What is an Essential 8 assessment?

An Essential 8 assessment evaluates how well your business implements the eight cybersecurity mitigation strategies defined by the Australian Cyber Security Centre. The assessment returns a maturity level (ML1, ML2, or ML3) per strategy plus an overall maturity score.

Is the CYBERWHITE Essential 8 assessment free?

Yes. The CYBERWHITE Essential 8 self-assessment is free, no credit card required. Results plus a prioritised gap-closure plan are delivered by email in PDF format.

How long does the Essential 8 assessment take?

The self-assessment typically takes about 5 minutes. You answer questions about how well your business currently implements each of the eight strategies, then receive your maturity score and gap-closure plan by email.

What does Essential 8 ML1 mean?

Essential 8 Maturity Level 1 (ML1) is the foundational tier of the framework. It defends against opportunistic threats using commodity attack techniques. ML1 is the most common starting point for Australian SMBs and is achievable in 60 to 120 days for most Microsoft 365 environments.

Is Essential 8 mandatory for Australian businesses?

Essential 8 at Maturity Level 2 is mandatory for Australian Federal Government non-corporate Commonwealth entities. For private-sector businesses it is not legally mandatory but is strongly recommended by the ACSC and is increasingly required by enterprise customers, government contractors, and cyber insurers.

How does the Essential 8 assessment compare to a paid audit?

A self-assessment gives you a directional baseline of your maturity. A paid audit from an accredited assessor produces evidence acceptable to government and insurers. Many Australian businesses use the free CYBERWHITE assessment first to identify gaps, then pursue a paid audit only once they have closed the obvious gaps.

Free Assessment Tool

Essential 8 Maturity Level Self-Assessment

A 2-minute self-check across the eight strategies to spot your likely gaps. Answer 24 questions and get an indicative maturity level.

This is a self-rated indicator, not an official ACSC rating. It reflects what you believe is in place. To verify it against your actual Microsoft 365 configuration, connect your tenant and we scan it in about 5 minutes.

Progress0% complete

Controls 1-3

Controls 4-5

Controls 6-8

Current Score:0/72

ML0 - Early stage (indicative)

Application Control

Do you have an application allowlist/whitelist implemented?

Are execution prevention rules configured for user profiles?

Is application control validated and audited regularly?

Patch Applications

Are security updates for applications applied within 48 hours for extreme vulnerabilities?

Do you have an automated vulnerability scanning process?

Is there a documented patching policy with defined timeframes?

Configure Microsoft Office Macros

Are macros disabled for files from the internet?

Are macro security settings centrally managed via GPO/Intune?

Is there logging/monitoring of macro execution attempts?

Please answer all questions in this section to continue