Free Essential 8 Assessment: Check Your ML1-ML3 Maturity
A 2-minute self-check across the eight strategies to spot your likely gaps. Answer 24 questions and get an indicative maturity level.
This is a self-rated indicator, not an official ACSC rating. It reflects what you believe is in place. To verify it against your actual Microsoft 365 configuration, connect your tenant and we scan it in about 5 minutes.
Application Control
Do you have an application allowlist/whitelist implemented?
Are execution prevention rules configured for user profiles?
Is application control validated and audited regularly?
Patch Applications
Are security updates for applications applied within 48 hours for extreme vulnerabilities?
Do you have an automated vulnerability scanning process?
Is there a documented patching policy with defined timeframes?
Configure Microsoft Office Macros
Are macros disabled for files from the internet?
Are macro security settings centrally managed via GPO/Intune?
Is there logging/monitoring of macro execution attempts?
Please answer all questions in this section to continue
About the Essential 8 assessment tool
This Essential 8 assessment tool evaluates how well your business implements the eight cybersecurity mitigation strategies defined by the Australian Cyber Security Centre (ACSC): application control, patching applications, configuring Microsoft Office macros, user application hardening, restricting administrative privileges, patching operating systems, multi-factor authentication, and regular backups. The assessment returns a maturity level (ML1, ML2, or ML3) per strategy plus an overall maturity score.
This free self-assessment gives you a directional baseline in about 5 minutes. For a verified result based on your actual Microsoft 365 configuration rather than a self-rating, connect your tenant and CYBERWHITE's compliance agents check it directly.
Frequently asked questions
What is an Essential 8 assessment?
An Essential 8 assessment evaluates how well your business implements the eight cybersecurity mitigation strategies defined by the Australian Cyber Security Centre. The assessment returns a maturity level (ML1, ML2, or ML3) per strategy plus an overall maturity score.
Is the CYBERWHITE Essential 8 assessment free?
Yes. The CYBERWHITE Essential 8 self-assessment is free, no credit card required. Results plus a prioritised gap-closure plan are delivered by email in PDF format.
How long does the Essential 8 assessment take?
The self-assessment typically takes about 5 minutes. You answer questions about how well your business currently implements each of the eight strategies, then receive your maturity score and gap-closure plan by email.
What does Essential 8 ML1 mean?
Essential 8 Maturity Level 1 (ML1) is the foundational tier of the framework. It defends against opportunistic threats using commodity attack techniques. ML1 is the most common starting point for Australian SMBs and is achievable in 60 to 120 days for most Microsoft 365 environments.
Is Essential 8 mandatory for Australian businesses?
Essential 8 at Maturity Level 2 is mandatory for Australian Federal Government non-corporate Commonwealth entities. For private-sector businesses it is not legally mandatory but is strongly recommended by the ACSC and is increasingly required by enterprise customers, government contractors, and cyber insurers.
How does the Essential 8 assessment compare to a paid audit?
A self-assessment gives you a directional baseline of your maturity. A paid audit from an accredited assessor produces evidence acceptable to government and insurers. Many Australian businesses use the free CYBERWHITE assessment first to identify gaps, then pursue a paid audit only once they have closed the obvious gaps.
Want a fuller picture? Read about Essential 8 compliance or how it compares to SMB1001.