you most of the way to Level 2.
To reach Level 2: Move staff and admins to phishing-resistant sign-in (passkeys, FIDO2 keys or Windows Hello for Business), extend MFA to computer logon, and keep sign-in logs somewhere they cannot be altered.
To reach Level 3: Extend phishing-resistant MFA to important data repositories and put someone on the hook for reviewing sign-in events promptly.
Meets your target.
-
Regular backups
To reach Level 1: Back up data, applications and settings on a schedule that matches their importance, keep copies where ransomware cannot reach them, and run a restore test — then write down the result.
To reach Level 2: Restrict backups to dedicated backup administrator accounts, so a compromised staff or admin account cannot read, change or delete them.
To reach Level 3: Make backups immutable for their retention period, so not even a backup administrator can alter or delete them.
Meets your target.
-
Patch applications
To reach Level 1: Set up automated asset discovery and vulnerability scanning, patch browsers, Office, email, PDF and security products within two weeks (48 hours for critical internet-facing flaws), and remove unsupported versions.
To reach Level 2: Bring every other application into scanning at least fortnightly and patch it within one month.
To reach Level 3: Patch critical or exploited flaws in common applications within 48 hours, and remove any application its vendor no longer supports.
Meets your target.
-
Patch operating systems
To reach Level 2: Scan internet-facing systems daily and everything else at least fortnightly, patch internet-facing systems within two weeks (48 hours if critical) and everything else within a month, and replace unsupported operating systems. Levels 1 and 2 share these requirements.
To reach Level 3: Patch critical or exploited flaws within 48 hours on every device, bring drivers and firmware into the cycle, and keep every device on the latest or previous operating system release.
Meets your target.
-
Restrict administrative privileges
To reach Level 1: Remove everyday admin rights from staff, give admins separate admin-only accounts with no email or web access, and approve admin access when it is requested.
To reach Level 2: Re-approve admin access yearly, disable it after 45 days unused, route admin work through jump servers, manage local admin passwords (for example with Windows LAPS) and service account passwords (for example with group managed service accounts), and log admin activity centrally.
To reach Level 3: Move admin work to secure admin workstations, switch to just-in-time admin access (for example Entra Privileged Identity Management), limit rights to each task, and enable Credential Guard.
Meets your target.
-
Restrict Microsoft Office macros
To reach Level 1: Disable macros for staff without a business need, block macros in files from the internet, turn on macro antivirus scanning and lock the settings by policy.
To reach Level 2: Block Win32 API calls from macros and log allowed and blocked macro activity centrally.
To reach Level 3: Allow only macros from trusted locations or signed by vetted publishers, and review the trusted publisher list at least yearly.
Meets your target.
-
User application hardening
To reach Level 1: Block web ads and internet Java in browsers, disable Internet Explorer 11, and lock browser security settings by policy.
To reach Level 2: Apply ASD or vendor hardening guidance to browsers, Office and PDF software (attack surface reduction rules do much of this), and log PowerShell and process-creation events centrally.
To reach Level 3: Remove .NET Framework 3.5 and older and Windows PowerShell 2.0, and enforce PowerShell Constrained Language Mode.
Meets your target.
-
Application control
To reach Level 1: Turn on application control on workstations (App Control for Business or AppLocker) so only approved programs, scripts and installers run from user profile and temporary folders.
To reach Level 2: Extend application control to every folder on workstations and to internet-facing servers, apply Microsoft’s recommended block rules, review the rules at least yearly, and log allowed and blocked events centrally.
To reach Level 3: Cover all servers and drivers, and apply Microsoft’s vulnerable driver block list.
Meets your target.
Want help with your results?
Send your results to us and we'll call you to go through the gaps and what it would take to fix them. It's free, and there's no obligation.
Fields marked with an asterisk are required.
What happens next
- We'll get back to you within one business day.
- We'll have a 20-minute call to understand what's going on and what you need.
- If we can help, you'll get a written proposal with the scope, price and start date.
We'll use your details to contact you about your results. See our privacy policy.
On Microsoft 365 with Windows computers, our managed IT plan aims for Maturity Level One on seven of the eight, for the systems we manage. See what's included ↗
This is an indicative self-assessment based on ASD’s Essential Eight Maturity Model (November 2023). Each strategy is condensed into one question and the result depends on your answers, so it is not an audit and it does not certify anything. A real assessment tests each requirement against evidence.
In October 2026, the Australian Signals Directorate published ASD Essentials, which builds on the Essential Eight. Insurers, clients and government buyers still ask about the Essential Eight, so this check still uses it. Much of the work you do on it carries across, but ASD Essentials assesses it differently and your maturity level doesn't convert automatically. Ask us what the change means for your business.